Migration notes - iDempiere 12 (technical)
Running iDempiere as a server on Windows has reported problems. See the forum thread.
JDBC libraries upgraded
Three libraries related to JDBC were upgraded with ticket IDEMPIERE-6716:
- PostgreSQL from 42.7.3 to 42.7.8
- Oracle from ojdbc10 19.21.0.0 to ojdbc17 23.26.0.0.0
- HikariCP from 5.1.0 to 7.0.2
PostgreSQL 42.7.8 has a change that could break previously working code. Before this version, DatabaseMetaData.get* methods worked with any catalog name, and that parameter was simply ignored. Since 42.7.5, the catalog is used as a filter, so it must be passed as the database name, or null.
References:
Session fingerprinting
Session fingerprinting was added to the ZK Web UI. See the "NF12 Session Fingerprinting" wiki page for the options being checked.
It is possible your users will be logged out when changing the browser's language during an iDempiere session, or if the browser is updated.
It is also possible that changes of IP address will be logged in the application log and in AD_Issue. This can happen when connecting to a VPN, changing Wi-Fi, or using mobile networks. It can also indicate an attempt to hijack the session. Keep an eye on these alerts and verify suspicious activity.
New Env.parseContext parameter
A new parameter was added to Env.parseContext:
- forSQL: if
true, the parsed value is intended for a SQL statement, so it replaces quotes accordingly.
Review your plugins and use the new parameter when Env.parseContext is intended to be used in SQL clauses. This is important to help prevent SQL injection attacks.
New SQLFragment approach
In many places in iDempiere, direct SQL clauses were built with parameters replaced directly within the where clause. This can open the door to SQL injection attacks.
To address this, org.idempiere.db.util.SQLFragment was added. This approach allows defining a where clause with binding parameters and associating a list of parameters to the clause.
Many methods were deprecated to encourage the use of the new SQLFragment approach instead of building where clauses directly. Review your plugins for usage of these deprecated methods and consider migrating to SQLFragment.