Plone security hotfix 20200121 release d — Plone: Enterprise Level CMS - Free and OpenSource - Community Driven - Secure
"Announcement of Plone releases and security-related notifications. Recommended subscription for all Plone developers and site admins." <[email protected]> Tue, 21 Jan 2020 09:00:57 -0600
| Newsgroups | gmane.comp.web.zope.plone.announce |
|---|---|
| Message-ID | <[email protected]> |
--===============7095789476159852517==
Content-Type: multipart/alternative;
boundary="Apple-Mail=_FFAD0DC5-BEFD-4033-9621-339D0B29FAE3"
--Apple-Mail=_FFAD0DC5-BEFD-4033-9621-339D0B29FAE3
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
The Plone security hotfix 20200121 has been released. Please visit
>=20
> https://plone.org/security/hotfix/20200121 =
<https://plone.org/security/hotfix/20200121>
for full details.
>=20
> Plone affected versions
>=20
PloneHotfix20200121-1.0.zip ( =
<plonehotfix20200121-1.0.ziphttps://plone.org/security/hotfix/20200121/@@d=
ownload/hotfix>https://plone.org/security/hotfix/20200121/@@download/hotfi=
x) <https://plone.org/security/hotfix/20200121/@@download/hotfix>
> MD5: af80f5de9f218063c3e3151b1e56a538
> SHA1: d162275ab04f736c5044a20eb5ee0133575e253c
> For all platforms (9522 bytes)
>=20
> CVE numbers: not yet issued.
>=20
> Versions Affected: All supported Plone versions (4.3.15 and any =
earlier 4.x version, 5.2.1 and any earlier 5.x version). Previous =
versions could be affected but have not been tested.
>=20
> Versions Not Affected: None.
>=20
> Nature of vulnerability:
>=20
> The patch will address several security issues:
>=20
> Privilege escalation when plone.restapi is installed. Reported and =
fixed by Lukas Graf and Niklaus Johner.
> An open redirection on the login form and possibly other places where =
redirects are done.
> The isURLInPortal check that is done to avoid linking to an external =
site could be tricked into accepting malicious links. Reported by =
Damiano Esposito.
> Password strength checks were not always checked. Reported by Ben =
Kummer.
> You might be able to PUT (overwrite) some content without needing =
write permission.
> This seems hard to do in practice. This fix is only needed when you =
use plone.app.contenttypes. Reported and fixed by Alessandro Pisa.
> SQL quoting in DTML or in connection objects was insufficient, leading =
to possible SQL injections. This is a problem in Zope. If you use Zope =
without Plone, this hotfix should work for you too. Reported and fixed =
by Michael Brunnbauer and Michael Howitz.
> Cross Site Scripting (XSS) in the title field on plone 5.0 and higher. =
Reported by Marcos Valle.
> Version support: The hotfix is officially supported by the Plone =
security team on the following versions of Plone in accordance with the =
Plone=C2=A0version support policy =
<https://plone.org/security/update-policy>: 4.3.19, and 5.0.10, 5.1.6, =
5.2.1. It was also tested on Plone 4.2.7. It is recommended also for =
Plone 4.0 and 4.1, but this has not been tested.
>=20
> The fixes included here will be incorporated into subsequent releases =
of Plone, so Plone 4.3.20, 5.1.7, 5.2.2 and greater should not require =
this hotfix.=20
>=20
> Warning: The hotfix has not been fully tested with Python 2.6. It =
should work though. If you find a problem due to this, we are happy to =
try to release an update. Python 2.6 has not been supported by the =
Python Software Foundation since the end of 2013. Even Python 2.7 is =
already End Of Life since the beginning of 2020. It gets ever more =
difficult to test on Python 2.6. If you are using Plone 4 with Python =
2.6 you need to upgrade soon. Note that currently Plone 5.2 is the only =
Plone version that runs on Python versions supported upstream (3.6 and =
higher).
>=20
> Installation instructions
>=20
> The procedure for installing Hotfix 20200121 differs slightly based on =
which version of Plone or Zope you are running, and whether you =
installed Plone or Zope using buildout.
>=20
> Backup First!
