SAS Drug Development Release Notes 35DRG07

SAS Drug Development Release Notes 35DRG07 SAS Drug Development (SDD) 3.5 is validated to work with/on the following technologies: MS Windows: Windows 7 and Windows XP Mac OS X: Snow Leopard (10.6) Internet Explorer 7 & 8 JRE 1.5 JRE 1.6.0_n, where n is not 14 (SDD 3.5_04 and later) Firefox 3.6 Safari 5.n SAS 9.2M3 (SDD 3.5_04 and later) This Hot Fix contains fixes for the following defects described below. Hot Fixes are cumulative so defects resolved in previous Hot Fixes are included below as well. Please note that after the list of fixes is a brief list of known unresolved issues. Reference # US4639 Description: Libname Performance issue in PE With SDD 3.5_06 hotfix, functionality was added to enable all the associated librefs to display when the libraries tab is displayed. Instead of pulling all this information on start-up, it is desired to have other options in place to reduce the time it takes before the tab is operational. Resolution: The contents of the libraries are not loaded into the library viewer now until a user selects a particular library to view. This eliminates the performance issue that was caused by loading all the library contents up front when the library viewer is initially rendered. Page 1 of 14

Reference # US4638/DT4268 Description: PE: general parsing exception The following code will generate an improper exception in the Process Editor: Resolution: %let study = test; %let header2=%str(double-blind Phase Study %upcase(&study.)); %let LAlign=%STR(STYLE(HEADER)=[JUST=LEFT ASIS=ON]); %put &header2.; %put &lalign.; The issue was caused by a logic error in the Process Editor code parser. This is now fixed. Reference # US4637/DT4264 Description: Incorrect parsing of SAS code from CDI transformation In the Process Editor, the following SAS code incorrectly generates the error "Unmatched brackets were detected in the following statement(s) with that line listed: Resolution: %put WARNING: %nrstr(% createodmview()); The issue was caused by a logic error in the Process Editor code parser. This is now fixed. Release Notes from Hot Fix 35DRG06: Reference # DT4253 Description: When there are a large number of groups, a user clicking on a userid from the Admin Users page will experience a markedly slower response time to surface the page with the user s details. Resolution: With this release, the performance of the detail display has been improved when a user clicks on a username to view details from the Admin Users page. Reference # DT4260 Description: Slow performance listing groups when the system has thousands of groups defined. Resolution: In this release, when a user views the admin->groups page, performance has been improved for the list of groups appearing. Reference # DT4258 Description: Cursor at the bottom of log files after running process Resolution: The cursor is now located at the top of the log file when a log file is opened after running a process. Page 2 of 14

Release Notes from Hot Fix 35DRG05: Reference # DT4245 Description: Users could not display columns of a study (.sdfxml) in the Data Explorer. Resolution: Users are now able to open a study, expand the table, and add the columns of that table to the Data Explorer viewer. Reference # DT4238 Description: Certain versions of JRE 1.6 did not work with the new Digi-Sign certificate. Resolution: Some versions of JRE 1.6 did not work with the updated method of signing the JWS application jars. This issue is resolved. Reference # DT4237 Description: Added Library Viewer functionality Resolution: From within the Process Editor, SDD now has library viewer functionality available. This includes displaying a listing of all SDD libraries, listing the contents of those libraries, and allowing users to open datasets in the Data Explorer. Reference # DT4235 Description: Increased default heap size for WebLogic system administration server Resolution: SAS s internal hosting organization has requested adding a default heap size of 1024m for the WebLogic Server Administration Server to the sasenv.sh script that is invoked at server startup. This will prevent OutOfMemory errors on the admin server.. Release Notes from Hot Fix 35DRG04: Reference # DT4184 Description: Issues with the Process Editor parser Resolution: In this release, the Process Editor finds all parameters entered in the Process Editor regardless of the SAS code used within the process. The performance in the Process Editor was improved. Reference # DT4182 Description: Copying files from one versioned folder to another versioned folder enables delete permissions Resolution: In this release, when a user copies files from one versioned folder to another folder, the delete permission will be disabled. Page 3 of 14

