Technical Enhancements
Web Security
• The application has been tested for OWASP Top 10 flaws; Veracode static and dynamic scans were performed on the PRECISION Web UI solution. Potential vulnerability flaws were reviewed and either corrected or mitigated. Changes involved general refactoring of code, sanitizing certain requests from the client, extending the use of the ESAPI library, and checking reflection logic and logic accessing files on the server side.
• Applets used to interface with local printers and weighing scales are now signed using a QAD certificate. If you use the applets, you are now presented with an information pop-up rather than a warning; additional warnings are suppressed.
Dynamic Contexts
The Web UI context is no longer hard coded in the deployed EAR file. Instead, the context is picked up from a Java property defined in the service\WrapperJBossService.conf file:
wrapper.app.parameter.10=-Dprecision.webui.context.name=precision
The static and translation contexts now derive from the Web UI context. If the Web UI context is set to production, rather than precision, then the static and translation contexts will be production-static and production-lang respectively.
Ext JS Upgrade
Ext JS version 3.4.1.1 replaces version 3.3.1. The Web UI static library no longer contains 3.3.1 resources.
Standards Mode
Previously, Web UI pages were rendered in Internet Explorer Quirks mode.
Web UI 4.8 supports the use of Internet Explorer 10; support for Internet Explorer 6 has ceased.
Cookie Notification
The standard login page displays a cookie usage note to advise users that the application uses cookies.
Login Page with Cookies Message
Fixes
• Scales: The Printing Applet Jar file now downloads to the client browser.
• Standard Packing task: The default pack type values are now correct.
• Authentication: An issue with the SSO Login Token has been resolved. Token auto authentication is now working properly.
• Scan, Pack and Ship: The notes task now displays correctly in Scan, Pack and Ship.
