Ares 5.0 Release Notes

Modified the course search logic to include courses with no assigned instructors in the search results.

Fixed an issue that would remove the Username entry in a new item's first history tracking entry for items that are cloned from another course on the web. Bug# 4558 

Fixed an issue where custom routing rules were not being applied when cloning an item on the web. Added handling for custom routing rules to be applied to the duplicate item even if the original item has a final routing status (e.g., Request Finished). Bug# 5910 & 4559

Fixed an issue where creating courses via the Course and User Load batch processing would not account for multiple instructors when creating the dictionaries of validation records to add. Bug# 8588

The Ares Client Installer will now display a prompt asking the user to choose between per-user or per-machine installation, instead of installing Ares per-user by default.

The installer will also cache this information along with the selected installation path, so that future installers (versions greater than 5.0.3) will be able to automatically default to the previously selected options.

Added the collection of telemetry data to the Ares Client and Web API. This feature will track the number of times each form and button is used in the Ares Client and each time an endpoint is used in the Ares API to assist with prioritizing features for future updates. Data collection will operate under the following restrictions and privacy considerations:

• The data collected will not be associated with your institution and only a general number of total clicks by all Ares users will be recorded and transmitted to Atlas (e.g., the total number of times the Process Copyright queue is opened on a certain day by all Ares users).
• To protect user privacy, no personally identifying data including item, course, staff, or user details will be collected.
• All data collected will remain internal to Atlas Systems and will not be shared with third parties.

For more information on this feature, see Ares Telemetry Data Collection.

Fixed an issue preventing proper logging for semester start and end dates in certain cases. Bug# 7394

Several new endpoints have been added to the Ares API to provide enhanced functionality. These endpoints can be used to:

• Update information for an existing item record (Read more)
• Retrieve a list of associated notes for a specific item record (Read more)
• Create a new course record (Read more)
• Update information for an existing course record (Read more)

Please use the link for each endpoint above to access its individual documentation.

Updated Ares to use the new Copyright Clearance Center (CCC) web service in order to keep integration with this service functional. The changes made by the CCC to the APIs used in its new web service have required several changes to the CCC configuration settings in the Ares Customization Manager and to the copyright search and ordering process and controls in the Ares Client.

Updated the value of the CCCHomePage customization key used to open the Copyright Clearance Center's home page from the Staff Client to https://www.copyright.com/ to ensure that the link does not break due to future URL changes.

Removed the CCCECCGatewayURI and CCCECCGatewayURL customization keys from the database.

Updated the LTI connection used by Ares to integrate with external course/learning management systems (CMS) from LTI v1.1 to LTI v1.3. Whereas the previous LTI 1.1 connection was handled through the Ares Web Service, the new LTI 1.3 connection will be handled by the Ares API. The following changes have been made to the Ares LTI configuration tools to support this upgrade:

• Added the LTIPlatforms, LTIPlatformMappings, and LTIKeys tables to the database and Ares Customization Manager to support configuring LTI 1.3 integrations with course/learning management systems
• Deprecated the LTIConsumers and LTIFieldMappings tables used to configure LTI 1.1 connections in Ares.
• Added functionality to the LTIPlatformMappings table that will allow you to specify the CMS platform to which each mapping entry should apply in order to ease integrating a single Ares instance with multiple course/learning management systems
• Fixed several pre-existing bugs related to LTI integrations (including Bug# 4445). Additional bug fixes are listed individually in the table entries below

Fixed an issue where the Select button used to add a deep link to an Ares item from a Moodle course (also known as content item selection) would not properly load in the Moodle interface. Bug# 4402

Fixed an issue where creating a course through the LTI would fail when the course had a matching CourseValidation record, but no instructor users from the CourseUserValidation record. Bug# 11996

Added multi-line text input to certain fields that may require longer text values to configure. This functionality will be available for the following fields in the new LTI configuration tables:

• Key field in the LTIPlatforms table
• PublicKey field in the LTIKeys table
• PrivateKey field in the LTIKeys table

Added the WebCookieSameSite key to the Customization Manager under Web | Settings that will configure the SameSite property on the SessionID cookie in order to fix an issue where users would be directed to the Ares login page if navigating to the Ares web pages from an external system, such as an LMS. For more information on configuring this key, see Persisting SessionID Using the WebCookieSameSite Key.

