Vulnerability in EPiServer.Forms

Try our conversational search powered by Generative AI!

Per Bjurström
Aug 17, 2017
(17 votes)

Planned breaking changes 2017 (CMS Core)

An update to let you know what breaking changes are planned for CMS Core, as we have done the last few years we plan for one breaking change release of CMS per year. With that said, please note that this is preliminary and subject to change. More details will be provided when we get closer to a release.

For many projects this will just require a re-build of the solution assuming you have stayed up to date with the continuous release process and continuously fixed the obsolete warnings that shows up.

New NuGet packages for ASP.NET integration

New NuGet packages EPiServer.CMS.AspNet and EPiServer.Framework.AspNet will be introduced which will contain all API's related to web development on the ASP.NET stack (both MVC and WebForms). Existing namespaces will be preserved to keep the upgrade as smooth as possible.

The goal is that the EPiServer.CMS.Core and EPiServer.Framework NuGet packages will be .NET Standard 2 compliant and will not contain any API's related to ASP.NET development, and that they in the future can be used stand-alone (without a web.config).

You might have noticed that we already started obsoleting methods that have dependencies on ASP.NET in core API's to prepare for this split. So for example the CreatePropertyControl-method in PropertyData will be removed since it has a dependency on WebForms (System.Web.UI.Control), but you can prepare for this change by registering controls on startup instead.

New NuGet package for StructureMap integration

A new NuGet package EPiServer.ServiceLocation.StructureMap will be introduced which will contain the integration with StructureMap, with support both for the existing signed StructureMap 3 and the new unsigned StructureMap 4 which we currently cannot support. The package only contain the integration and have NuGet dependencies on the official StructureMap packages. Episerver and module packages should not directly depend on this package but use our own abstractions for dealing with dependency injection, this API have been available for a few versions now and is already being used by most Episerver products.

This change makes it easier to support multiple versions of StructureMap but we are also looking into the dependency injection system that is shipped with .NET Core. Moving the dependency to a NuGet package is the same approach we have for logging, where we have abstractions in the platform and an integration in a separate NuGet package.

You might have noticed that we obsoleted the "Container" property in the initialization system and move that logic into an extension method, that was a preparation for this change where the extension method will be provided by a separate NuGet package (since EPiServer.Framework will no longer have any direct depedencies on StructureMap).

New NuGet packages for Dynamic Content and XForms

The legacy features Dynamic Content and XForms will be removed from the platform and moved into separate NuGet packages as add-ons instead (e.g. EPiServer.DynamicContent and EPiServer.XForms) with their own versioning number and breaking changes, as the platform progresses these features will become more limited over time. We recommend migrating to Forms or Blocks wherever possible.

PropertList<T> improvements

The base class PropertyList<T> is an API that have been in beta for a long time and has no official documentation, we know some projects are using it despite the shortcomings. We plan to make a few breaking changes to make sure the API properly can support these property types, document what they support and not, and then remove the beta stamp from this class.

As an example we are changing how properties are imported/exported by moving logic previously locked into PropertyData such as ToRawProperty to external services that can have their own dependencies and are easier to customize per property type. There will be a separate blog post with more details.

Performance improvements when loading content

Performance improvements up to 50% when content is loaded from the database, the results vary depending on the size of content types and the data being loaded. Besides optimizations of the API the larger behavioural change is that the CreateWritableClone-method is now also used when loading data from the database.

Bug fixes

We have a list of bugs that we have not been able to fix since they are considered breaking according to semantic versioning.

User interface changes

A separate blog post about breaking changes in the UI will be published later.

Getting access to pre-releases

We will publish pre-release versions on our NuGet site as soon as we have something that can be tested.

Aug 17, 2017


valdis Aug 17, 2017 08:08 PM

good stuff coming ;)

Aug 18, 2017 07:50 PM

Another thing to happen is that we will require net461 (since that is the net framework version confirming to NetStandard2.0). 

Also to clarify the update process for most scenarios, that is to update package EPiServer.CMS.Core (as usual) but also add a new dependency to the new packages EPiServer.CMS.AspNet and EPiServer.ServiceLocation.StructureMap

valdis Aug 18, 2017 11:05 PM

what if you don't install them? what's planned behavior?

Aug 21, 2017 08:26 AM

If you have a project that has some dependency (which is probably 99% of your projects, that is for example if you depend on a MVC Controller or WebForm Page) and do not install EPiServer.CMS.AspNet package then it will give you a compilation error saying somthing like "type PageController is missing". Ideally it would be nice if we could have used type forwarding but it will not work since the dependencies for the packages are the other way around...

If you do not install EPiServer.ServiceLocation.StructureMap then you will get an error during initialization saying something like "Either must InitializationEngine be instantiated with a IServiceLocatorFactory or an assembly with ContainerFactoryAttribute be present"

Aug 21, 2017 01:01 PM

Exciting! :D

Henrik Fransas
Henrik Fransas Aug 21, 2017 01:59 PM

Great info!

Do you have any hints on when in 2017 version 11 will come?

James Wilkinson
James Wilkinson Aug 22, 2017 12:12 PM


Aria Zanganeh
Aria Zanganeh Oct 31, 2017 12:27 AM

We were looking for .Net Core compatibility! Great stuff

Please login to comment.
Latest blogs
Join the Work Smarter Webinar: Working with the Power of Configured Commerce (B2B) Customer Segmentation December 7th

Join this webinar and learn about customer segmentation – how to best utilize it, how to use personalization to differentiate segmentation and how...

Karen McDougall | Dec 1, 2023

Getting Started with Optimizely SaaS Core and Next.js Integration: Creating Content Pages

The blog post discusses the creation of additional page types with Next.js and Optimizely SaaS Core. It provides a step-by-step guide on how to...

Francisco Quintanilla | Dec 1, 2023 | Syndicated blog

Stop Managing Humans in Your CMS

Too many times, a content management system becomes a people management system. Meaning, an organization uses the CMS to manage all the information...

Deane Barker | Nov 30, 2023

A day in the life of an Optimizely Developer - Optimizely CMS 12: The advantages and considerations when exploring an upgrade

GRAHAM CARR - LEAD .NET DEVELOPER, 28 Nov 2023 In 2022, Optimizely released CMS 12 as part of its ongoing evolution of the platform to help provide...

Graham Carr | Nov 28, 2023

A day in the life of an Optimizely Developer - OptiUKNorth Meetup January 2024

It's time for another UK North Optimizely meet up! After the success of the last one, Ibrar Hussain (26) and Paul Gruffydd (Kin + Carta) will be...

Graham Carr | Nov 28, 2023

Publish content to Optimizely CMS using a custom GPT from OpenAI 🤖

Do you find the traditional editor interface complicated and cluttered? Would you like an editorial AI assistant you can chat with? You can!

Tomas Hensrud Gulla | Nov 28, 2023 | Syndicated blog