>=20
> It is prudent to backup all your data and installation files before =
installing any Plone add-on, including this hotfix. If you already have =
a solid Plone backup routine in place, then you can skip this step and =
proceed.
>=20
> If you don't already have a backup of your Plone site, the simplest =
way to back up your Plone instance is to simply copy your entire Zope =
instance folder or buildout folder to a secure location.
>=20
> Recommended Install Procedure
>=20
> If you're less experienced with Plone, the easiest way to install =
Hotfix 20200121 on Plone 4.0 - Plone 5.1 (not 5.2) is as follows:
>=20
> 1) Download the hotfix archive using the link above. If you have an =
md5 tool available (Linux or Mac), use it to check that the signature =
matches.
>=20
> 2) Place the downloaded zip file into the "products" directory in your =
Zope instance. On pre-buildout installations, this will be "Products".
>=20
> 3) Unpack the zip file.
>=20
> On Linux or Mac, the command is:
>=20
> $ unzip PloneHotfix20200121-1.0.zip
> On Windows, use your favorite archiving product. (7Zip is a good =
choice).
>=20
> 4) Restart your Zope instance in foreground mode to ensure that the =
hotfix is installed.
>=20
> On Mac or Linux, the command is typically:
>=20
> $ bin/instance fg
> On Windows, the command is typically:
>=20
> > bin\instance.exe fg
> Zope will start in the foreground, and you should see the message =
"INFO PloneHotfix20200121 Hotfix installed." during startup.
>=20
> 5) Stop the foreground instance of Zope by hitting CTRL-C
>=20
> 6) Restart your Zope instance.
>=20
> On Mac or Linux, the command is typically:
>=20
> $ bin/instance start
> On Windows, the command is typically:
>=20
> > bin\instance.exe start
> If you're using ZEO clients, change instance to client1, client2, =
etc., in the above commands.
>=20
> Installing with Buildout
>=20
> If you are an experienced Plone administrator, and you are using a =
buildout-based installation of Plone, you may choose to install Hotfix =
20200121 with buildout. For Plone 5.2 this is the only option, because =
there is no products directory anymore. However, if you choose to do =
this, you must be certain that you will not accidentally overwrite Plone =
components with newer versions. This is particularly likely if you try =
to use buildout with older versions of Plone.
>=20
> If you are not sure what you're doing, please use the "Recommended =
Installation Instructions" above if possible.
>=20
> Unless you have a very recent buildout, you may get this error when =
running buildout, caused by changes to the Python Packaging Index:
>=20
> Error: Couldn't find a distribution for =
'Products.PloneHotfix20200121=3D=3D1.0'.
> The most likely cause is that your buildout is trying to download the =
hotfix via http. You should use the https PyPI index. In the buildout =
section of your buildout, make sure you use the correct index:
>=20
> [buildout]
> index =3D https://pypi.org/simple/
> A combination of setuptools 33.1.1 and zc.buildout 2.9.6 works =
correctly, if you want to be conservative.
>=20
> 1) Find your buildout.cfg file, typically located in the "zinstance" =
subdirectory of your Plone installation directory. (If you're using ZEO =
clients, the subdirectory may be called "zeoserver").
>=20
> 2) Open your buildout.cfg file in your text editor.=20
>=20
> 3) Scroll down to the "eggs" section of the buildout and add =
Products.PloneHotfix20200121, e.g.
>=20
> [buildout]
> ...
> eggs =3D=20
> Products.PloneHotfix20200121
>=20
> [versions]
> Products.PloneHotfix20200121 =3D 1.0
> 4) Rerun buildout.
>=20
> On Mac or Linux, the command is:
>=20
> $ ./bin/buildout -Nv
> On windows, the command is:
>=20
> > bin\buildout.exe -Nv
> 5) Restart your Zope instance.
>=20
> On Mac or Linux, the command is:
>=20
> $ ./bin/instance start
> On Windows, the command is:
>=20
> > bin\instance.exe start
> Alternatively, on Windows, you may restart the Zope service via the =
Windows Services control panel.
>=20
> If you're using ZEO clients, change instance to client1, client2, =
etc., in the above commands.