Support for the previous version of the CCC web service has been reimplemented in Ares to fix an issue where orders placed using the prior versions of Ares could not be updated after upgrading to Ares 5.0.4/5.0.6. The following changes will be made to Ares in order to support both the previous and new CCC web services simultaneously:

• All legacy orders placed with the old version of the CCC web service (in Ares v5.0.3 and prior) will display an Order Header label instead of the new CCC Project label in the Ares Client. These legacy orders will also not display a link to the CCC Marketplace. 
• All orders created with the new CCC web service in Ares 5.0.4/5.0.6 will display the CCC Project label and contain a link to the CCC Marketplace.
• The Ares System Manager will now properly update legacy orders if any changes are made to the relevant course/order (e.g., if the course enrollment number changes or if the order is canceled).

Added LegacyCCCUsername and LegacyCCCPassword customization keys to the Ares Customization Manager under System | Copyright that can be configured with separate CCC Marketplace credentials used to authenticate with the old CCC web service in Ares v5.0.3 and prior, if necessary.

Removed session ID information from the LTI 1.3 redirect URLs used by the Ares API to display the Ares web pages from the course/learning management system without requiring user reauthentication. For enhanced security, LTI 1.3 integrations will now set this information using a session cookie in the user's browser.

Fixed an issue where the CCC Status Updater process run by the Ares System Manager would fail when checking for changes to items requiring Special Request copyright orders placed in the Ares Client. Bug# 19678

This fix only applies to the System Manager's CCC Status Updater process that runs nightly according to the time set in the CCCStatusUpdateRunTime customization key. An error may still display on the item record in the Ares Client if an immediate status update is triggered by opening the item record in the Client before the nightly System Manager process has run to update the status (Bug# 19852). This error will resolve itself once the System Manager process runs the following night:

 

Updated the signing certificate used by the application to fix an issue that prevented the SQL Alias Manager from opening.

Fixed an issue where copyright information would fail to show on item records associated with copyright orders placed through the CCC API if the API failed when checking for order updates. Ares will now display the existing copyright information saved to the database for the item and log an error when the API connection fails.  Bug# 20638

Updated the Ares Client Installer to include the latest version of the SQL Alias Manager (v1.3.3) with the updated signing certificate.

Changed the default mail merge method used by the Ares Client to fix an issue where attempting to print after updating to Microsoft Word version 2211 or above could potentially return an error stating "The OpenDataSource method or property is not available because a macro is currently running."

The following new configuration options are available for the Ares web interface to prevent bot-driven spam account creation via the Create Account form (GCreateAccount.html):

• Ares can now integrate with one of three supported third-party captcha providers to add a captcha challenge requirement to the Create Account form (GCreateAccount.html). The captcha challenge will provide extra security against bot-driven account creation by requiring new users to solve the challenge in order to submit the form and create their accounts. The following captcha providers and plans are supported by Ares (note that a separate account must be created with your chosen captcha provider to implement this feature): 

  • Google reCAPTCHA: reCAPTCHA v2 (both the "invisible" and "checkbox" variants) and reCAPTCHA v3
    • Note that reCAPTCHA Enterprise is not supported by Ares
  • hCaptcha: Free "Publisher" plan
  • MTCaptcha: Free plan
• As an alternative to implementing the captcha requirement, user registration can now be completely disabled for accounts created through standard Ares authentication (AresAuth) from the Create Account form (GCreateAccount.html) using the new AresAuthUserRegistrationEnabled customization key. This option will prevent the creation of spam accounts by completely blocking account creation for users who are not pre-authorized for an Ares account via an LDAP or Remote Authentication configuration. This option should not be chosen if you only allow users to register for accounts through the standard Ares account creation and authentication process.

