Products.cmfcore

Latest version: v3.6

Safety actively analyzes 701948 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 6 of 9

2.4.0b2

Not secure
--------------------

- Factored support for FSZSQL methods out into a setup extra.
If you need support for Filesystem ZSQL methods, install the
egg specifying the ``zsql`` extra.
[dataflake]

- Use ``zope.interface.implementer`` decorator instead of
``zope.interface.implements``
[dataflake]

- Use security declaration decorator notation where possible.
[dataflake]

- Improve the new indexing object wrapping for unindexing by using a
module-level wrapper class based on zope.proxy instead of a class
at method level.
Some discussion available at GitHub PR 15.
[dataflake]

- Queue and process indexing operations (index, reindex, unindex) at
transaction boundaries. This allows to reduce redundant operations
and thus improving performance.
Operations are processed just at transaction boundaries or whenever
a catalog search is performed.
Part of PLIP 1343: https://github.com/plone/Products.CMFPlone/issues/1343
[gforcada]

- Provide a ``CATALOG_OPTIMIZATION_DISABLED`` environment variable to
disable any catalog optimization. This is mostly meant to be used so that
tests which may need some adaptation do not break after updating to
this version. Set it to ``true``, i.e.
``export CATALOG_OPTIMIZATION_DISABLED=true`` before running tests.
Part of PLIP 1343: https://github.com/plone/Products.CMFPlone/issues/1343
[gforcada]

2.4.0b1

Not secure
--------------------

- Target use with Zope 4: no longer support 2.13.x.

- Make sure RegistrationTool.addMember is not published
[vangheem]

- Don't fail on catalog inconsistency when doing `reindexObjectSecurity`
[tomgross]

2.3.0

Not secure
------------------

- Fall back to DAV aware marshaller when importing or exporting folderish
content, so types now retain their metadata when being round-tripped.
[MatthewWilkes]

- IndexableObjectWrapper: Made sure portal_type doesn't return None.
Products.ZCatalog 3 indexes can no longer handle None values.

- interfaces: Fixed dotted names by setting __module__ explicitly.

- Skinnable: The skins tool is now looked up as utility.
'getSkinsFolderName' is no longer supported, that method was removed.

- permissions: Fixed some issues in permissions.zcml.

- support unset portal_skins request variables in HTTP headers
(see https://dev.plone.org/ticket/10071) [fRiSi]

2.3.0beta2

------------------------

- added fixes for migrating CMF 2.2 sites.

2.3.0beta

------------------------

- DynamicType: Modified 'icon' method.
The specified icon might be registered for a ZTK layer that is not available
in the ZMI. If the icon can't be found, an empty string is returned.

- exportimport.tests.test_mailhost: Accomodate 'smtp_queue' and
'smtp_queue_directory' exports (newly added in GenericSetup).

- tools: Converted all tools into local utilities.
The registration is not done here, see CMFDefault_ as an example of a
registration via GenericSetup.

- MemberDataTool: Changed property modes to 'w' and added 'fullname' property.

- setup handlers: Improved content type registry handler.
The 'insert-before' and 'insert-after' directives are now supported.

- Optimize `SkinnableObjectManager.__getattr__` to short circuit view (``) and
traverser (`+`) lookup in addition to `_` and `aq_`.

- Avoid a shallow dependency on `Products.ZReST`.

- Fixed types tool test to only test creation for type infos.

- utils: Fixed '_OldCacheHeaders' and '_FSCacheHeaders' methods.
DateTimeErrors caused by invalid HTTP headers were not caught.

- setup handlers: Added export/import support for member data tool settings.

- MemberDataTool: Fixed tool initialization.
The default boolean and date property values were not set correctly.

- MemberDataTool: Modified 'setProperties' method.
It now can be used by user managers as well.

- MembershipTool: Added 'isMemberAccessAllowed' method.
If you don't have the 'Manage users' permission for the membership tool, you
shouldn't have write access to other members.

- MemberDataTool: Removed obsolete MemberData factory lookup.
This feature was added in CMF 2.2, but now the MemberAdapter should be
overridden instead.

- MemberDataTool: Split up MemberData class.
The old MemberData API is now provided by the new MemberAdapter. The
persistent MemberData objects are just used for storing member data.

- interfaces: Added 'IMember' interface.

- permissions: Marked 'setDefaultRoles' as deprecated.

- DirectoryView: Added 'bobobase_modification_time' method to FSObject.
The "Contents" tab in the ZMI now shows useful 'Last Modified' values.

- DirectoryView: Changed debug mode behavior.
No additional subdirs are registered in debug mode. If you add new subdirs,
you have to restart your instance.
(https://bugs.launchpad.net/zope-cmf/+bug/271027)

- DirectoryView: Improved debug mode speed on NTFS partitions.
The much faster non-Windows implementation is now used on Windows as well if
non-FAT32 time stamps are detected. In rare cases that heuristic approach
might fail to detected NTFS partitions.

- DirectoryView: Modernized debug mode lookup.
Now getConfiguration().debug_mode is used instead of Globals.DevelopmentMode.

- Fix content exportimport when Title or Description are unicode (merge from
2.2 branch).

- tests base: Tightened security for anonymous test user.

- Load permissions.zcml from Products.Five in the test to fix tests
with Zope 2.12.

- notifyWorkflowCreated only to IWorkflowAware, possibly following adaption on
IObjectAddedEvent.

- Adapterize workflow storage lookups.

- utils: Added FakeExecutableObject.
It can be used to set proxy roles in trusted code.

- tests base: Removed obsolete test utils.

- testing: Removed broken run function.
Unit test modules are no longer directly executable.

- CookieCrumbler: Removed redirect support.
The Unauthorized handling and redirects are now part of CMFDefault.

- Added a permissions.zcml file defining our own permissions. This was
formerly done in Zope 2's Products.Five.

- Removed zope.app.testing dependency.

- Import BeforeTraverseEvent from new location if available.

- Skinnable and MembershipTool: Removed support for missing REQUEST argument.
'changeSkin', 'setupCurrentSkin' and 'credentialsChanged' will no longer
try to acquire the request if it is not passed in explicitly.

- Tools and PortalFolder: Removed support for deprecated marker attributes.
'_isDirectoryView', '_isPortalRoot', '_isTypeInformation' and '_isAWorkflow'
are no longer supported.

- utils: Removed deprecated functions.
'getToolByInterfaceName', 'initializeBasesPhase1', 'initializeBasesPhase2',
'expandpath' and 'minimalpath' are no longer available.

- DirectoryView: Removed support for deprecated old API.

- Require at least Zope 2.13.12.

.. _CMFDefault : https://github.com/zopefoundation/Products.CMFDefault/blob/master/Products/CMFDefault/profiles/default/componentregistry.xml

2.2.5

Not secure
------------------

- Added two missing explicit InitializeClass calls.

Page 6 of 9

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.