Overview of all update note

4.17

Not required database index

Please delete the database index apps_groupname_idx, it is not required, because the columns already part of an unique key index.

Update of the APP_ASSETS table when using Microsoft SQL Server

If you are using a Microsoft SQL Server as the map.apps database, an additional migration step is necessary. In the table APPS_ASSETS the type of the column ID has been changed from binary(255) to binary(16). Please execute the script updater-app-assets-table-sqlserver.sql to make the changes.

4.16

CSV export from the (old) Result Center

Only the "old" Result Center (bundle resultcenter) is affected by the changes described here. When using the new Result Center introduced with map.apps 4.14 (bundles result-ui and result-api), nothing needs to be considered.

The order of the columns in a CSV export now corresponds to the order of the fields in the underlying store metadata. Previously, this was not always the case, so that after updating to this version, the order may be different than before. In addition, the default value of the detectExtraFields property has been changed from true to false. This can lead to fewer columns appearing in the export than before without further adjustment. If additional fields are detected, they are appended to the end of the fields from the store metadata.

4.15

Standalone Identity Service for OAuth Integration

With version 4.13.0, OAuth authentication mode was introduced in map.apps. In this mode map.apps delegates the login to ArcGIS Online, ArcGIS Enterprise Portal or Keycloak. This mode has been renamed from OAUTH to IDENTITY and requires the installation of the separate service Identity Service as of this release. This service can be downloaded from the con terra Download Portal. More information about the new service can be found at Identity Service.

If you are not using the Identity Service with the same database as map.apps, delete the IDENT_EXTSESSIONS, IDENT_SESSIONS and IDENT_TOKENS tables from the database. Suitable SQL scripts can be found here: PostgreSQL, Microsoft SQL Server and Oracle.

If you have customized the following configuration parameters in the global configuration, remove these customizations:

Dropped options
security.oauth.provider
security.oauth.provider.arcgis.url
security.oauth.provider.arcgis.organizations
security.oauth.provider.arcgis.roles
security.oauth.provider.keycloak.url
security.oauth.provider.keycloak.realm
security.oauth.provider.keycloak.revokeRefreshTokens
security.oauth.provider.keycloak.scopes
security.oauth.clientId
security.oauth.clientSecret
security.oauth.tokenRules
security.sharedSecret
security.session.maxIdleTimeInSeconds
security.session.cookieName
security.session.cookieDomain
security.session.enforceSecureAndSameSiteNone

New configuration options have been added for the integration of the new service. Please follow the authentication instructions at ArcGIS Enterprise portal, ArcGIS Online or Keycloak to update your configuration.

No longer needed database columns

Synchronization of apps and app templates is removed with this release (see Discontinued features). Therefore you can delete the columns SYNC_TEMPL_BIN, SYNC_MODE, SYNC_AUTO, SYNC_AT from the table APPS of the database. Suitable SQL scripts can be found here: PostgreSQL, Microsoft SQL Server and Oracle.

Renaming of the configuration proxy.cors.trustedServers

The configuration option proxy.cors.trustedServers has been renamed to cors.request.trustedServers. If you have customized proxy.cors.trustedServers in the global configuration change it to cors.request.trustedServers. The name change is to make clear that this configuration option is not interpreted by the proxy integrated in map.apps.

Character encoding of JavaScript files

Due to changes in the build system of map.apps, special characters in JavaScript strings are no longer escaped to ASCII as before. Especially files containing translation strings (bundle.js) are affected.

There is no need for action if you are running map.apps in the default configuration (delivering apps via the map.apps backend).

But if you are running your own web server to deliver map.apps JavaScript files (e.g. as part of native app export), make sure that they are delivered by the web server with the HTTP header Content-Type: text/javascript; charset=utf-8.

Do not use quotes in manager.config.viewbundles

Please remove the quotes from the bundle names listed in manager.config.viewbundles.

No quotes in manager.config.viewbundles
# Old:
manager.config.viewbundles="appmanagement","reportmanagement","bundlemanagement"

# New (removed quotes)
manager.config.viewbundles=appmanagement,reportmanagement,bundlemanagement

4.14

Updated default app

The template for the default app is updated. If you have not made any customizations, remove the file default-app-4.zip from the working directory. The path to this directory is defined in the parameter data.directory.location in the file %TOMCAT%\webapps\mapapps\WEB-INF\classes\custom-application.properties.