Reference # DT4181 Description: Process Editor log shows user password in clear text Resolution: In this release, by default mprint is turned off for the %sasdrugdev_login macro. When the user hides the password parameter in the UI and log (obfuscate), the password will not show up in the log. Note: if a user explicitly uses options mprint; in their code, then the password will be displayed in the log. Reference # DT4179 Description: Parsed Code Warnings in Process Editor when code contains LIKE with % Resolution: In this release, using % with LIKE will work as expected with no warning messages. Reference # DT4164 Description: Configuration changes not being honored for Disabling Parsing Messages Resolution: In this release, the popup windows indicating parsed code errors will not appear if the user has disabled parsing messages. Reference # DT4150 Description: SDD 3.5x Default Options for SYMBOLGEN Resolution: In this release, customers can set the default option for SYMBOLGEN Reference # DT4149 Description: Process Editor is not handling FMTSEARCH properly Resolution: In this release, SAS Drug Development outputs the values as defined using FMTSEARCH. Reference # DT4148 Description: Scheduled job does not always kick off at the scheduled time Resolution: In this release, the underlying Quartz component used for scheduling jobs has been updated. All jobs in SAS Drug Development initiate at the time scheduled. Reference # DT4112 Description: Process Editor work library doesn't display if validvarname option = v6 Resolution: In this release, the work library displays properly regardless of the setting of validvarname. Page 4 of 14

Reference # DT4090 Description: Job Editor using incorrect parameter when using Task and Base Path Resolution: In this release, jobs created in SAS Drug Development that contain tasks which again contain Base Path parameters will display the correct parameters when opening the Parameter Resolution window for a task where the Base Path parameters have already been changed. Reference # DT3999 Description: Process Editor not getting latest version of object before run Resolution: In this release, customers can set a registry setting to determine whether the Process Editor should check for updates and prompt for reload if a file has been changed. If a file has been updated while the Process Editor is open, the user will be updated if they want to reload the updated file before submitting. Reference # DT3873 Description: A codedmessage that embeds a line of SAS code containing % signs causes issues with the results Resolution: In this release, the Process Editor will handle without any errors a codedmessage that embeds SAS code lines containing % signs. Reference # DT3708 Description: Parser error over-ride does not work for processes that have input processes Resolution: In this release, SAS Drug Development insures that the Run Time Execution Option set to Disable parsing messages and enable program execution is honored for all processes including those that have input processes. Reference # DT3501 Description: e-sig signing session timeout Resolution: In this release, SAS Drug Development enforces a session timeout for the e-signature session after 30 minutes from when it was initiated. Reference # DT3220 Description: SAS Drug Development treating docx (Word 2007) files as zip files Resolution: In this release, all new Word 2007 files stored in SAS Drug Development with the extension.docx will be recognized by SAS Drug Development as Word documents and will open in Word if available. Reference # DT3210 Description: Output file name (kanji) not output correctly Resolution: In this release, for those customers using Shift-JIS, output files will have the correct filename extension. Page 5 of 14

Reference # DT3209 Description: Process Editor calling process needs to be saved before a run Resolution: In this release, the Process Editor will execute calling processes correctly regardless of whether the calling process has been saved before being executed. Reference # DT3004 Description: Change permissions on folder should generate audit trail for all its children Resolution: In this release, changing the permission on a folder will generate an appropriate audit trail record for all of the children of the folder as well. Reference # DT2957 Description: Saved parameters base path not being saved Resolution: In this release, SAS Drug Development will retain the modified base path value. Reference # DT2312 Description: Data Explorer Mnemonic value incorrectly displaying Label value Resolution: In this release, SAS Drug Development will retain and display the value set for the variable mnemonic. Reference # DT2184 Description: File Properties display from Data Explorer is not usable Resolution: In this release, the user interface for the Data Explorer s File Properties UI has been improved to allow easy viewing of this information. Reference # DT1134 Description: User can log off SAS Drug Development and leave the Process Editor open and cannot save back to SAS Drug Development Resolution: In this release, if a user logs out of SAS Drug Development while the Process Editor is open and code changes have been made in the editor, the user will be provided the opportunity to save their changes before logging them out of SAS Drug Development. Reference # DT988 Description: Description box too small to see text entered Resolution: In this release, the User Interface has been changed allowing for viewing of long descriptions when customizing types in the Input Data Table. Page 6 of 14