>=20
> Confirming Installation
>=20
> On startup, the hotfix will log a number of messages to the Zope event =
log. You can use this to confirm the patch is successfully installed. =
They look like this:
>=20
> 2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied =
sql_quote patch
> 2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied =
in_portal patch
> 2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied =
password_validation patch
> 2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied pac =
patch
> 2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied content =
patch
> 2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied layout =
patch
> 2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied =
restapi_local_roles patch
> 2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Hotfix installed
> Not all patches are needed in all Plone versions, and may depend on =
which extra packages you have installed. For example the 'pac' patch is =
only applied when you use plone.app.contenttypes. Patches that are not =
relevant for you, do not appear in the log.
>=20
> If the hotfix tries to apply a patch and there is an error, then you =
may have a setup that we did not consider. Please investigate then. You =
will get an error like this, followed by a traceback:
>=20
> 2020-01-21 13:10:26 ERROR Products.PloneHotfix20200121 Could not apply =
content
--Apple-Mail=_FFAD0DC5-BEFD-4033-9621-339D0B29FAE3
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=us-ascii
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dus-ascii"><base></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><base=
class=3D""><div class=3D"Apple-Mail-URLShareUserContentTopClass">The =
Plone security hotfix 20200121 has been released. Please visit</div><div =
class=3D"Apple-Mail-URLShareWrapperClass"><blockquote type=3D"cite" =
style=3D"border-left-style: none; color: inherit; padding: inherit; =
margin: inherit;" class=3D""><div class=3D""><div =
class=3D"original-url"><br class=3D""><a =
href=3D"https://plone.org/security/hotfix/20200121" =
class=3D"">https://plone.org/security/hotfix/20200121</a><br =
class=3D""></div></div></blockquote><div =
class=3D"Apple-Mail-URLShareWrapperClass"><br class=3D""></div>for full =
details.<br class=3D""><blockquote type=3D"cite" =
style=3D"border-left-style: none; color: inherit; padding: inherit; =
margin: inherit;" class=3D""><div class=3D""><div =
class=3D"original-url"><br class=3D""></div><div id=3D"article" =
role=3D"article" style=3D"text-rendering: optimizeLegibility; =
font-family: -apple-system-font; font-size: 1.2em; line-height: 1.5em; =
margin: 0px; padding: 0px;" class=3D"system exported">
<!-- This node will contain a number of div.page. -->
<div class=3D"page" style=3D"word-wrap: break-word; max-width: =
100%;"><h1 class=3D"title" style=3D"font-size: 1.95552em; line-height: =
1.2141em; margin-top: 0px; margin-bottom: 0.5em; max-width: 100%;">Plone =
affected versions</h1><p style=3D"max-width: 100%;" class=3D"">
</p></div></div></div></blockquote><a =
href=3D"PloneHotfix20200121-1.0.ziphttps://plone.org/security/hotfix/20200=
121/@@download/hotfix" class=3D"">PloneHotfix20200121-1.0.zip (</a><a =
href=3D"https://plone.org/security/hotfix/20200121/@@download/hotfix" =
class=3D"">https://plone.org/security/hotfix/20200121/@@download/hotfix)</=
a><br class=3D""><blockquote type=3D"cite" style=3D"border-left-style: =
none; color: inherit; padding: inherit; margin: inherit;" class=3D""><div =
class=3D""><div id=3D"article" role=3D"article" style=3D"text-rendering: =
optimizeLegibility; font-family: -apple-system-font; font-size: 1.2em; =
line-height: 1.5em; margin: 0px; padding: 0px;" class=3D"system =
exported"><div class=3D"page" style=3D"word-wrap: break-word; max-width: =
100%;"><p style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: =
100%;" class=3D"">MD5: </span> af80f5de9f218063c3e3151b1e56a538<br =
style=3D"max-width: 100%;" class=3D"">
<span style=3D"max-width: 100%;" class=3D"">SHA1: </span> =
d162275ab04f736c5044a20eb5ee0133575e253c<br style=3D"max-width: 100%;" =
