Previously, you could enter any external URLs in the Exact Synergy Enterprise URL and other URL fields across the XML import or export menu paths. This unrestricted access created a security vulnerability as it could connect to malicious servers and expose Exact Globe+ to external attacks.
In this product update, only Administrators are allowed to whitelist URLs in the XML server settings. People without the Administrator rights can only browse the whitelisted URLs in the XML import or export menu paths.
The External links section has been added at System > General > Settings > XML server settings. Administrators can add URLs for Exact Synergy Enterprise or other URLs while non-admin users see these fields in read-only mode. Each URL must be entered on a separate line. An error message will be displayed if the URL is incorrectly entered or contains more than 255 characters. For more information on XML server settings, see XML server settings.
In the XML import or export menu paths, the e-Synergy URL and Other URL fields have been changed to dropdown boxes. These dropdowns display only whitelisted URLs defined in XML server settings. Both the e-Synergy URL and Other URL fields cannot be edited.
These changes also apply to XML > Other import > Integrator.
Note: If you are using PU 506 or lower, the URLs that you have manually defined in the XML import or export will not be available once you update Exact Globe+ to PU 507. Administrators must re-enter the URLs in the XML server settings.
The XML launcher tool has also been updated to retrieve whitelisted URLs from Synergy URL. This applies to Exact.XML.Launcher.Tools.exe in the installation bin folder. For more information on the XML launcher tool, see Using the Exact.XML.Launcher.Tools tool.