Reference # DT1940 Description: Finer granularity for Scheduler Resolution: In this release, the Scheduler will allow users to define recurring jobs at an hourly, twice per hour or quarterly (four times per hour) schedule. For twice per hour, the jobs will kick off on the hour (:00) and half past the hour (:30). For quarterly, the jobs will initiate at :00, :15, :30 and :45 past the hour. Jobs that run hourly may be selected for any time during the hour (e.g. 7:34) and will then run hourly from that time (e.g. 8:34, 9:34, etc.). Reference # DT4163 Description: Audit trail query with dates causes full-table scan on Oracle. Resolution: In this release, SAS Drug Development has been updated to optimize audit trail queries involving dates reducing the amount of time needed to retrieve this information for the reports. Reference # DT4162 Description: Index on Audit trail table delaying updates Resolution: In this release, an index that had been added in the 3.5 version was removed as it was not needed and was seen to be adding unnecessary time to every new audit record added to the table. Reference # DT4145 Description: Excessive logging generated by login modules Resolution: In this release, unnecessary debug activity was disabled which reduces the amount of logging activity generated during logins to SAS Drug Development. Reference # DT2985 Description: Provide error message from Advanced Loader when an XPT file conversion fails Resolution: In this release, the user will be notified with an appropriate error message when an XPT file conversion fails when using the Advanced Loader. Page 7 of 14

Release Notes from Hot Fix 35DRG03: Reference # DT4125 Description: Restrict external URL access Resolution: In this release, additional authorization checks have been added to insure that users who enter URLs to access SDD are authorized with the same checks as if they had accessed the location via an internal SDD link. Reference # DT4126 Description: Suppress informational dialog boxes in Process Editor for parameter resolution in an input process. Resolution: In this release, a configuration parameter has been edited that, when enabled, suppresses informational dialog boxes from displaying when a program is submitted from the Process Editor. The default setting for this setting maintains the previous behavior which is to show the informational dialog boxes. Reference # DT4127 Description: Need to prevent cross-site scripting Resolution: In this release, additional checks have been put into place to insure crosssite scripting cannot be initiated from within the SAS Drug Development application. Reference # DT4129 Description: User should not have to close applications and log out to pick up changed credentials in applications Resolution: In this release, when a password is changed it is immediately effective within that user s current SDD session. NOTE: If there is a Process Editor session open at the time of the password change, the Process Editor will not honor the new password during that session. All new Process Editor sessions launched subsequent to the password change in SDD will honor the new password. Reference # DT4132 Description: A job run in the scheduler runs slower than if run through the Process Editor Resolution: In this release, changes have been made to the way the scheduler submits jobs so that the time it takes to run submitted jobs is approximately the same amount of time if not better than running through the Process Editor. Page 8 of 14

Release Notes from Hot Fix 35DRG02: Reference # DT4016 Description: By default, all users of SAS Drug Development access the SAS servers through the same trusted user account. It is feasible for a skilled, authorized, malicious user to gain access to the inputs and outputs of a SAS job submitted by a different user. Only a user with valid credentials in the system could acquire this access. Resolution: The issue has been addressed in this release. The resolution requires an external LDAP server to manage users on the SAS servers. Individual user sessions are connected to the SAS application server through separate accounts which only have access to the SAS work files for that account. This fix requires changes to the configuration of the SAS Drug Development system to include the LDAP server. A script will run when scheduled to check all SAS Drug Development user ids against previously defined user ids on the LDAP server. The script will either add user ids for new accounts or delete user ids for retired accounts. A new user will not be able to perform any functions within SAS Drug Development that require a SAS session until the script has run and created the corresponding id on the LDAP server. A change order must be submitted to request this fix. Additional hardware is required for any instance implementing this change. Reference # DT3712 Description: SAS logs in saved job logs do not contain carriage returns resulting in one long string of the entire SAS log. Resolution: This issue is resolved in this release. SAS logs in a saved job log now contain carriage returns. Reference # DT4097 Description: In the Audit Trail query window, the From and To dates in the selection criteria appear as 20010 instead of 2010. Resolution: In this release, this issue has been resolved. The error in the display caused incomplete results in the audit trail search. With the fix of the display date, the audit trail results are now comprehensive. Reference # DT4107 Description: When a user whose userid begins with two consecutive numbers uploads a data table, the columns metadata is unavailable. Resolution: This issue is resolved in this release. Page 9 of 14