class=3D"">
<span style=3D"max-width: 100%;" class=3D"">For</span>
all platforms
=20
(9522 bytes)
=20
=20
</p><p style=3D"max-width: 100%;" class=3D"">CVE =
numbers: not yet issued.</p><p style=3D"max-width: 100%;" =
class=3D""><strong style=3D"max-width: 100%;" class=3D"">Versions =
Affected:</strong> All supported Plone versions (4.3.15 and any earlier =
4.x version, 5.2.1 and any earlier 5.x version). Previous versions could =
be affected but have not been tested.</p><p style=3D"max-width: 100%;" =
class=3D""><strong style=3D"max-width: 100%;" class=3D"">Versions Not =
Affected:</strong> None.</p><p style=3D"max-width: 100%;" =
class=3D""><strong style=3D"max-width: 100%;" class=3D"">Nature of =
vulnerability:</strong></p><p style=3D"max-width: 100%;" class=3D"">The =
patch will address several security issues:</p>
<ul style=3D"max-width: 100%;" class=3D"">
<li style=3D"max-width: 100%;" class=3D"">Privilege escalation when =
<code style=3D"max-width: 100%;" class=3D"">plone.restapi</code> is =
installed. Reported and fixed by Lukas Graf and Niklaus =
Johner.</li>
<li style=3D"max-width: 100%;" class=3D"">An open redirection on the =
login form and possibly other places where redirects are done.<br =
style=3D"max-width: 100%;" class=3D"">The <code style=3D"max-width: =
100%;" class=3D"">isURLInPortal</code> check that is done to avoid =
linking to an external site could be tricked into accepting malicious =
links. Reported by Damiano Esposito.</li>
<li style=3D"max-width: 100%;" class=3D"">Password strength checks were =
not always checked. Reported by Ben Kummer.</li>
<li style=3D"max-width: 100%;" class=3D"">You might be able to PUT =
(overwrite) some content without needing write permission.<br =
style=3D"max-width: 100%;" class=3D"">This seems hard to do in practice. =
This fix is only needed when you use<code style=3D"max-width: 100%;" =
class=3D""> plone.app.contenttypes</code>. Reported and fixed =
by Alessandro Pisa.</li>
<li style=3D"max-width: 100%;" class=3D"">SQL quoting in DTML or in =
connection objects was insufficient, leading to possible SQL injections. =
This is a problem in Zope. If you use Zope without Plone, this hotfix =
should work for you too. Reported and fixed by Michael Brunnbauer =
and Michael Howitz.</li>
<li style=3D"max-width: 100%;" class=3D"">Cross Site Scripting (XSS) in =
the title field on plone 5.0 and higher. Reported by Marcos =
Valle.</li>
</ul><p style=3D"max-width: 100%;" class=3D""><strong style=3D"max-width: =
100%;" class=3D"">Version support: </strong>The hotfix is =
officially supported by the Plone security team on the following =
versions of Plone in accordance with the <a =
href=3D"https://plone.org/security/update-policy" style=3D"color: =
rgb(65, 110, 210); max-width: 100%;" class=3D"">Plone version =
support policy</a>: 4.3.19, and 5.0.10, 5.1.6, 5.2.1. It was also tested =
on Plone 4.2.7. It is recommended also for Plone 4.0 and 4.1, but this =
has not been tested.</p><p style=3D"max-width: 100%;" class=3D"">The =
fixes included here will be incorporated into subsequent releases of =
Plone, so Plone 4.3.20, 5.1.7, 5.2.2 and greater should not require =
this hotfix. </p><p class=3D"clear" style=3D"max-width: 100%; =
clear: both;"><strong style=3D"max-width: 100%;" =
class=3D"">Warning</strong>: The hotfix has <strong style=3D"max-width: =
100%;" class=3D"">not</strong> been fully tested with Python 2.6. =
It <em style=3D"max-width: 100%;" class=3D"">should</em> work though. If =
you find a problem due to this, we are happy to try to release an =
update. Python 2.6 has not been supported by the Python Software =
Foundation since the end of 2013. Even Python 2.7 is already End Of Life =
since the beginning of 2020. It gets ever more difficult to test on =
Python 2.6. <strong style=3D"max-width: 100%;" class=3D"">If you are =
using Plone 4 with Python 2.6 you need to upgrade =
soon.</strong> Note that currently Plone 5.2 is the only Plone =
version that runs on Python versions supported upstream (3.6 and =
higher).</p>
