8.17 (stable)

Important Changes

• Services/PDFGeneration
  • Since the development for wkhtmltopdf has stopped and the consumer for the service are regressive, the jour Fixe decided to deprecate the PDFGeneration Service with ILIAS 8 and to remove this service with ILIAS 9
  • https://docu.ilias.de/goto_docu_wiki_wpage_7795_1357.html
• Plugins
  • Plugins which provide a configuration screen must add an explicit `ilCtrl` directive in the PHPDoc comments of the `il*ConfigGUI` class.
    • Example:
      • /**
         * @ilCtrl_IsCalledBy ilMyPluginConfigGUI: ilObjComponentSettingsGUI
         */
        class ilMyPluginConfigGUI extends ilPluginConfigGUI
        {
            // Code ...
        }
  • Many public methods of class `ilPluginAdmin` (often considered as public API of the component service in ILIAS by developers) were removed. The class itself is marked as deprecated and will be removed in future ILIAS releases. Plugin developers should use `ilComponentRepository` and `ilComponentFactory` instead. Implementations of these interfaces can be retrieved from the dependency injection container ($DIC["component.repository"] and $DIC["component.factory"]).
  • Please always execute a `composer du` command if you put a new plugin into the plugin directories in your filesystem or if you applied any changes to your `plugin.php`. Otherwise the plugin will not be listed in the global ILIAS plugin administration or may cause other problems.
• Workflow Engine
  • Due to low demand and security issues, we removed the workflow engine with 7.23 and 8.3
• OpenIDConnect
  • We switched the implementation from the "Implicit Flow" (e.g. because of https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps#name-attacks-on-the-implicit-flo)  to the "Authorization Code Flow".
• SAML
  • Please read https://github.com/ILIAS-eLearning/ILIAS/blob/release_8/Services/Saml/README.md#ilias-configuration and https://github.com/ILIAS-eLearning/ILIAS/blob/release_8/src/HTTP/README.md#dropinreplacements
• MathJax
  • Please check if you configured a polyfill url at Administration > Third Party Software > MathJax. This is not needed by modern browsers and IE 11 is no longer supported by ILIAS at all. You should NOT use the polyfill.io library any longer, see https://sansec.io/research/polyfill-supply-chain-attack for details.

Known Issues

• none

Changed Behaviour

• T&A: Import of Tests with Results: IIt's no longer possible to deselect questions during the import.
• See changes concerning uploading ZIPs and unzipping here: Drag&Drop Files in Container Objects
• The visibility of the user administration has been adjusted. For a read-only access, the permission "Read" and no longer "Read Access to User Accounts" is used. Mantis 37269.
• T&A: "Auto-saved" or intermediate answers are not saved anymore as authorized answers when the set test duration limit ends.
• T&A: Zero will not be accepted any longer as value for points in File Upload Questions.
• DataCollection: The new field type "Copy" was added to the datacollection and can now be selected for new fields! A copy field shows a selection of values from another tables entry and copies those to its own value without a reference, making it robust against manipulation and deletion of the origin value.

Security Fixes

#42613: [Booking Tool] BookingPool: Broken Access Control/Record Ownership (Michael Jansen (Databay AG))
#42848: [LTI] LTIConsumer: Stored XSS (Matthias Marx (Security Research Labs))

Fixed Issues

The following issues reported in Mantis have been resolved:

#41733: [Accessibility / WCAG Issues] Test > Einstellungen -> Byline bei Durchführung: Zugang > Ende -> Hervorhebung mit < b > statt < strong > (skergomard)
#42091: [Calendar] iCal cash is not used, but written (smeyer)
#43008: [Certificate] Empty listing in certificate content breaks pdf generation (mjansen)
#31589: [Course Management] Email-link in Course Info can produce "Permission Denied" error (smeyer)
#40265: [Data Collection] Administration -> Delete trash -> Delete Datacollections => error: "ilObject::read(): Object with obj_id: 88798 (dcl) not found! (iszmais)
#40892: [Data Collection] Error when user has no access to a referenced table (iszmais)
#41509: [Data Collection] Übersetzung der Informationen in der Spalte "Feld Datentypen" fehlt (iszmais)
#41549: [Data Collection] The deletion of required referenced fields prevents creation and editing (iszmais)
#41989: [Data Collection] Errors at opening datacollection (iszmais)
#42833: [Employee Talk] Failed test: Create a talk (interrupting the creation) (tschmitz)
#41508: [ILIAS Page Editor] Rücksprungpunkt nach Bearbeitung der Einzelansicht falsch (iszmais)
#42996: [Language Handling] Missing German translation for : assessment#:#tst_show_pass_details (skergomard)
#42733: [Login, Auth & Registration] CAS authentication always fails with Wrong Login or Password (PerPascalSeeland)
#43017: [Metadata + ADT] Metadata/Address: Editing options of "Address" type result in PHP error (tschmitz)
#42223: [RBAC] RBAC/GlobalRoleAdministratio/Performance: Memory issue in role table when selecting autom. created local roles (skergomard)
#42321: [Search] Direct search: Pagination does not work (smeyer)
#41684: [Test & Assessment] Inserting question to be moved without having selected target position results in fatal error (tjoussen)
#42560: [Test & Assessment] In File-Upload Question with Authomatic Feedback and Locking File Upload Questions show "Invalid Upload" on Navigation (skergomard)
#42865: [Test & Assessment] Failed test: Inhalte zur Wiederholung durch andere ersetzen (skergomard)
#42872: [Test & Assessment] CharSelectorConfig::setDefinition TypeError (fneumann)
#42866: [User Service] User: Error when saving standard field configuration (while tinkering with the checkboxes) -> default_hits_per_page (skergomard)
#42870: [User Service] UserAutocomplete Limit is being ignored (skergomard)