Percussion started as an XML application server, and eventually evolved into a content management system.  All early templating and content editing was done via the use of XML, XSL, and XML applications exclusively. As the system evolved, Velocity replaced XSL as the primary templating language. 

XML is still used heavily in the system backend for Content Editors, and Editor Custom Controls are rendered with XSL.  In order to mitigate a number of XML related security vulnerabilities , the XML Catalog was introduced in version 8.x. 

System XML Catalog

All system DTDs, name spaces and public identifies are registered in the root of the CMS installation folder as PercussionXMLCatalog.xml file. This file is updated at install time to lock down the allowed paths that XSL, and XML files can use in the product. As a system file the catalog is overwritten on every upgrade. 

Customer XML Catalog 

The customer XML catalog is where developers can register any custom XSL controls, DTDS, or public identifiers so that the system allows them to be used in XML and XSL files. 

This file is located in the <Installation Directory>\var\config\CustomXMLCatalog.xml file and will not be overwritten on upgrade.  Any custom entity references, or public identifiers may be added to the custom catalog. 

The catalog file follows the formats defined in the XML Catalog specification; more information can be found here: XML Catalogs 

Updating Custom XSL Controls

After upgrading, any existing XSL Custom controls should be updated to use the following DOCTYPE declaration so that the stylesheet is pointed at entity references in the System Catalog. 

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE xsl:stylesheet [
		<!ENTITY % HTMLlat1 PUBLIC "-//W3C//ENTITIES_Latin_1_for_XHTML//EN" "https://www.percussion.com/DTD/HTMLlat1x.ent">
		%HTMLlat1;
		<!ENTITY % HTMLsymbol PUBLIC "-//W3C//ENTITIES_Symbols_for_XHTML//EN" "https://www.percussion.com/DTD/HTMLsymbolx.ent">
		%HTMLsymbol;
		<!ENTITY % HTMLspecial PUBLIC "-//W3C//ENTITIES_Special_for_XHTML//EN" "https://www.percussion.com/DTD/HTMLspecialx.ent">
		%HTMLspecial;
		<!ENTITY % w3centities-f PUBLIC
				"-//W3C//ENTITIES Combined Set//EN//XML"
				"http://www.w3.org/2003/entities/2007/w3centities-f.ent"
				>
		%w3centities-f;
		]>
<xsl:stylesheet version="1.1" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
                xmlns:psxctl="urn:percussion.com/control"
                xmlns="http://www.w3.org/1999/xhtml" xmlns:psxi18n="com.percussion.i18n"
                extension-element-prefixes="psxi18n" exclude-result-prefixes="psxi18n">

Replacing the XSL control style sheet doc type declaration should resolve any XSL merge errors related to missing entities post upgrade.  A service restart may be required after updated control stylesheet.