Updating to version 3.20.2

Libraries added to the ICF server

The installation program now empties [Install directory]/ICF/server/lib on every update, so that libraries from an older version do not linger next to the new ones. A library you added to that directory yourself, such as a JDBC driver (jt400.jar for an AS400 database, for example) or the PeopleSoft libraries psjoa.jar and psft.jar, is deleted as well.

Pre-update tasks

• (If you added libraries to ICF/server/lib) Copy them out of [Install directory]/ICF/server/lib before running the installation program.

  Required

  Left in place, the library is deleted by the update and the connectors that need it fail with a ClassNotFoundException.

Pre-startup tasks

• (If you added libraries to ICF/server/lib) Place the libraries you copied out back in [Install directory]/ICF/server/lib.

  This has to be done again after every update to a version from 3.20.2 to 3.21.0. From version 3.21.1 on, place these libraries in ICF/server/ext_lib instead, which the update does not touch: see Updating to version 3.21.1.

Notification templates

The values an email template renders are now escaped before they reach the body, so that a name, a justification or any other stored text cannot carry markup or code into a notification.

Template expressions are also resolved more strictly. An attribute that does not exist on the object it is read from — identity.invalidAttribute, for example — used to render as if its value were empty; the rendering now fails instead. Every attribute a template names must be a valid one.

The templates shipped with RAC/M are updated. The tasks below apply only if you deployed your own copy of a notification template, which the update does not rewrite.

Post-startup tasks

• (If you customized the notification templates) Replace the == true comparison of the removed roles in remove_accesses_request/<language>/task.html:

  Required

  Left as it is, the task notification of a remove accesses request is no longer sent at all: the comparison fails while the body is rendered and the notification is abandoned.

  Before:

  @if{request.?rolesToRemoveLi == true}

  After:

  @if{request.?rolesToRemoveLi != ''}

  If you personalized other templates, make sure the following attributes do not use == true:

  • accountsToActivateLi
  • groupsToAddLi
  • groupsToRemoveLi
  • rolesToAddLi
  • rolesToRemoveLi
  • toAddLi
  • toRemoveLi
  • writtenRequestListLi
  • writtenRequestsLi

• (If you customized the notification templates) Correct or remove every attribute your templates name that does not exist on the object it is read from, such as identity.invalidAttribute:

  Required

  Left as it is, the notification is no longer sent: the unknown attribute fails the rendering of the body and the notification is abandoned.

  A misspelled attribute, or one that no longer exists in the model, used to go unnoticed because it rendered as an empty value. It now stops the rendering, so review the attributes of each template you deployed against the ones the object actually exposes.

  The null-safe form @{identity.?department} does not help here: it guards against a value that is null, not against an attribute that does not exist.