7.28 (stable)

Important Changes

• ILIAS Page Editor
  • With Release 7, the ILIAS page editor was fundamentally revised. As part of the page editor, the content style was also adjusted and redundant text and block formats removed. You can see the list of removed paragraphs here:
    • Page Editor » Text Editing
  • When updating to ILIAS 7, please bear in mind that the changes in the content style will affect your existing content. To prevent this, you can export the content style before an update OR download the ILIAS 6 Default Content Style from the following link:
    • Content Styles-Börse
• Setup
  • With ILIAS 7 the GUI for the Setup has been abandoned. Installing and updating ILIAS is now handled by a command line implementation of the setup. The features for maintenance mode and multi-clients have been removed completely as discussed in the context of the Setup Revision. For more information about the new Setup please have a look into the detailed documentation of the setup in the file setup/README.md or take a look into the ILIAS installation instructions at docs/configuration/install.md.
• Migration of files
  • In addition to the new setup via CLI, since version 7 ILIAS also requires that so-called migrations are carried out after an update. With ILIAS 7, such a migration is, for example, that files are migrated from the file object into the new resource storage service. These migrations can already be started after the update in live mode. To do this, run# php setup/cli.php migratein the CLI for more information.
• Workflow Engine
  • Due to low demand and security issues, we removed the workflow engine with 7.23 and 8.3
• OpenIDConnect
  • We switched the implementation from the "Implicit Flow" (e.g. because of https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps#name-attacks-on-the-implicit-flo)  to the "Authorization Code Flow".

Known Issues

• none

Changed Behaviour

• …

Security Fixes

#39530: [¥ Web Access Checker] Referer can circumvent WAC permission check (offscript)
#40096: [Learning Module SCORM 2004] SCORM 2004: Arbitrary File Deletion (Rene Rehme (rehme.infosec))
#40095: [Learning Module SCORM 2004] SCORM 2004: Local File Inclusion (Rene Rehme (rehme.infosec))
#40225: [User Tracking] LegacyUIComponents/Tabs: XSS in "Back" link (Rene Rehme (rehme.infosec))
#40220: [Mail] Mail: XSS in User Folders (Rene Rehme (rehme.infosec))
#39525: [¥ Web Access Checker] WAC can be used to circumvent access restrictions (offscript)
#40363: [Learning Module SCORM 2004]  Stored XSS
#40097: [Learning Module SCORM 2004] SCORM Import: Possible Remote Code Execution (Rene Rehme (rehme.infosec))

Fixed Issues

The following issues reported in Mantis have been resolved:

#26268: [Calendar] ilDatePresentation::formatDate => wrong date (was: Exercise and Timezone => Wrong date) (smeyer)
#26706: [Calendar] Consulation hours which are assigned to a course can be booked by non-members too (tschmitz)
#38040: [Calendar] Consultation Hours link missing from calendar box in "Upcoming Events" view (tschmitz)
#40297: [Content Page (Repository Object, not ILIAS Page Editor)] Import of Content Pages causes an error (mjansen)
#22331: [Course Management] Show all previous sessions and timeline (smeyer)
#29409: [Course Management] Failed test: Datei zur Kursinfo hinzufügen (smeyer)
#36943: [Didactic Templates] Import of automatic generated didactic templates fails (tschmitz)
#37208: [Didactic Templates] Error, didactic template import. (skergomard)
#40422: [ILIAS Page Editor] Link breaks (Customize) Page - Page becomes unrecoverable (akill)
#39511: [Language Handling] Typo DE in prtf#:#prtt_title_info# (mkunkel)
#39513: [Language Handling] Typo DE: orgu#:#ext_id_updated# (mkunkel)
#37740: [Learning Module ILIAS : Editor] HTML Export of ILIAS LM fails (akill)
#39324: [LTI] Wrong LTI LuceneObjectDefinition.xml (ukohnle)
#39454: [Mail] The displayed file size does not correspond to the actual file size (mjansen)
#31003: [Poll] Quotation marks in possible answers results in loosing all following answer items (tschmitz)
#17930: [Test & Assessment] Anzeigefehler bei "Anordnungsfrage: vertikal" (u.kunze)
#33898: [Test & Assessment] Ordering Question (vertical): No indicators for 'correct/wrong' displayed in results (u.kunze)
#37248: [Test & Assessment] Wrong cmdNode by using the action menu -> crashing display of test results (fhelfer)
#39124: [Test & Assessment] Test: Duplicate breadcrumb & broken table row selector in results view depending on ilCtrl route (fhelfer)
#39297: [Test & Assessment] Variables in LaTeX not interpreted / not shown properly to users (skergomard)
#39610: [Test & Assessment] Clicking on link to question pool in list of questions results in fatal error (skergomard)
#39612: [Test & Assessment] "Add from Other Test": Test titles are neither shown nor linked (skergomard)
#39823: [Test & Assessment] No results generated in Test when scoring best pass and points are a float value (skergomard)
#40228: [Test & Assessment] Qpl buildTitle error when Test not existent (fhelfer)
#26138: [User Service] Maileinstellunge greifen nicht bei Änderungen am Benutzerprofil (skergomard)
#32322: [User Service] Mails sent by Cron Job "Check user accounts" not informative enough (skergomard)
#39915: [User Service] Field "street" in user profile too short (max 40 chars) (skergomard)
#32201: [Weblink] Bad query - webr_items (smeyer)
#36643: [Wiki] Performance problems when editing wiki pages (akill)