Resolved Problem Tickets

206855: Add cdn.datatables.net to csp: Add cdn.datatables.net to script-src-elem in commdev and portal. Causing error in permit edit screen (and probably projects).
- Expected Functionality: The Host is part of the Content Security Policy. This policy uses the script-src-elem response header. This applies to both commdev and portal.
208202: Update CSP to allow content from another source: Please update the Content Security Policies for {{variable.Community Development}} to allow content from share.vidyard.com. The Product team would like this in time for the next Quarterly Product Webinar with customers on 6/23/2025.
- Expected Functionality: For Vidyard on the website, we were able to play any of their videos, then once we clicked on "share {{glossary.HTML}} snippets, able to paste inside one of the forms. Again, tested on the portal, and the video was playing.
208374: Fix Log Error in Elkhart: The Login error issue was there for the client.
- Expected Functionality: The login issue has been resolved.
208267: Update AutoNumber GetAutoNumber to Not Lock When Not Updating: The AutoNumber's routine is locking tables even when not updating anything, which makes no sense.
- Expected Functionality: New permits and licenses were created. Permits had an 'approved' status, and licenses had an 'active' status. The numbers for these permits and licenses were checked. They were in the correct order.
205339: Research CORS Issue: 27Global is trying to load map layers on staging, and they are getting the following errors. Sounds like the recommended way to do it is to have your server read the Origin header from the client, compare that to the list of domains you would like to allow, and if it matches, echo the value of the Origin header back to the client as the Access-Control-Allow-Origin header in the response."
- Expected Functionality: Research: If your server can read the Origin header from the client. Compare this header to your list of allowed domains. If it matches a domain, send the Origin header's value back to the client. This value should be the Access-Control-Allow-Origin header in the response.
207612: Pen Test Finding 2.1.4 Login Brute forcing: Fix Time zone Issues: The application's login mechanism does not implement sufficient protection against brute force attacks. An attacker can send an unlimited number of authentication requests to the login endpoint without triggering any rate limiting, account lockout, or CAPTCHA challenges. This vulnerability enables attackers to systematically attempt large numbers of username-password combinations, either to guess weak credentials or to validate known username/email lists usingautomated tools.
- Expected Functionality: For login attempts, a user can try 10 times. After the 10th try, a pop-up message appears: "Too many incorrect tries". On the portal side, after 10 attempts with incorrect passwords, a message also appears. It states: "Try again after 5 minutes due to too many unsuccessful logins".
206310: Security Scan: {{glossary.SQL}} Injection / Apostrophe Issues parcels: SQL Injection (SQLi) is a security vulnerability that occurs when an application improperly handles user input, allowing an attacker to manipulate SQL queries executed by the database. Affected Endpoints:
- - /c4sandbox/parcels/combine
  - /c4sandbox/parcels/combinefloors
  - /c4sandbox/parcels/combinelots
  - /c4sandbox/parcels/combineunits
  - /c4sandbox/parcels/searchForCombine
- Expected Functionality: After creating a new parcel, lots, building, suites with a special character mainly (' and "). It got saved once I created these special characters in the name. Then, once I searched for these names, I was able to get the right result.
206309: Security Scan: SQL Injection / Apostrophe Issues item data: SQL Injection (SQLi) is a security vulnerability that occurs when an application improperly handles user input, allowing an attacker to manipulate SQL queries executed by the database. If inputs are not correctly sanitized or validated, an attacker can inject malicious SQL code into the query, potentially gaining unauthorized access to data, modifying it, or even executing administrative operations on the database. SQL Injection (SQLi) is a prevalent and potentially devastating security vulnerability that arises when an application fails to properly sanitize or validate user input before incorporating it into SQL queries.Affected Endpoints:
- - /c4sandbox/fees/item data
- Expected Functionality: Tested endpoint through Postman.
206308: Security Scan: SQL Injection / Apostrophe Issues populate widget data: SQL Injection (SQLi) is a security vulnerability that occurs when an application improperly handles user input, allowing an attacker to manipulate SQL queries executed by the database. If inputs are not correctly sanitized or validated, an attacker can inject malicious SQL code into the query, potentially gaining unauthorized access to data, modifying it, or even executing administrative operations on the database. SQL Injection (SQLi) is a prevalent and potentially devastating security vulnerability that arises when an application fails to properly sanitize or validate user input before incorporating it into SQL queries.Affected Endpoints:
- - /c4sandbox/app/populatewidgetdata
- Expected Functionality: Tested endpoint through Postman.
198549: Correct Log Errors for Large Customers - Form Errors: We previously looked through our error logs for our 3 largest clients. We found two errors we want to correct.
- Expected Functionality: The log errors have been corrected.

May 8, 2025 Release Notes