Overview:
- What’s new in Umbraco Forms 8.11/9.3?
- And Umbraco Deploy 4.5/9.3?
- How to test
- How to get your hands on the release candidates
- When is the public release?
Update 22/02/2022: the final release has been moved to March 8th, 2022.
The releases are available for solutions based on both CMS versions 8 and 9, and are functionally equivalent. As such if you are using one of both of the products in Umbraco 8, you can update to the release candidate for Forms 8.11 and Deploy 4.5. If you’ve started projects with Umbraco 9 running on .NET 5, version 9.3 of both products is available.
As with previous releases of the products we are issuing them first as release candidates so you can evaluate what’s included and ideally try them out on your existing solutions. Of course, if you do find any issues, or simply have comments for further improvement on the new features, we welcome any feedback.
How to get access to the new versions and where to submit any comments and report issues is discussed at the bottom of the post. Firstly though, let’s have a look at what you can expect 👀
What’s new in Umbraco Forms 8.11/9.3?
Permissions Improvements
With this release, our main focus has been on efforts to improve the permissions model used by Umbraco Forms. Currently, all permissions are managed at the user level, which works fine for sites with a small number of backoffice users, but as that number grows, it can get more and more unwieldy to manage.
Umbraco has for a while now offered the feature of user groups - where each user can be allocated to one or more groups, and the effective permissions they have are based on those assigned to the groups, not to the individual users. With this release, we can now take advantage of that with Forms too.
We've also introduced "start folders", which work in a similar way to CMS content and media start nodes, allowing users to be restricted to a subset of the forms available for editing. And lastly, we've taken steps to support more restricted access that was previously available, as well as split some responsibilities so they can be more finely assigned to users.
In all of this we've taken care to ensure that existing installations work as they did previously following an upgrade. Users will continue to have their existing permissions until you opt-in to the new features. As there are a few, let's take them one at a time…
Default Access To New Forms
Firstly, and sticking with user-specific permissions to start with, we've provided an option to be more restrictive and secure when it comes to access to newly created forms. Currently, all users get access to new forms by default, and it's up to an administrator to remove access should they want to for each user.
This can be cumbersome if the behavior you prefer is to selectively opt users into access to a new form. Hence we've added a configuration option now, allowing you to select whether users are granted (the default) or denied access to new forms.
This is applied in the UmbracoForms.config file in V8:
Or in the appSettings.json file (or equivalent) in V9:
Separation of Design and Data Roles
We've also taken on board the observation that for some organizations, it makes sense to separate the responsibility for form creation and design from that for viewing the form entries. Some backoffice users may require one of these permissions, some the other, and some both.
You are now able to define that as you need as we now have an additional permission you can set for each user in the Form Security section:
By default for an upgraded project all users that have the "Manage Forms" permission will also be granted the one to "View Entries" - ensuring their immediate access remains unchanged. An administrator can then remove one or both as appropriate for different users.
Start Folders
When running Umbraco Forms on Umbraco 8 with form definitions stored in the database, or on Umbraco 9, it's possible to create folders within the forms tree, to store forms, or more folders, inside:
As well as providing for a better organized and more easily navigable tree, we can now use this for defining finer permissions for the users - restricting them to only the forms within one or more folders.
If no start folders are selected, which will be the case by default, the user will be able to access all forms in the backoffice according to their permissions.
If a single start folder is selected, that will act as the root of the tree view of forms. The user will have access to all folders and forms below that selected folder.
Finally, if more than one start folder is selected, they will appear underneath the root of the tree view of forms. The user will have access to only those folders and their descendent folders and forms.
Managing Permissions at the Group Level
As mentioned, in introducing these new features we've made efforts to ensure that after upgrading, each user's permissions remain as they were previously. So if you are happy with the current setup, there's no reason not to upgrade to be able to get the benefits of other features and bug fixes available in the most recent version.
Configuration
If you do want to make use of the new permissions model managed at the group level though, first you need to opt into it via configuration. Set the ManageSecurityWithUserGroups value to true to do this.
You can also define which user groups get access to the newly created form by default, by applying the comma-delimited list of group aliases to the GrantAccessToNewFormsForUserGroups setting.
As before, configuration is applied in the UmbracoForms.config file in V8:
Or in the appSettings.json file (or equivalent) in V9:
Permissions Model and Management
With that in place you'll see that the Users > Form Security section now renders in three sections:
Before discussing the management of permissions, it's first important to explain how the permissions model works when user groups are involved.
Access to a particular resource or feature is determined by the following:
- If the user has a specific user permission set, it is used to grant or deny access in preference to anything set on the user groups they are a part of.
- If the user doesn't have a specific user permission set, they are granted access if at least one of the user groups they are part of has access.
With that in mind, following a new install or an upgrade, the first thing to do is to set the appropriate permissions for each user group, which is done under the Group permissions section of Form Security.Here each user group is listed and the same settings as available for individual users can be set here.
