Plone 5.2.5 has been soft-released. Please give it a try and let me know if there are any critical issues:
https://dist.plone.org/release/5.2.5-pending/versions.cfg
For those who haven't run across soft-releases before, this is the last step before the final release. Because things haven't been finalized yet, some packages may change between now and the release. It is not recommended to use soft-releases in production.
See also the release checklist on GitHub .
The combined changelog of packages:
New features:
Allow to customize the WSGI pipeline [ale-rt, jensens] (#116)
Add repoze.profile profiling middleware support [jensens] (#129)
Make any ctl script python-env aware
[sneridagh] (#162)
Added support for Python 3.9 and restored support for Python 3.5 (needed for Zope 4)
[dataflake] (#164)
Bug fixes:
Enable both weekly and manual builds for GitHub Actions [jugmac00] (#169)
Fix unsupported syntax in the requirements files which prevented to evaluate
the specified constraints during test runs [jugmac00]. (#171)
Applied code style black and isort with Plone/black rules, includes tox/GH-Actions [jensens] (#175)
Fixed $PYTHONSTARTUP file support for the debug command under Python 3
[dataflake] (#167)
New features:
i18ndude rebuild-pot --exclude="name1 name2" now also accepts directory names for exclusion.Bug fixes:
Test with GitHub Actions instead of Travis CI.
[maurits] (#83)
Support Python 3.9. No code changes were needed.
[maurits] (#83)
Do not raise AttributeError when content is None. (#84)
update configuration for version 5 of isort
add support for Python 3.9
make sure "Manager" users can always modify proxy roles
(#50 <https://github.com/zopefoundation/Products.PythonScripts/issues/50>_)
add support for Python 3.9
update configuration for version 5 of isort
Bug fixes:
Bug fixes:
Bug fixes:
New features:
Bug fixes:
Add tests to verify that the intids utility is correct after moving content.
[ale-rt, maurits] (#430)
Improve tox.ini so that plone.api could be tested locally.
Add all tests to travis-ci config.
Add .editorconfig file to plone.api to help enforce coding conventions
[loechel] (#448)
Fix plone.api.content.find to respect object_provides "not" queries.
Fixes: #451
[thet] (#452)
Bug fixes:
Allow to use the @@getSource view when we are in an add form and we do not have the "Modify portal content" permission (#221)
Call fileUpload view explict with @@ to avoid possible plone.rest clashes.
[jensens] (#225)
Fixed stored XSS in folder contents.
From the PloneHotfix20210518 contents fix <https://plone.org/security/hotfix/20210518/stored-xss-in-folder-contents>_.
[maurits] (#3274)
Fixed stored XSS from user fullname and possibly other places where getVocabulary is called.
This is an alternative to the plone.app.users workaround from the PloneHotfix20210518 fullname fix <https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname>_.
[maurits] (#3274)
Bug fixes:
Bug fixes:
Do not allow file: protocol in ical url.
Previously, only file:// was disallowed, but this left room for relative paths.
Taken over from PloneHotfix20210518 <https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url>_.
[maurits] (#3274)
Fix #330 traversal problem in the portlet_events template when an object in a folder is called "image" (backport from master)
[sneridagh] (#330)
Fix events portlet error when rendering with thumbnails suppressed [alecpm] (#332)
New features:
Bug fixes:
Fix checkin/checkout process for containers, since there was an annotation left to "reset" (pos) on checkout and it broke the sections viewlet
[sneridagh] (#93)
Do not break if some custom code provides an alias for Products.Archetypes (#85)
Black and pep8 compliance
[sneridagh] (#88)
Update relations on Check-In WorkingCopy, by trigger an ObjectModifiedEvent event
black and flake8 formatting
[2silver] (#89)
Update Dutch translations.
[fredvd]
Fix German translations.
[pbauer]
Fix French translations.
[boulch, laulaz]
Bug fixes:
Products.PloneHotfix20210518 <https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-url>_.Bug fixes:
PloneHotfix20210518 <https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser>_.Bug fixes:
Bug fixes:
Bug fixes:
Fixed another deprecation warning for ObjectEvent from zope.component.
[maurits] (#3130)
Fix fields in the interface IRuleConfiguration: enabled, stop and cascading are not required. [andreesg] (#11)
Bug fixes:
Fix export/import of content in Python 3.