<h2 style=3D"font-size: 1.43em; max-width: 100%;" class=3D"">Installation =
instructions</h2><p style=3D"max-width: 100%;" class=3D"">The procedure =
for installing Hotfix 20200121 differs slightly based on which version =
of Plone or Zope you are running, and whether you installed Plone or =
Zope using buildout.</p>
<h3 style=3D"font-size: 1.25em; max-width: 100%;" class=3D"">Backup =
First!</h3><p style=3D"max-width: 100%;" class=3D"">It is prudent to =
backup all your data and installation files before installing any Plone =
add-on, including this hotfix. If you already have a solid Plone =
backup routine in place, then you can skip this step and proceed.</p><p =
style=3D"max-width: 100%;" class=3D"">If you don't already have a backup =
of your Plone site, the simplest way to back up your Plone instance is =
to simply copy your entire Zope instance folder or buildout folder to a =
secure location.</p>
<h3 style=3D"font-size: 1.25em; max-width: 100%;" class=3D"">Recommended =
Install Procedure</h3><p style=3D"max-width: 100%;" class=3D"">If you're =
less experienced with Plone, the easiest way to install Hotfix 20200121 =
on Plone 4.0 - Plone 5.1 (<strong style=3D"max-width: 100%;" =
class=3D"">not</strong> 5.2) is as follows:</p><p style=3D"max-width:=
100%;" class=3D"">1) Download the hotfix archive using the link above. =
If you have an md5 tool available (Linux or Mac), use it to check =
that the signature matches.</p><p style=3D"max-width: 100%;" class=3D"">2)=
Place the downloaded zip file into the "products" directory in your =
Zope instance. On pre-buildout installations, this will be =
"Products".</p><p style=3D"max-width: 100%;" class=3D"">3) Unpack the =
zip file.</p><p style=3D"max-width: 100%;" class=3D"">On Linux or Mac, =
the command is:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D""> $ unzip PloneHotfix20200121-1.0.zip</pre></div><p =
style=3D"max-width: 100%;" class=3D"">On Windows, use your favorite =
archiving product. (7Zip is a good choice).</p><p style=3D"max-width: =
100%;" class=3D"">4) Restart your Zope instance in foreground mode =
to ensure that the hotfix is installed.</p><p style=3D"max-width: 100%;" =
class=3D"">On Mac or Linux, the command is typically:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D""> $ bin/instance fg</pre></div><p =
style=3D"max-width: 100%;" class=3D"">On Windows, the command is =
typically:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">> bin\instance.exe fg</pre></div><p =
style=3D"max-width: 100%;" class=3D"">Zope will start in the foreground, =
and you should see the message "<kbd style=3D"max-width: 100%;" =
class=3D"">INFO PloneHotfix20200121 Hotfix installed.</kbd>" during =
startup.</p><p style=3D"max-width: 100%;" class=3D"">5) Stop the =
foreground instance of Zope by hitting CTRL-C</p><p style=3D"max-width: =
100%;" class=3D"">6) Restart your Zope instance.</p><p style=3D"max-width:=
100%;" class=3D"">On Mac or Linux, the command is typically:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">$ bin/instance start</pre></div><p style=3D"max-width:=
100%;" class=3D"">On Windows, the command is typically:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">> bin\instance.exe start</pre></div><p =
style=3D"max-width: 100%;" class=3D"">If you're using ZEO clients, =
change <code style=3D"max-width: 100%;" class=3D"">instance</code> to =
<code style=3D"max-width: 100%;" class=3D"">client1</code>, <code =
style=3D"max-width: 100%;" class=3D"">client2</code>, etc., in the above =
commands.</p>
<h3 style=3D"font-size: 1.25em; max-width: 100%;" class=3D"">Installing =
with Buildout</h3><p style=3D"max-width: 100%;" class=3D"">If you are an =
experienced Plone administrator, and you are using a buildout-based =
installation of Plone, you may choose to install Hotfix 20200121 with =
buildout. For Plone 5.2 this is the only option, because there is no =
products directory anymore. However, if you choose to do this, you must =
be certain that you will not accidentally overwrite Plone components =
with newer versions. This is particularly likely if you try to use =