Added the following new customization keys to the Ares Customization Manager to support the new spam prevention options in the Ares web interface:

• AresAuthUserRegistrationEnabled: Determines if new user registrations can be created via standard Ares authentication (AresAuth)
• SLUserRegistrationDisabled: The web status line that appears if registration has been disabled using the AresAuthUserRegistrationEnabled key
• CaptchaProvider, CaptchaSecret, CaptchaSiteID: These keys are used to configure the captcha integration for the user registration form
• SLCaptchaFailure: The web status line that appears if a user fails the CAPTCHA challenge during user registration.

Added the CAPTCHA web DLL tag to the Ares web interface. This tag is used to display the captcha challenge requirement on the Create Account form (GCreateAccount.html) when a captcha integration has been configured in the Ares Customization Manager. 

Added a new Media Expiration Date field to the Items and SharedListItems database tables that can be used to indicate the expiration date of media linked to an Ares item, for example, in the case that an Ares item contains a link to a URL for a hosted video streaming resource that will not be available after a certain date.

<label for="MediaExpirationDate">
<#ERROR name="ERRORMediaExpirationDate">
<strong>
<span class="<#VALIDATION name="ERRORMediaExpirationDate">">
Media Expiration Date</span><br/>
<span class="note">MM/DD/YYYY</span>
</strong>
<input id="MediaExpirationDate" name="MediaExpirationDate" 
type="text" size="40" class="f-name" 
value="<#PARAM name="MediaExpirationDate">"><br/>
</label>

Added the CUSTOMIZATION web DLL tag to the Ares web interface. This tag is used to display the value of a specified customization key as it is configured in the Ares Customization Manager on the Ares web pages. 

Users will no longer be able to register for an Ares account from the TestWeb directory to prevent bot-driven spam account creation from the Ares TestWeb web pages. TestWeb user registration will be disabled by default upon update and cannot be re-enabled.

Expanded the maximum length of the AuthUser and AuthPass fields in the ZServerConfig database table to 100 characters. These fields display as the Username and Password fields on Z39.50 server configuration form in the Ares Customization Manager.

Added support for the Chromium-based Microsoft Edge WebView2 embedded browser within the Ares Client and Client addons. Support for the WebView2 browser will include the following enhancements:

• Easier updating process: The WebView2 browser is updated via the Windows Update process on your local machine, removing the need to update the version of the browser used by Ares by manually updating the Ares Client.
• Accessible version tracking: The version of WebView2 currently installed on your machine and used by Ares can be easily checked by navigating to the Resources tab located within the Ares Options form in the Ares Client. 
• New cache clearing options for easier debugging: A Clear Cache button is available next to the WebView2 version number information on the Ares Options form that will clear the cache for the WebView2 browser (cookies, logins, and browser history) on the local machine for the user currently logged into the Ares Client.

The following addons have been updated to use the WebView2 browser and are available for download in the Ares Addon Directory:

• Google Scholar Search Addon (v1.1.1)
• WorldCat Local Addon (v1.5.3)

Logs for the following Ares components are now configured to use UTF-8 encoding by default to fix an issue where some characters, such as those with diacritics and non-Latin characters, did not display correctly (Bug# 21307):

• Ares Client
• Customization Manager
• Staff Manager
• System Manager
• Web API
• Web Service

The CopyrightDefaultStudents customization key will now default to a value of 1 when used to estimate or place copyright orders in the Ares Client if the key has been set to 0 or a negative number in the Ares Customization Manager.

Fixed an issue where the Ares Client would ignore the method chosen in the CopyrightCourseStudents customization key to calculate costs for copyright orders and instead would always use the number of students registered for the course when calculating the order estimate and the estimated enrollment for the course when calculating the cost for the order when submitted. Bug# 21218

Modified GCreateAccount.html to include the new <CAPTCHA> tag and added the following new files to the default web pages to implement captcha support on the New User Registration form:

• include_captcha_none.html
• include_hcaptcha.html
• include_mtcaptcha.html
• include_recaptcha_v2_checkbox.html
• include_recaptcha_v2_invisible.html
• include_recaptcha_v3.html

Updated the Ares API to v.1.0.8. The new version of the Ares API uses the Microsoft .NET 8 framework in place of the deprecated Microsoft .NET Core 2.1 framework used in previous API versions for enhanced security.

