Orbeon Forms 2021.1.1 PE

We just released the Orbeon Forms 2021.1.1 PE maintenance release!

For details, see the release notes.

You can download the latest version of Orbeon Forms from the downloads page.

We hope you enjoy this release!

Orbeon Forms 2021.1

Today we released Orbeon Forms 2021.1 PE and Orbeon Forms 2021.1 CE!

This release includes improvements to Form Builder and Form Runner, including the ability to test PDFs, to export and import forms in Excel and XML formats, and much more.

For details, see the complete release notes.

You can download the latest version of Orbeon Forms from the downloads page.

We hope you enjoy this release!

More Orbeon Forms PE Log4j maintenance releases

Today we released a new series of maintenance releases that bump the Log4j version to 2.17.1, the latest at the time of publication.

See also our two previous blog posts:

• Vulnerability in the log4j library
• Orbeon Forms PE Log4j maintenance releases

You can download the latest version of Orbeon Forms from the downloads page.

Orbeon Forms PE Log4j maintenance releases

While the recent Log4j vulnerability, discussed in our previous blog post, does not immediately impact Orbeon Forms, we have now upgraded supported versions of Orbeon Forms to the latest version of Log4j 2.

For details, see the following release notes:

• Orbeon Forms 2020.1.6 PE
• Orbeon Forms 2019.2.4 PE
• Orbeon Forms 2019.1.2 PE
• Orbeon Forms 2018.2.5 PE
• Orbeon Forms 2018.1.4 PE

You can download the latest version of Orbeon Forms from the downloads page.

Vulnerability in the log4j library

A few days ago, a serious vulnerability in a popular Java logging library, log4j, was discovered. See CVE-2021-44228 for details.

Orbeon Forms uses the log4j library and therefore we have reviewed the issue. Luckily in this case, since Orbeon Forms use an older (version 1) of the library, it is not likely to be a target of this particular attack because that older version does not support so-called lookups (see this discussion by the authors of the library).

However, if you use the JMS appender in your log4j.xml configuration you might still be subject to some attacks. By default, the Orbeon Forms log4j.xml configuration does not include a JMS appender.

Therefore we recommend that all Orbeon Forms users check their log4j.xml configuration and make sure that they are not using any appenders that use networking features, including JMS and SocketServer. If your configuration logs to one or more files, as is the default, you are safe.

In the meanwhile, we are also working on migrating to a newer logging library such as log4j 2 (which has now addressed this vulnerability) or another library.

Orbeon Forms 2020.1.5 PE

We just released Orbeon Forms 2020.1.5 PE!

For details, see the release notes.

You can download the latest version of Orbeon Forms from the downloads page.

We hope you enjoy this release!

Testing PDF production in Form Builder

Background

Orbeon Forms both features PDF production and the ability to test a form in Form Builder. The latter allows you to run your form in a special “test” mode, where you can test a few of the form’s features without having to deploy it.

But so far there wasn’t a way to test PDF production without publishing your form. This is now improved with Orbeon Forms 2021.1, which allows you to do just that!

How to test PDF production

There are two ways to access the “Test PDF” function:

1. directly from the Form Builder’s main window’s new “Test” menu
2. from the “Test Form” window

The new “Test” menu

In either case, selecting “Test PDF” shows the following dialog:

The “Test PDF Production” dialog

You have access to the following options:

• “Disable the evaluation of ”Initial Values“ formulas”: when selected, all “Initial Value” formulas are disabled, as if they were not present.
• “Disable the evaluation of ”Calculated Values“ formulas”: when selected, all “Calculated Value” formulas are disabled, as if they were not present.
• “Show controls, grids, and sections with dynamic visibility”: when selected, all controls, grids, and sections that can be dynamically shown are shown. This means that those with visibility “Yes” or “Formula” are always shown. Controls with visibility “No” remain not visible.

Use cases for enabling the last option include:

• Verifying that every control, grid, or section that can appear in the PDF appears correctly.
• Exporting the PDF file for printing and manual filling.

Selecting “Continue” simply opens the resulting PDF, which will show in your browser window.

When you access the “Test PDF” feature from Form Builder’s “Test Form” window, any data currently entered in the form will show in the PDF.

PDF templates

Form Runner has allowed you to optionally attach one or more PDF templates to a form, in which case the templates are used by Form Runner to fill out fields.

Now the “Test PDF” dialog lets you choose between the automatic PDF or one of the available PDF templates when testing.

Selecting a PDF template for PDF testing

We hope you will enjoy this new feature of Orbeon Forms 2021.1!