Patch 7 - Bug fixes and minor enhancements
Date: April 15, 2010
Version affected: v1.90.
Notes:
-
This is a NOT
cumulative patch. You should install all version 1.9 patches through patch 6 before installing this update.
-
This patch includes a SQL script which must be run to add new
course menu styles.
Contents:
- M2007102301 "SQL Server does not exist" error in student menu on heavily
loaded systems.
On some heavily loaded systems a "SQL Server does not exist" error is
occasionally reported when displayin the student's home page menu. This affects
only installations running against SQL Server. This has been corrected.
- M2010011801 - fixes for query string vulnerabilities
A number of clients reported that web application review software reported query
string parameter vulnerabilties in some of the WBT Manager student menu pages.
The reported pages have been modified to perform additional validation on their
query string parameters.
- C2009121602 - Change API to use Javascript instead of Java
Due to various Corporate security policies regarding Java, the Java API adapter
which was used in WBT Manager has become troublesome for a number of clients. It
has been replaced by a fully JavaScript version which uses built-in browser
components for communication. See JavaScript API Changes below for more
information.
Installation:
First unzip the patch files to a temporary directory.
Web-Module:
On the web-server where the WBT Manager
Web-Server Application is installed:
Copy the web_module folder
from the patch to a convenient temporary location on the web-server.
Note the NTFS permissions on the WBT Manager
DLLs (see "Replaced Files" list below) in the Windows/System32
directory.
If you are using the External Script Interface scripts and have
modified the files in the msgtemplates directory see
Updating the msgtemplate files.
Shut down IIS services from a console prompt
(execute "NET STOP IISADMIN").
Execute the setup.exe program found in the
web_module folder.
When prompted for an installation folder
browse to the location where the WBT Manager Web-Server Application is
installed.
After installation is completed check the NTFS
permissions on the new versions of the WBT Manager DLLS. Make any necessary
changes to the permissions.
Copy modified versions of the msgtemplates
folder files into the msgtemplates folder if necessary.
Re-Start IIS ("IISRESET" at a console prompt).
Verify access to the WBT Manager Web-Server
Application and perform any other desired checks.
Run the SQL script C2009121602.sql to add new
menu styles as described in JavaScript API Changes below.
Javascript API Changes
The Java applet previously used as the SCORM API adapter has been re-written
using Javascript to remove the requirement that a Java runtime be installed on
student systems. All previously existing functions have been duplicated so from
the viewpoint of a lesson, there will be no difference in behavior.
From a WBT Manager courseware administion viewpoint there are a couple of
differences and improvements.
- The API adapter is now attached to the student menu instead of the
course menu. This allows a course
which contains a single lesson to launch the lesson directly from the student
menu without an intervening course menu. There is a new menu style flag for this
(described below).
- API debug information is now displayed in a separate browser window
instead of in a special pane on the course menu.
To enable menu-less launch of a lesson a "nomenu" flag has been added for use in
menu styles. A script is included in this patch to add 2 new styles with this
flag set. Additional styles may be created using the instructions in the WBT
Manager Installation and Customization Guide. Include "nomenu=1" as a parameter
to the menugen URL (e.g.; crsmenu.asp?nomenu=1&api=1).
Run the script to load the pre-defined menu styles as follows:
- Launch the RUNSQL.EXE program
from the patch directory.
- Select the DSN connected to the WBT Manager
database and log on using the same database account and password as is used for
the System Administrator module.
- Select the database\C2009121602.sql
script file and click the "Execute" button.
The script should be executed without stopping until the program displays "End
Of File.". If you execute the script more than once you will see error messages
beginning with "error ignored by directive". This is not a problem.
Updating the msgtemplate files
The message template files in the
msgtemplates folder are being updated in this patch. If you have
been using the WBT Manager External Script Interface and have customized those
files you will need to copy your changes to the new versions of the files or
copy the changes from the patch into your customized files. The new versions of
the message templates are different in that they HTML encode any passed in
parameters which are displayed by the message to prevent script encoding
exploits. For example:
Before: <%=Request("errortext")%>
<P><%=StringItems.LookupValue(g_nLangOffs+185172)%> <%=Request("errortext")%></P>
After:
<P><%=StringItems.LookupValue(g_nLangOffs+185172)%> <%=Server.HTMLEncode(Request("errortext"))%></P>
Before applying this patch:
- Copy the new versions of the msgtemplate files from
web_module\standard_files\msgtemplates to a working folder.