Reference # DT4108 Description: The Scheduler does not resolve 2 provided macro variables: _SDDURL_ and _SDDDAV_ Resolution: This issue is resolved in this release. Release Notes from Hot Fix 35DRG01: Reference # DT2141 Description: In a UTF-8 encoded instance, the resulting log and SAS output from an executed process have garbled Double Byte Character Set (DBCS) characters. The characters are distorted regardless if the user executes the process with or without saving out the log and list files, as well as when the user views the files from a saved job log (jlgxml). Resolution: In this release, this issue has been resolved. One additional note to make: SAS log and output require a viewer consistent with the client encoding to display DBCS correctly in files opened from the Job Results Viewer. The SAS System Viewer does not support UTF-8, so another viewer must be used. Reference # DT2157, DT2651, DT4015 & DT4025 Description: In a UTF-8 encoded system, DBCS characters are garbled in both ODS RTF and PDF output files. Resolution: In this release, DBCS characters are correctly displayed for both Shift- JIS and UTF-8 encoded instances in ODS RTF output. ODS PDF output displays properly for Shift-JIS encoded systems, however UTF-8 encoded systems require a workaround to properly display the file. UTF-8 ODS PDF Workaround: Add the following OPTIONS statement before the first ODS PDF statement: OPTIONS locale=ja_jp; Reference # DT2225 & DT2321 Description: In an UTF-8 encoded instance,.csv,.xls,.dat and.tab files do not display correctly in the Data Explorer. Resolution: This is resolved in this release. Reference # DT2380 & DT4002 Description: PDF files created by printing to PDF from the Process Editor in UTF-8 instances do not display DBCS correctly. Resolution: This issue is outside the code base of SAS Drug Development; however,!sasroot\nls\u8\sashelp was added to our SASHELP definition as a workaround to this problem. Page 10 of 14

Reference # DT3026 Description: A results file saved as an.xpt in the Data Definition Explorer later opened in the Data Explorer opens with the error: "the dataset contains no data; an empty record has been added for display." Resolution: This issue is resolved in this release. Reference # DT3030 Description: In the Data Definition Explorer and the Process Editor, information displayed in menus is English; however, in some pop-up menus or dialog boxes, the information is displayed in Japanese. Resolution: The information in both of these locations is now specified in English. Reference # DT3219 Description: Access to SAS Drug Development through a proxy that requires authentication is not functioning. Resolution: Issue has been resolved in this release. Reference # DT3527 Description: Output files created from the Process Editor incorrectly have a.txt as part of the file name. For example the file created would be file_new.txt.pdf instead of file_new.pdf Resolution: Issue is fixed in this release. Output files do not have the additional.txt within the filename. Reference # DT3710, DT4081, DT3782, DT4019, & DT4037 Description: DBCS and Extended ASCII characters are garbled in both the Permissions report and the Exported Audit Trail report when opened in Microsoft Excel. Resolution: In this release, this issue is resolved for Single Byte Character Set (SBCS) and Shift-JIS systems. On UTF-8 encoded instances, Extended ASCII and DBCS characters will not display properly when opened in Excel. This is because of a known issue where files in.csv format, encoded in UTF-8, do not display Extended ASCII (or DBCS) characters correctly in Excel. The characters will display correctly, however, when the.csv file is opened in the Data Explorer. Reference # DT3974 Description: From within the Process Editor Parameter Resolution window, if the Apply button is clicked more than once, an additional file extension is appended to the current filename and extension. For example if the file was test_file.sas7bdat and the user selected the Apply button again then the file would become test_file.sas7bdat.sas7bdat. Resolution: This is resolved in this release. Page 11 of 14