Editor widget

With the upgrade of the Esri ArcGIS API for JavaScript the editing bundle of map.apps will provide a completely new Editor widget. Accordingly, the config option allowedWorkflows:["create"] is deprecated and should not be used in favor of allowedWorkflows:["create-features"].

DGrid

DGrid was affected by a design flaw in its API that could be used as an attack vector for JavaScript injection. The dependency was updated to version 1.3.3 which includes a fix for this problem.

This update comes with a breaking change concerning custom formatters: whereas values returned from a formatter were previously always interpreted as HTML, return values will now be escaped appropriately by default. Only when explicitly returning { html: "…​string…​" } will the value be interpreted as HTML. More details are described in this Github issue .

Example:

// Before:
function makeRed(value) {
    // Was vulnerable before, will now be escaped:
    return `<span class="red">${value}</span>`
}

// After:
function makeRed(value) {
    // Ensure that value is either trusted or escaped correctly!
    return {
        html: `<span class="red">${escapeHtml(value)}</span>`
    }
}

Note that map.apps installations are safe against this vulnerability when using default settings: the Content-Security-Policy headers prevent execution of inline scripts (unsafe-inline).

seasons-template

Removing Dijit Layout Containers

The Dijit BorderContainer/ContentPane-based layout has been replaced by a modern CSS-Grid . This gives much more possibilities to customize the layout via CSS (also later via app.css) without having to change the underlying HTML.

The change described above also removes the CSS classes .dijitContentPane and dijitBorderContainer. If you use an app.css, check if there are corresponding style statements. There are two cases to distinguish:

  • The style statement is no longer necessary (paddings of .dijitContentPane and .dijitBorderContainer).

  • The style statement no longer applies because it contains .dijitContentPane or .dijitBorderContainer in the selector.

/*before*/
.ctAppRoot .ct-application-footer.dijitContentPane {
    height: 80px;
}

/*after*/
.ctAppRoot .ct-application-footer {
    height: 80px;
}

Harmonization of attach-points for widgets

The naming of attach-points for widgets has been revised. As a result, all attach-points are available under the same name in all sub-layouts. In the mobile landscape layout (mobile_landscape), the dockingbarLeft has been renamed to dockingbarBottomLeft. You can update app.json files by search and replace. Without this adjustment, tools may not be displayed in the mobile landscape view.

Themes and theme-extensions

The naming of the manifest.json properties CSS-Themes and CSS-Themes-Extension was changed to cssThemes and cssThemesExtension. The old values are deprecated and should be replaced with the new ones. This is only relevant when you have custom bundles, that provide their own css, theme bundles or theme-extension bundles.

4.13

New Database Tables

map.apps requires the new database tables IDENT_EXTSESSIONS, IDENT_SESSIONS, and IDENT_TOKENS.

Starting from this version, map.apps creates those tables when starting Tomcat if they do not exist already and the property db.hibernate.schemaUpdate=update in the appropriate config file is set. If you have not set or changed this setting so far, you do not need to make any changes.

If you wish to create the tables manually, instead, use the appropriate SQL script for your database in use:

Use of ArcGIS roles in map.apps

If you previously used roles derived from ArcGIS Enterprise Portal or ArcGIS Online groups in map.apps, this previously required the following notation: "user@@group". The syntax changes to "group::user" with this release.

Tools in the DockingBar in the Footer

Tools in the DockingBar in the Footer are no longer in a toggle group by default. If they are not to be opened at the same time, they must be assigned to a group.

4.12

Updated default app

The template for the default app is updated. If you have not made any customizations, remove the file default-app-4.zip from the working directory. The path to this directory is defined in the parameter data.directory.location in the file %TOMCAT%\webapps\mapapps\WEB-INF\classes\custom-application.properties.

Domain bundles

Due to improvements to the domain bundle system, there is a change in behavior. Previously, all thematic maps from domain bundles loaded at app startup were added to the map in their loading order. This resulted in the first loaded topic maps being below the later loaded ones for multiple domain bundles. As of this release, this behavior is reversed so that first loaded topic maps are above later loaded ones.

This new behavior can be influenced by changing the domainBundleOrder option. See Domain-Bundles.

Increase of the maximum URL length for GET requests (instead of POST).

The maximum length of URLs queried by GET from the map.apps server is increased from 2048 to 3072 with this release. This allows the bundle files to be queried via GET instead of POST even in more extensive apps that contain many bundles. This is an advantage because only GET requests can be cached by the browser, increasing performance when the app is reloaded.

