Patch 3 - Bug fixes and Minor Enhancements

Date: April 15, 2010

Version affected: v2.00.

Notes:

This is a NOT cumulative patch. You should install version 2.0 patches 1 and 2 before installing this update.
This patch updates the web-module string table (strings.txt). If you are using a translated version of WBT Manager you will need to obtain a new translated version from your reseller or translate and add the new strings to your existing table. If you have modified the standard version of strings.txt you should make a backup copy before installing the patch. After installtion restore your customized version and update it with the changes in this patch. See string table changes for more information.
This patch includes a SQL script which must be run to enable some enhancements.

M2010011801 - fixes for query string vulnerabilities
A number of clients reported that web application review software reported query string parameter vulnerabilties in some of the WBT Manager student menu pages. The reported pages have been modified to perform additional validation on their query string parameters.
M2010020601 - Ampersand in lesson launch URL causes XSL error in ILT instructor menu.
The ILT lesson launch URL is displayed on the Instructor menu so that instructors may launch the lesson content as a presentation during class. The display copy of the URL was not being properly XML-encoded. The presence of an "&" caused an error on the page. This has been corrected.
M2010032101 "No-click"M2010032101 "No-click" menu doesn't launch lesson on FireFox
The delay while the API adapter Java applet loaded was causing the lesson menu to fail to launch the lesson for single lesson "no-click" menu-style courses (lesson is supposed to launch automatically when the course menu is displayed). This has been corrected by the change to a Javascript-only API adapter (C2009121602 below).
C2009121602 - Change API to use Javascript instead of Java
Due to various Corporate security policies regarding Java, the Java API adapter which was used in WBT Manager had become troublesome for a number of clients. It has been replaced by a fully JavaScript version which uses built-in browser components for communication. See JavaScript API Changes below for more information.
C2008071501 - Add individual status reports to web module
The Ad-Hoc report writer has been enhanced to include data from individual lesson sessions (ISTATS and IHSTATS).
C2010021301 - Allow ad-hoc report writer to display student password.
The Ad-Hoc report writer has been enhanced to allow System Administrators to define report which include the student password. This feature is disabled on installation. See Setting up student password reporting below for more information.

Installation:

First unzip the patch files to a temporary directory. Copy the web_module directory to the web-server where WBT Manager is installed.

Web-Module:

On the web-server where the WBT Manager Web-Server Application is installed:

Copy the web_module folder from the patch to a convenient temporary location on the web-server.

If you have a translated version of WBT Manager or have customized the string table (strings.txt ) make a backup copy of strings.txt and update it as described in string table changes below.

Execute the setup.exe program found in the web_module directory.

When prompted for an installation directory browse to the location where the WBT Manager Web-Server Application is installed.

Restore the modified backup copy of the strings.txt file (as mentioned above) if necessary.

Run the SQL script patch200_3.sql to update the Ad-Hoc Report utilities fields and add new menu styles as described in Updating the database below.

Run the reload.asp script in the browser to refresh the string table for changes made in this patch.

Verify access to the WBT Manager Web-Server Application and perform any other desired checks.

String Table Changes

This patch will replace the string table (strings.txt ) used by the web module. If you have a translated version of WBT Manager you will need to obtain a new version from your reseller or add the new strings to your existing file.

To update the file yourself:

Make a copy of your existing strings.txt file.
Translate and change the entries in the file web_module\patch200_3-strings.txt
Copy the new strings into your backup copy of strings.txt in the appropriate places (numeric order).
Install the patch.
Replace the patch's strings.txt file with your updated one.

Javascript API Changes

The Java applet previously used as the SCORM API adapter has been re-written using Javascript to remove the requirement that a Java runtime be installed on student systems. All previously existing functions have been duplicated so from the viewpoint of a lesson, there will be no difference in behavior.

From a WBT Manager courseware administion viewpoint there are a couple of differences and improvements.

The API adapter is now attached to the student menu instead of the course menu. This allows a course which contains a single lesson to launch the lesson directly from the student menu without an intervening course menu. There is a new menu style flag for this (described below).
API debug information is now displayed in a separate browser window instead of in a special pane on the course menu.

To enable menu-less launch of a lesson a "nomenu" flag has been added for use in menu styles. A script is included in this patch to add 2 new styles with this flag set. Additional styles may be created using the instructions in the WBT Manager Installation and Customization Guide. Include "nomenu=1" as a parameter to the menugen URL (e.g.; crsmenu.asp?nomenu=1&api=1).

Updating the msgtemplate files

The message template files in the msgtemplates folder are being updated in this patch. If you have been using the WBT Manager External Script Interface and have customized those files you will need to copy your changes to the new versions of the files or copy the changes from the patch into your customized files. The new versions of the message templates are different in that they HTML encode any passed in parameters which are displayed by the message to prevent script encoding exploits. For example:

Before: <%=Request("errortext")%>

<P><%=StringItems.LookupValue(g_nLangOffs+185172)%> <%=Request("errortext")%></P>

After:

<P><%=StringItems.LookupValue(g_nLangOffs+185172)%> <%=Server.HTMLEncode(Request("errortext"))%></P>

Before applying this patch:

Copy the new versions of the msgtemplate files from web_module\standard_files\msgtemplates to a working folder.
Add your custom changes to the files in the working folder.