Under User permissions as before we have a list of users, but in this case, it's only users that have a specific user permission record saved. If migrating, this will likely be all of them, and you can now delete these records such that the user's effective permissions are defined by the combination of groups they are part of.
If necessary though, where a particular user needs a particular combination of permissions that you can't or don't want to provide via the user groups, you can retain, or re-create, the user-specific setting:
Finally, under Start folders, the start folders for each user can be set as described above. They are moved to this section simply as we may want to be able to set these for every user, irrespective of whether they have a specific user permission set.
Editable Entries in the BackOffice
We've had a long-standing request, raised by several people, to allow for the update of the entries submitted via the back-office.
With this release, we've made that an option you can give to your editors. By default the editing feature is disabled, but you can enable it for a given user or group via the Form Security section
If enabled for a user, they will be able to click to edit entries when viewing via the back-office, at which point the previously read-only view switches to an editable one. Changes can be made, saved, or canceled via the additional buttons available.
The intention of this feature is not so much to offer a full data entry experience, but more to allow for minor amends and fixes to entries after they have been received via website form submissions. Validation - as defined by mandatory fields and regular expressions - is enforced. More advanced features though, such as conditions and multi-pages available when the form is rendered on the website, aren't supported in the backoffice.
Other Updates
The other updates included in the release are as follows:
- Ensured a column index missing when upgraded from V7 is created.
- Added the option to save the "score" calculated by the reCAPTCHA plugin to the form entry.
- Removed use of inline scripts in the default theme, allowing for the setting of a stricter content security policy.
- Fixed timezone conversion on entries viewer
- Fixed null reference in back-office user check for retrieving records outside of a back-office request
- Fixed case insensitive view name under forms security (V9 only)
- Backoffice translated into two more languages: Danish and Czech added to English, French, Spanish, Italian, and Polish.
And of course, all issues fixed in the recent patch versions of the previous minor releases are included.
And Umbraco Deploy 4.5/9.3?
Content Comparison
A feature we've added in this minor release of Umbraco Deploy is a dialog where you can compare two content items - one in your local environment with another from a remote one. The idea being you can see what has changed and when, and understand if you proceed with a transfer upstream or a restore into the local environment, what specifically is going to change.
You access this via the content tree and will see a dialog looking like the following:
Member Deployment
For most workflows, we'd expect member records held within Umbraco to be created and managed only in production. That said, we've had requests to support the transfer and restore of member records via Umbraco Deploy, and have implemented that for this release.
Due to the potential privacy concern of handling member information, this is something that you need to opt into via configuration if it will be useful.
To enable, add the following setting to your UmbracoDeploy.Settings.config configuration file if running Umbraco 8:
And for Umbraco 9:
The allowMembersDeploymentOperations setting can take four values:
- None - member deployment operations are not enabled (the default value if the setting is missing)
- Restore - restore of members from upstream environments via the backoffice is enabled
- Transfer - transfer of members to upstream environments via the backoffice is enabled
- All - restore and transfer of members from upstream environments via the backoffice is enabled
With TransferMemberGroupsAsContent set to true, member groups can also be transferred via the backoffice, and groups identified as dependencies of members being transferred will be automatically deployed.
Note that it's important to ensure a common machine key is set up for all environments, to ensure hashed passwords remain usable in the destination environment.
How to test
You can either create a new installation using one or both of these packages that are available from the links below or upgrade an existing project. Both scenarios can provide valuable feedback. If upgrading, you may find you need to bump your client-dependency version.
If you find anything in the release candidates that are not working as you’d expect, we’d be grateful for feedback on the Github issue trackers for Forms and Deploy. You’re welcome to add comments to the features and fixes listed linked above or to submit new bug reports (click New Issue and select Bug Report), please prefix the issue with 8.11RC or 9.3RC (for Forms) and 4.5RC or 9.3RC (for Deploy):
How to get your hands on the release candidates
For Forms, release notes can be found on the our.umbraco.com download page where there’s also a download available for Umbraco 8. The release candidates are also available from the appropriate NuGet feed:
For Deploy, the release notes can be found on the our.umbraco.com download page.
Installation is via NuGet:
If you are using Umbraco Cloud and are happy to run some tests there, please reach out to Umbraco support and we can make available the files to run the RC on your project.
When is the public release?
We’re aiming for a full public release on Tuesday, March 1st, 2022, Update 22/02/2022: the final release has been moved to March 8th, 2022. On this date, the packages will be available for new and existing projects on Umbraco Cloud, via Nuget, and/or the download page.
A big H5YR 🙌 to everyone who has contributed to these releases by highlighting pain points, reporting issues, providing feedback, and suggesting solutions. And thanks to everyone willing to lend a hand in testing it out.
Bug reports are best handled on the issue tracker and as always, we welcome you to submit product feedback and questions to product@umbraco.com.