Make sure there are no restrictions on your server that prevent longer GET requests. Alternatively, you can change the length at which GET is switched to POST in the client.config.requestMaxUrlLength property in the application.properties file.

Import of map.apps classes

As part of code modernizations, the build process for bundles is incrementally switched to rollup.js . This means that internal, non-public classes from map.apps can no longer be imported in custom implementations. Instead, use official APIs from map.apps or use map.apps classes as templates for your own implementations. As always, we welcome your feedback on missing features, APIs or configuration parameters.

Import of ArcGIS API for JavaScript classes

The ArcGIS API for JavaScript is the largest dependency in map.apps (in the browser) in terms of the number of modules and also their combined size. Until now, the API has been integrated into map.apps in such a way that private, undocumented modules can also be imported at runtime. With this release, the number of JavaScript modules in the API is minimized to what is necessary by only importing documented modules. As a result, the number of JavaScript modules is reduced by more than 55%. On the one hand, this can lead to a performance gain and on the other hand, it prevents accidentally programming against internal interfaces of the API during own developments. If you experience runtime errors in your own developments after updating to this version, please check whether you are using internal modules of the ArcGIS API for JavaScript.

4.11

Separate rollout of line 3 bundles

If map.apps line 3 bundles are needed, they have to be installed as separate bundles from now on.

Database Model for Pre-optimized Apps

Changes need to be made to the database schema to support pre-optimized apps.

Two changes are necessary:

  1. The column PREOPTIMIZED has to be added on table APPS.

  2. The table APPS_ASSETS has to be created and indexed.

The update can be done either automatically or manually. In either way, the database user has to have permissions to create/alter tables and to add an index. After the update the permissions can be revoked again.

Automatic Update

Make sure, that the property db.hibernate.schemaUpdate=update in the appropriate config file is set. If you have not set or changed this setting so far, you do not need to make any changes. Restart map.apps to apply the update automatically.

Manual Update

Use the appropriate SQL script for your database in use:

Password for the map.apps administrator

From now on map.apps is shipped without a preconfigured default password for the administrator user. Thus, if not already done in a previous installation, the password must be set.

Updated default app

The templates for the so-called default app is updated. If you have not made any customizations, remove the files default-app-4.zip from the working directory. The path to this directory is defined using the parameter data.directory.location in the file %TOMCAT%\webapps\mapapps\WEB-INF\classes\custom-application.properties. At the first start, the new templates are copied there.

Customized splashscreens

If the map.apps installation, which is being updated, has its own index.html with customized init.css these files must be saved and reapplied after the update.

4.9

JavaScript import/export vs. AMD define

In the course of modernizing the map.apps API, the keyword export defined in the ECMAScript 6 standard (ES6) is increasingly used. This requires a change when using the AMD import style define . Use the new ES6 import syntax to avoid incompatibilities.

The following sections show the change using the example of string-replace:

AMD import (old)
define(["apprt-core/string-replace"], function(stringReplace){

   var msg = stringReplace('Hello ${key}', { key : "World"});

});
ES6 import (new)
import stringReplace from "apprt-core/string-replace"

const msg = stringReplace('Hello ${key}', { key : "World"});

Code that is in AMD format can be converted with the amd-to-es6 tool. The sample project for developing new bundles mapapps-4-developers is already prepared for using the new syntax.

Theming

With map.apps 4.9 new color variables are available to customize the OmniSearch background and input-text color via LessCss. For custom themes, the following variables with the default values must be added :

@ct-omnisearch-input-background-color: #fff;
@ct-omnisearch-input-text-color: #000;
@ct-omnisearch-drawer-button-background-color: @ct-omnisearch-input-background-color;
@ct-omnisearch-drawer-button-icon-color: darken(@disabled-text-color, 30);

4.6

Update of the ArcGIS API for JavaScript to version 4.10 (from 4.8)

The ArcGIS API for JavaScript used by map.apps as technical basis is updated to version 4.10 with this release. With this release, changes in the handling of Cross-Origin Requests and Cross-Origin Resource Sharing (CORS), which were implemented by Esri in version 4.9 of the API, become effective. A detailed description of these changes is given in the article CORS and the ArcGIS API for JavaScript: Changes coming in 4.9 .

Most important changes are:

  • It is now assumed that all requested servers support the CORS mechanism. Previously, a list of supporting servers was maintained or a check if a server supports CORS was made.

