Caché Upgrade Checklists - InterSystems Documentation

Developers6.2.10 CSP Changes6.2.10.1 Keep CSP Info Off Insecure Channels When Using HTTPSIn previous versions, the CSP sessionId cookie that Caché sent to the browser did not have the 'secure' flag set. This meantthat if an https CSP application could force the browser to go to the same web site with http rather than https. In this case,the browser would send the sessionId cookie in clear text which would make it possible to sniff this off the network andthen use the cookie information to impersonate this user.To improve security in version 2009.1, if the CSP session has only ever seen https requests then Caché will send the sessioncookie with the secure bit set. If the CSP session has seen any http requests, it will the session cookie without the securebit set. This also means a CSP application that starts on an https page, and then goes to an http page, will start a new session(and take out a license and so on). This is by design as it prevents the sniffing of the sessionId.If the user application is willing to allow this sessionId to be sent over the network unencrypted there are two ways toaccomplish this:1. Start on an http page first, and then link to the https page. This will ensure the sessionId will never have the 'secure'flag set.2. When linking to the http page from the https page pass the sessionId with the property CSPCHD=&CSP-SHARE=16.2.10.2 Convert CSP Parameter Names And Values On InputIn prior versions, when a CSP pages was submitted, Caché did not convert the parameters names based on the charactersset of the page. If an application used a non-ASCII name, it would therefore not appear correctly in the %request.Dataarray. Beginning with this version, Caché will convert both the value and the name.6.2.10.3 Change Value of Serve FIles For CSP ApplicationsFor the InterSystems-supplied CSP application settings for the csp applications /isc/studio/templates and/isc/studio/usertemplates, the Serve Files parameter has been changed from “No” to “Always and Cached”. In addition,in the portal the default setting for Serve Files has been changed from “No” to “Always” for new applications. Thismatches the settings in the ^SECURITY routine. Customers may want to review their current CSP application settings,and change the value for their applications to “Always”.6.2.11 Zen Changes6.2.11.1 Zen dynaTree Component ImprovementsA number of extensions were added to this component:Display ControlsThe component now has the ability to show lines between folder and leaf nodes (like a windows tree control). This is activatedby setting the new showLines property to true. In this mode, the size and images used by the tree control are fixed. If thatis not appropriate, set showLines to false.New Callback Provides Tree ContentsA new callback allows an application to obtain the contents of the tree. This callback is set via the OnGetTreeInfo property.The callback method returns the entire contents of the tree as one array. This structure is designed to make it easy to programaticallyprovide tree contents. Each node in this array corresponds to one node within the tree. At each node there isa $LIST of information about this node:Caché Upgrade Checklists 153