After the patch is applied copy the customized versions of the files to the msgtemplates folder on the web server.

Updating the database

The new menu styles for the Javascript API and the changes to the Ad-Hoc report writer require new database entries to be made.

Launch the RUNSQL.EXE program from the patch\database folder.
Select the DSN connected to the WBT Manager database and log on using the same database account and password as is used for the System Administrator module.
Select the patch200_3.sql script file and click the "Execute" button.
The script should be executed without stopping until the program displays "End Of File.". If you execute the script more than once you will see error messages beginning with "error ignored by directive". This is not a problem.

Setting up student password reporting

This patch adds the ability to include the student's password in Ad-Hoc reports. For security reasons, this capability is disabled by default. When enabled, only a system-level administrator can define a report which includes student passwords. Once defined, any user with access to the report will be able to view the passwords.

To enable reporting of student passwords add the following keyword to the [misc] section of appsettings.ini:

;adhocallowpassword controls whether the ad-hoc report writer can display student passwords
;Default is "N" If set to "Y":
; component wbtman7n.dll must be installed and registered in the windows system folder
; if passwords are encrypted.
; only system administrators will be able to create reports containing passwords
; any user with access to the report will be able to view passwords.
adhocallowpassword = "Y"

Run reload.asp to load the new setting. System administrators will now see "Student Password" in the list of available fields for Ad-Hoc reporIf you have encrypted passwords in the database with the Site Configuration Utility then the Student Password column will display "Encrypted". If you need to display those passwords contact Integrity eLearning for assistance.

Web-Module
Destination	File	Version	Date
<web-dir>	global.asa		2010/02/13 11:39 AM
	reload.asp		2010/02/13 11:40 AM
<web-dir>/asp	ahredit.asp		2010/02/12 12:19 PM
	apidbglog.asp		2010/04/05 9:42 AM
	apiload.asp		2010/04/02 9:59 AM
	apitext.asp		2010/04/02 9:58 AM
	clsmenu.asp		2010/04/02 5:00 PM
	crsmenu.asp		2010/04/05 12:03 PM
	crsmenu2.asp		2010/04/05 11:39 AM
	crsmenublank.asp		2010/04/13 3:41 PM
	emailpw.asp		2010/01/26 5:06 PM
	fframe.asp		2010/01/26 5:07 PM
	iltinstr2.asp		2010/02/06 11:11 AM
	menu.asp		2010/04/05 12:10 PM
	menuutils.inc		2010/04/05 5:26 PM
	querystringfilter.inc		2010/04/07 11:01 AM
	reportah.asp		2008/07/15 5:11 PM
	reportah.inc		2010/02/13 12:06 PM
	scorm6.asp		2010/04/02 9:57 AM
	set1.asp		2010/01/26 4:35 PM
<web-dir>/jar	austart.js		2010/04/02 5:06 PM
	crsmenuutils.js		2010/04/05 11:57 AM
	httppreq.js		2010/04/02 5:06 PM
	jsinherit.js		2010/04/05 11:48 AM
	scorm1.js		2010/04/13 6:07 PM
	scorm2.js		2010/04/13 5:03 PM
	scorm3.js		2010/04/13 5:03 PM
	scorm3a.js		2010/04/02 5:05 PM
	scorm4.js		2010/04/13 6:24 PM
	scorm5.js		2010/04/02 5:04 PM
	stumenuutils.js		2010/04/05 5:31 PM
<web-dir>/xsl	ahredit.xsl		2008/07/15 4:45 PM
	clsmenu.xsl		2010/04/02 4:53 PM
	crsmenublank.xsl		2010/04/13 3:27 PM
	menu.xsl		2010/04/02 4:52 PM
<web-dir>/msgtemplates	emailpwer.asp		2010/01/26 5:10 PM
	emailpwnf.asp		2010/01/26 5:10 PM
	emailpwok.asp		2010/01/26 5:10 PM
	enrollcertstudenrolled.asp		2010/01/26 5:10 PM
	enrollcertstudfailed.asp		2010/01/26 5:10 PM
	enrollcertstudnoprog.asp		2010/01/26 5:10 PM
	enrollcertstudnostud.asp		2010/01/26 5:10 PM
	enrollcertstudsuccess.asp		2010/01/26 5:10 PM
	enrollcertstudsuccessp.asp		2010/01/26 5:10 PM
	enrollstudenrolled.asp		2010/01/26 5:10 PM
	enrollstudfailed.asp		2010/01/26 5:09 PM
	enrollstudnocrs.asp		2010/01/26 5:10 PM
	enrollstudnostud.asp		2010/01/26 5:09 PM
	enrollstudsuccess.asp		2010/01/26 5:09 PM
	regstudbadid.asp		2010/04/12 1:29 PM
	regstuddupemail.asp		2010/01/26 5:10 PM
	regstudduplogin.asp		2010/01/26 5:10 PM
	regstudduprefid.asp		2010/01/26 5:10 PM
	regstudfailed.asp		2010/01/26 5:10 PM
	regstudmodlogin.asp		2010/01/26 5:09 PM
	regstudsuccess.asp		2010/01/26 5:09 PM
	verstuderror.asp		2010/01/26 5:10 PM
	verstudfound.asp		2010/01/26 5:10 PM
	verstudmissing.asp		2010/01/26 5:10 PM

Version 2.0 Patches

*end of file*