Fixes issue 124 <https://github.com/plone/plone.dexterity/issues/124>_.
Also fixes the tests in combination with newest Products.GenericSetup 2.1.2.
[maurits] (#124)
Officially support Plone 6.0 and Python 3.9.
No code changes.
[maurits] (#1)
New features:
Bug fixes:
Fix issue where already uploaded images were lost when file validation error occurs (Broken image saved on form validation error · Issue #46 · plone/plone.formwidget.namedfile · GitHub) [fRiSi] (#46)
Fix NamedFileWidget bug when trying to create value from None. [vangheem] (#35)
Don't check for hard coded image size in test.
[agitator] (#40)
Bug fixes:
New features:
NAMEDFILE_USE_DENYLIST=1.Products.PloneHotfix20210518 <https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots>_.Bug fixes:
issue 100 <https://github.com/plone/plone.namedfile/issues/100>_.New features:
Bug fixes:
Bug fixes:
New features:
Adjust JSONField adapter to include widget name to use in serialization
[sneridagh] (#1089)
Allow block transforms to run in "subblocks", discovered as the blocks field (or alternatively, data.blocks) in a block value. (#1085)
Allow passing use_site_search_settings=1 in the @search endpoint request, to follow Plone's ISearchSchema settings. (#1081)
Bug fixes:
Fix navigation endpoint sort by adding default sort_on='getObjPositionInParent' to the query. @valipod @tiberiuichim (#1107)
Fix startup on Plone 4 without plone.app.contenttypes.
[maurits] (#1166)
Fix error in Plone 4.3 that installed the blocks profile when installing the package, instead of the default profile. Fix #895 <https://github.com/plone/plone.restapi/issues/895> [wesleybl] (#895)
Fixed a deprecation warning when importing UnrestrictedUser from AccessControl (#1129)
Fix @workflow when executing user has no permissions to access review_history in target state.
[deiferni] (#999)
Fix @history when full history is empty.
[deiferni] (#1113)
Fix @querystring-search endpoint with correct sort_order
@mamico (#1108)
Fix @search endpoint with use_site_search_settings flag, for VHM PhysicalRoot scenarios
@tiberiuichim (#1105)
Fixes if old p.schema is used
[sneridagh] (#1103)
Fixes build was using the released version
[sneridagh] (#1090)
@contextnavigation endpoint does not honor nav_title index
[sneridagh] (#1092)
Do not log "No such index" warnings for knonw indexes like metadata_fields @cekk (#987)
Respect "Access inactive portal content" permission in @search endpoint [cekk] (#1066)
Add GSM unsubscribe for test registered adapters in block transformer tests @tiberiuichim (#1083)
Pin some package versions to fix buildout @tiberiuichim (#1086)
Re-release 7.3.6 since it was a brown bag release.
New features:
Bug fixes:
Bug fixes:
Bug fixes:
fix waitress deprecation warning (#77)
Catch OSError in test teardown when removing a temporary directory.
Fixes issue 79 <https://github.com/plone/plone.testing/issues/79>_.
[maurits] (#79)
Fix code and tests when running on Products.GenericSetup >= 2.1.2, thus
requiring at least that version.
Do not break at startup when subscribers.zcml is included but no
portal_catalog object is in the database, e. g. when starting for the
first time.
(#115 <https://github.com/zopefoundation/Products.CMFCore/pull/115>_)
Avoid DeprecationWarning for changed import location for rfc1123_date
Fix several DeprecationWarnings during unit tests
(#112 <https://github.com/zopefoundation/Products.CMFCore/issues/112>_)
Set Cache-Control header in '304 Not Modified' response case as well.
(#111 <https://github.com/zopefoundation/Products.CMFCore/issues/111>_)
Make sure getSkinNameFromRequest only returns sane values
(#109 <https://github.com/zopefoundation/Products.CMFCore/issues/109>_)
Fix Python 3 incompatibility in CookieCrumbler.credentialsChanged
Bug fixes:
vulnerability <https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool>_.New features:
Bug fixes:
Removed the docstring from various methods to avoid making them available via a url.
From the Products.PloneHotfix20210518 reflected XSS fix <https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots>_.
