Release Notes
Portfolio: 4.0.1
Media Engine: 4.0.1
Web Client: 4.0.1
Desktop Client: 4.0.1
Server: We updated Apache Tomcat to version 9.0.58.
Server: We updated the log4j library to version 2.17.2. This eliminates a vulnerability introduced in earlier versions of the log4j library as detailed here: https://www.cve.org/CVERecord?id=CVE-2021-44228.
We addressed five high-risk flaws identified by White Oak Security:
Admin/Web/Desktop: Authentication Bypass – Hard-Coded Credentials (CVE-2022-24255)
Web: Authenticated Unrestricted File Upload Resulting in Remote Code Execution (CVE-2022-24251)
Web: Authenticated Unrestricted File Upload + Path Traversal Resulting in Remote Code Execution (CVE-2022-24252)
Admin: Authenticated Archive Zip-Slip Path Traversal Resulting in Remote Code Execution (CVE-2022-24254)
Admin: Authenticated Unrestricted File Upload Resulting in Remote Code Execution (CVE-2022-24253)
The change that addresses the security issue CVE-2022-24252 may cause Web Client scripts to fail. If your Web Client scripts stop working, see this article.
Server: Portfolio now supports Active Directory 2019.
Web, Desktop: You can now share private galleries with other users.
Server: You can now turn off the English option when you choose another language in the General Engine section of the Smart Keywords settings.
Web, Desktop: We have updated NetPublish Site Builder to allow you to add any number of metadata fields to be published. (You should confirm that your chosen fields will display as expected.)
NetPublish: We have increased the space available for details in the asset preview available on a NetPublish site.
NetPublish: In NetPublish Site Builder, you can allow site visitors to choose among multiple formats when they download assets.
NetPublish: We have improved watermarks created by NetPublish to include a white shadow for black text, and a black shadow for white text.
NetPublish: In NetPublish Site Builder, we have added an option for what a visitor can do when they try to download a file that can’t be watermarked.
Server: We updated LibRaw to version 0.20.2.
Server: We updated Apache Tomcat to version 9.0.43.
We fixed an issue where a long field name was cut off when you added it to your site’s Grid Fields in the NetPublish Site Builder. [PORT-12930]
We fixed an issue where the NetPublish Usage report would display user names incorrectly. [PORT-13127]
We fixed an issue where Portfolio would remove a deleted asset from the Asset Deletion report after a few days, no matter what the date range for the report is. [PORT-13349]
We fixed an issue where a catalog created while logged in using a language other than U.S. English would display EXIF and GEO metadata fields in the wrong category in the client. [PORT-13354]
We fixed an issue where Portfolio couldn’t create a catalog with the General Use template when the user logged in with the International English language. [PORT-13365]