Reference # DT3790 & 4020 Description: In a DBCS encoded instance, the date is displaying in Western format instead of the system locale. Resolution: In this release, the display date has been changed to use correct locale so that the month, day, and year values will display in the correct order for the user. For Japanese locale the format is yy/mm/dd. Reference # DT3851 & 4044 Description: While parsing code in the Process Editor, the following valid code throws multiple parser errors in the PE: Resolution: %macro test(a =); %put a = &a; %mend test; %test(a = %nrbquote(%%)); %test(a = %str([7.5; 8.0[ is the interval from 7.5 to 8.0, including 7.5 and excluding 8.0)); %test(a = %str( ] )); %test(a = %str( { )); %test(a = %str( } )); %test(a = %nrbquote( ' )); %test(a = %nrbquote( " )); %PUT A;; The parser code has been updated to recognize these statements as valid code. Reference # DT3885 Description: Limit the character input number for the Business Title field on the Personal tab of the Personal Settings page. Resolution: All fields in the Business section of the Personal tab are restricted to only 60 characters, and the five characters < > " % ; are no longer accepted as valid input. If longer data has been entered in these fields prior to the application of this software patch on the instance, the data will be truncated at 60 characters and validated if opened and saved in the Edit User page. Reference # DT3886 Description: Limit the amount of characters accepted in the UserID field on the login page. Resolution: The UserID on the login page has been restricted to 20 characters. Page 12 of 14

Reference # DT4028 Description: From within the Parameters field In the Process Editor, the up and down arrows are not functioning as one would expect. If an item is moved to the first or last position, initially both Down and Up arrows are still active. If the same arrow (e.g. item is at the top of the list and Up is selected) is selected again, both arrow buttons become disabled. Resolution: The arrow button actions have been modified so that if the highlight item is the first item, only the 'down' button is enabled and 'up' button disabled. The converse is true if the highlighted item is the last item. Reference # DT4043 Description: In the Process Editor Customizing window when a customized file type is selected, the appropriate file extension is added to the file name (e.g. test_file.txt). However if the file type is changed, instead of changing the extension, the new extension is added to what is already in the Name field, leading to multiple extensions (e.g. test_file.txt.xml). Resolution: In this release, this issue has been resolved. The selected file type extension is properly appended to the file name. Reference # DT4050 Description: Metadata customizations made in the Study Definition Editor metadata are not saved. Resolution: This is resolved in this release. Page 13 of 14

Known unresolved issues SAS Drug Development Desktop Connection is not yet available for Windows 7 systems At the time of this software release, there is a version of SAS Drug Development Desktop Connection that is being validated on Windows 7 systems. This release should be available soon. Until this release is available, a workaround is to use Xythos Drive 64, which lets you map a drive to a SAS Drug Development location so you can transfer files. Note that this is a standard version of Xythos Drive that is not customized for SAS Drug Development the way SAS Drug Development Desktop Connection is. Not all Clinical Transformation parameters are populated properly within the Publish to SDD plug-in. When using Clinical transformations that contain internal library and filename references (wherever the user encounters a Browse button inside of a Clinical Transformation), the Publish to SDD plug-in does not recognize these and therefore they are not parameterized in SDD. When working with these transformations the user will be required to set the correct parameters within the process code residing in SDD. This will need to be done each time the code is published to SDD. Modifying a SAS process after it has been published to SDD requires an advanced understanding of the SDD Process Editor and the substitution process. In addition, a strong knowledge of the study directory structure is required to ensure that the files and data sets are accessed and stored in the correct folders. Problems with Web folders on Windows 7 systems There is a bug in the current set of Windows 7 patches that prevents the general use of Webfolders. The issue was logged with Microsoft under tracking id REG:110121452716336. At the time of this release, the issue is not resolved. The Xythos Drive 64 or SAS Drug Development Desktop Connection, when made available, are workarounds for this issue. Previously reported issues with resolutions Problems with Java Runtime Environment (JRE) version 1.6.0_14 SAS Drug Development applications (e.g., the Data Explorer and Process Editor) use the Java Runtime Environment (JRE). If a user tries to run any of the SAS Drug Development applications with the 1.6.0_14 version of the JRE, they will get an error message concerning the signing of the files. The application will not launch. The problem is fixed in 1.6.0_15 and all subsequent versions of the JRE. Page 14 of 14