[maurits] (#3274)
Add the remote code execution fix from the Products.PloneHotfix20210518 expressions patch <https://plone.org/security/hotfix/20210518/remote-code-execution-via-traversal-in-expressions>_.
We need this because Zope 4.6.2 is too strict for us.
[maurits] (#3274)
New features:
Bug fixes:
Avoid a deprecation warning when importing gather_permissions
(#20 <https://github.com/zopefoundation/Products.DCWorkflow/issues/20>_)
Avoid a TypeError when adding a managed group to a workflow
(#18 <https://github.com/zopefoundation/Products.DCWorkflow/issues/18>_)
Fix Issue #83 where empty Versions caused an Error [gogobd]
Document and fix behavior of methods that open/read/write filesystem files
(#107 <https://github.com/zopefoundation/Products.GenericSetup/issues/107>_)
Fix snapshot comparisons under Python 3
(#85 <https://github.com/zopefoundation/Products.GenericSetup/issues/85>_)
Bug fixes:
zope.interface 5.3.0.Fix method signature of PluggableAuthService._setObject
(#95 <https://github.com/zopefoundation/Products.PluggableAuthService/issues/95>_)
Fix tests when running on Products.GenericSetup >= 2.1.2, thus requiring
at least that version.
ZMI: use flexbox for twolist macro, fixes removing roles in Safari browser.
(#91 <https://github.com/zopefoundation/Products.PluggableAuthService/issues/91>_)
Fix CSRF token access for tigher TAL path expression security in Zope 5.2.1
(#99 <https://github.com/zopefoundation/Products.PluggableAuthService/issues/99>_)
Changed adding object gui to modal window
Handle login issues for cookie based login when came_from is missing
(#65 <https://github.com/zopefoundation/Products.PluggableAuthService/issues/65>_)
Tighten down security on several login string transformation methods
(#88 <https://github.com/zopefoundation/Products.PluggableAuthService/issues/88>_)
add support for Python 3.9
change package structure to move package code into a src subfolder
Bug fixes:
Split method cleaner_options off from scrub_html in safe_html transform.
This makes it easier to monkey patch or subclass.
[maurits] (#44)
REST transform: ignore warnings and stylesheet keyword arguments.
They can be abused.
From Products.PloneHotfix20210518 <https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-script>_.
[maurits] (#3274)
Add support for Python 3.9
Update configuration for version 5 of isort
Bug fixes:
Bug fixes:
Bug fixes:
zope.component 5.zope.component.interfaces has long been a backwards compatibility import for zope.interface.interfaces, but not anymore.Changes that I still expect (apart from me adding release notes, and copying packages):
AccessControl with a security fix. The fixed version 4.3 is already in our versions.cfg. There should be a post on the forum about the release and the fix once the Zope release is out, which should be soon.Products.isurlinportal release, with a minor security fix. That will probably be early next week.mockup and plone.staticresources releases. There is a small fix in mockup, but I don't see any effect when I try to take over this change in plone.staticresources. I am no expert on those packages though, so I could be wrong. If someone can have a look, that would help.I have added Zope 4.6.3 and Products.isurlinportal 1.2.0.
Thanks! I tested it with 2 projects and everything seemed to work fine.
I tested it with on the test server of the Austrian Architectural Forum and all looks good so far!
Testing easyform to email stop working
Thanks for the release!
The PloneIntranet test suite runs fine with Plone 5.2.5.
I am using 5.2.5 while developing and so far I did not notice anything strange!
I can confirm!
You can see the problem by going to the form actions. The standard Mailer object is not selected, so it is not active:
And when I select it and click Save, it has no effect...
Might be fixable in collective.easyform.
But the root cause is that zope.schema was upgraded from 6.0.0 to 6.1.0.
This version changed set the default of IField.required to False. See issue 104 and PR 105, which include earlier reports of problems, which mostly have been fixed.
With this latest report about this causing problems in easyform, it seems best to keep Plone 5.2 on the older zope.schema 6.0.0. I will make a PR first.
@mactrash Can you try with zope.schema = 6.0.0?
Confirm
Tag zope.schema = 6.0.0
Will work for easyform issue.
Thanks
I have updated the versions and constraints in the 5.2.5-pending directory to use zope.schema 6.0.0.