Fixed an issue where an error would occur during the server update process if multiple SystemURL customization keys were defined in the Ares Customization Manager for different processing locations.

Fixed an issue where the ItemFormat and Proxy fields were not included in the POST Items endpoint and were always given default values when using the endpoint to create new item records. The endpoint now supports setting specific values for those fields in the API call. Bug# 9285

Fixed an issue where the Ares API would return the value of the createdVia field in Courses endpoints as an integer. This value will now be returned as a string. Bug# 16946

Fixed an issue where the POST Token endpoint would always return a 500 error in response to staff token requests.

Updated the third-party Newtonsoft dependency used by the Ares System Manager and Ares Web Service to patch a security vulnerability found in the previous version of this component. 

Updated the third-party Newtonsoft dependency used by all client applications (Ares Client, Customization Manager, and Staff Manager) to patch a security vulnerability found in the previous version of this component. 

Fixed an issue affecting the Ares Web API's LTI controller in the Ares Server v5.0.10 release which could lead to issues with existing LTI integrations after the server update.

Fixed the following issues present in Ares Server Installer v5.0.10:

• Fixed an issue where the installer would not create the 'docs' virtual directory in IIS pointing to the AresDocs\PublicDocs folder.
• Fixed an issue where the installer would not correctly load nonstandard paths set for the Ares installation directory and the AresDocs directory in previous installer runs, which would require manually setting those paths to the correct values in the installer options during the server update.
• When SQL server authentication is selected, the installer will now check to ensure the provided database username and password credentials are valid before beginning the installation process.

The Ares Server has been updated to a new version 5.0.15 to fix an issue where creating a new user via the LTI would result in an error. Bug# 28913

An issue with LTI deep linking was resolved. Bug# 29089

Fixed a bug which caused courses created via LTI to have a null Course.CreationDate - Bug# 29398

Fixed a bug which caused Tracking and History entries to have UTC DateTime values (values are now in local time). Bug# 29398

Added ability to specify the IIS web site for Ares installation

For new installations, changed the default logging path the Ares Web API to C:\Ares\Logs from C:\Ares. Will not change or overwrite existing log files for existing installations

Fixed an issue where web.config files could be overwritten during some updates Bug# 29561

Ares has been modified to support the CHIPS (Cookies having independent partitioned state) feature for browser cookies. Browsers are beginning to phase out support for browser cookies with the 'SameSite: None' attribute, which would allow cookies to be sent when directed from a different domain. There are potential security issues with this approach, and CHIPS is one of the alternatives. The CHIPS feature is documented in depth here: https://developers.google.com/privacy-sandbox/cookies/chips

The Web DLL will now create two session cookies - the AresSessionID and the new AresSessionID-Partitioned. When looking for session cookies submitted by the user's browser, Ares will prefer the AresSessionID-Partitioned cookie if it is present and will take its session ID value from that. If not, it will fall back on the AresSessionID cookie for backwards compatibility with browsers that do not support the CHIPS feature yet.

The Web API also sets browser cookies when issuing course or item redirects for LMS integrations through LTI. This has been changed to also generate the AresSessionID and new AresSessionID-Partitioned cookies.

Browser Notes

Support for CHIPS is currently available in most major browsers with the exception of Safari. https://caniuse.com/?search=Set-Cookie%3A%20Partitioned

Supported:

• Chrome
• Edge
• Firefox
• Opera

Not Supported: Safari (MacOs and IOS)

Limited testing showed Safari will support sending the cookies from the LMS to Ares if on the same parent domain. For Atlas hosted Ares customers, support staff can help review the LMS and Ares URLs to see if we can put a domain alias on the Ares server to avoid the issue in Safari.

Another workaround includes setting the LMS tool to not use embeds and instead open in new windows.

If you're experiencing issues, we recommend using a browser other than Safari until it supports CHIPS or using the same domain name for Ares and your LMS.