  • If CORS is not supported, a proxy is required. The URL of the server can be entered in the parameter proxy.use.rules in this case. The previous workaround over JSONP or JSONP support is removed.

These changes also affect map.apps and some configuration options. The following settings are no longer effective for apps from version 4.6.0 (however, they still apply to line 3 apps running under a map.apps 4.6 installation). Adjustments to these options, which are usually made in an application.properties file in the data directory of the map.apps installation, can be removed accordingly.

proxy.cors.enabled=true
proxy.cors.detection=true
proxy.cors.enabledServers=servicesbeta.esri.com,server.organization.com
proxy.use.always=true

The first three options are omitted as CORS support is now assumed by default. If the option proxy.use.always was used in previous versions, all servers for which the proxy always has to be used have to be configured with proxy.use.rules.

For apps version 4.6.0 and later only the following option applies, which corresponds to the former option proxy.cors.enabledServers with the flag |true:

# List of URLs for backend services for which the transfer of security-critical information with CORS is activated (for example cookies and authorization headers)
proxy.cors.trustedServers=https://servicesbeta.esri.com,https://server.organization.com

Vuetify Update to 1.3.8 (from 1.0.17)

map.apps 4.6 contains an updated version of the vue based UI Library Vuetify. For a complete overview of changes, check the Vuetify release notes from 1.0.18 to 1.3.8 .

The following changes might affect custom developed bundles, themes or style overwritings (for example in app.css).

Changes

  • all vuetify component style classes are now prefixed consistently with v- so add .v- to custom CSS selectors targeting vuetify components. For example the selector .ctAppRoot .my-custom-bundle .list__tile{} must be changed to .ctAppRoot .my-custom-bundle .v-list__tile{}

  • The components <v-textfield textarea/>, <v-text-field autocomplete/> and <v-select combobox/> have changed to independent components and are replaced by <v-textarea/>, <v-autocomplete/> and <v-combobox/>. A search and replace operation can be used because the properties stay the same.

  • The components <v-radio/> and <v-checkbox/> without a color attribute defined gets the "accent" color assigned as fallback. All map.apps UIs have already success color assigned (for example <v-checkbox color="success"/>). For custom bundles this has to be done too.

New UI components supported

v-autocomplete, v-combobox, v-textarea, v-rangeslider, v-rating, v-img, v-hover, v-item-group, v-timeline, v-treeview

Deprecations:

  • v-card-media

  • v-jumbotrons

Both can be replaced by v-img.

Measurement in 2D

In Line 4 apps, measurement is now possible in 2D maps in addition to the existing 3D measurement functions. The previous bundle measurement now loads the bundles measurement-2d and measurement-3d. If an app is only intended for operation in 2D or 3D, one of the bundles measurement-2d and measurement-3d can be loaded instead.

Updated default apps

The templates for the so-called default apps are updated. If you have not made any customizations, remove the existing templates (files: default-app-*.zip) from the working directory. The path to this directory is defined using the parameter data.directory.location in the file %TOMCAT%\webapps\mapapps\WEB-INF\classes\custom-application.properties. At the first start, the new templates are copied there.

4.4

  • The templates for the so-called default apps are updated. If you have not made any customizations, remove the existing templates (files: default-app-*.zip) from the working directory. The path to this directory is defined using the parameter data.directory.location in the file %TOMCAT%\webapps\mapapps\WEB-INF\classes\customapplication.properties. At the first start, the new templates are copied there.

  • The default setting for using https based services with self-signed certificates is changed. map.apps only accepts services with official certificates by default. This setting can be changed with property security.ssl.trustAny.

  • The base classes in a map.apps application have changed. If templateseasons is used and your app has its own app.css make sure that you do not use the old class names. Refer to the following table to translate the old to new class names. If using a custom theme it is also required to make sure that there a no occurrences of the old class names.

    Old class name New class name

    .header

    .ct-application-header

    .logo

    .ct-application-header__logo

    .appTitle

    .ct-application-header__app-title

    -

    .ct-application-header__container-main

    -

    .ct-application-header__container-right

    -

    .ct-application-center

    .footer

    .ct-application-footer

    .footer_left

    .ct-application-footer__container-left

    .footer_right

    .ct-application-footer__container-right

  • The compatibility of the ArcGIS API for JavaScript with ES Promises has changed. To be notified about resolved objects as a developer, the method when() has to be used (before then()). This blog post describes the changes in detail.

4.2

With bundle package 4.2.0 bundle basemaptoggler is renamed to basemapswitcher.