- Add your custom changes to the files in the working folder.
After the patch is applied copy the customized versions of the files to the
msgtemplates folder on the web server.
Replaced files
| Web-Module |
| Destination |
File |
Version |
Date |
| \windows\system32\ |
wbtman6d.dll |
1.9.0.3 |
2007/12/18 4:16 PM |
| <web-dir>/asp |
apidbglog.asp |
|
2010/04/05 9:42 AM |
| |
apiload.asp |
|
2010/04/02 9:59 AM |
| |
apitext.asp |
|
2010/04/02 9:58 AM |
| |
clsmenu.asp |
|
2010/04/02 5:00 PM |
| |
crsmenu.asp |
|
2010/04/02 9:58 AM |
| |
crsmenu2.asp |
|
2010/04/05 11:39 AM |
| |
crsmenublank.asp |
|
2010/04/13 3:41 PM |
| |
emailpw.asp |
|
2009/09/12 2:44 PM |
| |
fframe.asp |
|
2010/01/26 3:36 PM |
| |
menu.asp |
|
2010/04/02 4:58 PM |
| |
menuutils.inc |
|
2010/04/05 5:26 PM |
| |
querystringfilter.inc |
|
2010/04/07 11:01 AM |
| |
scorm6.asp |
|
2010/04/02 9:57 AM |
| |
set1.asp |
|
2010/01/26 4:35 PM |
|
<web-dir>/jar |
austart.js |
|
2010/04/02 5:06 PM |
| |
crsmenuutils.js |
|
2010/04/02 5:04 PM |
| |
httppreq.js |
|
2010/04/02 5:06 PM |
| |
jsinherit.js |
|
2010/04/02 5:06 PM |
| |
scorm1.js |
|
2010/04/13 6:07 PM |
| |
scorm2.js |
|
2010/04/13 5:03 PM |
| |
scorm3.js |
|
2010/04/13 5:03 PM |
| |
scorm3a.js |
|
2010/04/02 5:05 PM |
| |
scorm4.js |
|
2010/04/13 6:24 PM |
| |
scorm5.js |
|
2010/04/02 5:04 PM |
| |
stumenuutils.js |
|
2010/04/05 5:37 PM |
| <web-dir>/xsl |
clsmenu.xsl |
|
2010/04/02 4:51 PM |
| |
crsmenublank.xsl |
|
2010/04/13 3:27 PM |
|
menu.xsl |
|
2010/04/02 4:52 PM |
| <web-dir>/msgtemplates |
emailpwer.asp |
|
2010/01/26 4:46 PM |
|
emailpwnf.asp |
|
2010/01/26 4:46 PM |
|
emailpwok.asp |
|
2010/01/26 4:46 PM |
|
enrollcertstudenrolled.asp |
|
2010/01/26 4:47 PM |
|
enrollcertstudfailed.asp |
|
2010/01/26 4:47 PM |
|
enrollcertstudnoprog.asp |
|
2010/01/26 4:47 PM |
|
enrollcertstudnostud.asp |
|
2010/01/26 4:47 PM |
|
enrollcertstudsuccess.asp |
|
2010/01/26 4:47 PM |
|
enrollcertstudsuccessp.asp |
|
2010/01/26 4:47 PM |
|
enrollstudenrolled.asp |
|
2010/01/26 4:47 PM |
|
enrollstudfailed.asp |
|
2010/01/26 4:47 PM |
|
enrollstudnocrs.asp |
|
2010/01/26 4:47 PM |
|
enrollstudnostud.asp |
|
2010/01/26 4:47 PM |
|
enrollstudsuccess.asp |
|
2010/01/26 4:47 PM |
|
regstuddupemail.asp |
|
2010/01/26 4:47 PM |
|
regstudduplogin.asp |
|
2010/01/26 4:47 PM |
|
regstudduprefid.asp |
|
2010/01/26 4:47 PM |
|
regstudfailed.asp |
|
2010/01/26 4:47 PM |
|
regstudmodlogin.asp |
|
2010/01/26 4:47 PM |
|
regstudsuccess.asp |
|
2010/01/26 4:47 PM |
|
verstuderror.asp |
|
2010/01/26 4:47 PM |
|
verstudfound.asp |
|
2010/01/26 4:47 PM |
|
verstudmissing.asp |
|
2010/01/26 4:47 PM |
Version 1.9 Patches