buildout with older versions of Plone.</p><p class=3D"clear" =
style=3D"max-width: 100%; clear: both;"><strong style=3D"max-width: =
100%;" class=3D"">If you are not sure what you're doing, please use the =
"Recommended Installation Instructions" above if =
possible.</strong></p><p style=3D"max-width: 100%;" class=3D"">Unless =
you have a very recent buildout, you may get this error when running =
buildout, caused by changes to the Python Packaging Index:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">Error: Couldn't find a distribution for =
'Products.PloneHotfix20200121=3D=3D1.0'.</pre></div><p style=3D"max-width:=
100%;" class=3D"">The most likely cause is that your buildout is trying =
to download the hotfix via http. You should use the https PyPI index. In =
the buildout section of your buildout, make sure you use the correct =
index:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">[buildout]
index =3D <a href=3D"https://pypi.org/simple/" =
class=3D"">https://pypi.org/simple/</a></pre></div><p style=3D"max-width: =
100%;" class=3D"">A combination of setuptools 33.1.1 and =
zc.buildout 2.9.6 works correctly, if you want to be conservative.</p><p =
style=3D"max-width: 100%;" class=3D"">1) Find your buildout.cfg file, =
typically located in the "zinstance" subdirectory of your Plone =
installation directory. (If you're using ZEO clients, the subdirectory =
may be called "zeoserver").</p><p style=3D"max-width: 100%;" class=3D"">2)=
Open your buildout.cfg file in your text editor. </p><p =
style=3D"max-width: 100%;" class=3D"">3) Scroll down to the "eggs" =
section of the buildout and add <code style=3D"max-width: 100%;" =
class=3D"">Products.PloneHotfix20200121</code>, e.g.</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">[buildout]
...
eggs =3D=20
Products.PloneHotfix20200121
[versions]
Products.PloneHotfix20200121 =3D 1.0</pre></div><p style=3D"max-width: =
100%;" class=3D"">4) Rerun buildout.</p><p style=3D"max-width: 100%;" =
class=3D"">On Mac or Linux, the command is:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">$ ./bin/buildout -Nv</pre></div><p style=3D"max-width:=
100%;" class=3D"">On windows, the command is:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">> bin\buildout.exe -Nv</pre></div><p =
style=3D"max-width: 100%;" class=3D"">5) Restart your Zope =
instance.</p><p style=3D"max-width: 100%;" class=3D"">On Mac or Linux, =
the command is:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">$ ./bin/instance start</pre></div><p =
style=3D"max-width: 100%;" class=3D"">On Windows, the command is:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">> bin\instance.exe start</pre></div><p =
style=3D"max-width: 100%;" class=3D"">Alternatively, on Windows, you may =
restart the Zope service via the Windows Services control panel.</p><p =
style=3D"max-width: 100%;" class=3D"">If you're using ZEO clients, =
change <code style=3D"max-width: 100%;" class=3D"">instance</code> to =
<code style=3D"max-width: 100%;" class=3D"">client1</code>, <code =
style=3D"max-width: 100%;" class=3D"">client2</code>, etc., in the above =
commands.</p>
<h2 style=3D"font-size: 1.43em; max-width: 100%;" class=3D"">Confirming =
Installation</h2><p style=3D"max-width: 100%;" class=3D"">On startup, =
the hotfix will log a number of messages to the Zope event log. You can =
use this to confirm the patch is successfully installed. They look =
like this:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">2020-01-21 13:10:26 INFO =
Products.PloneHotfix20200121 Applied sql_quote patch
2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied in_portal =
patch
2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied =
password_validation patch
2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied pac patch
2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied content =
patch
2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied layout =
patch
2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Applied =
restapi_local_roles patch
2020-01-21 13:10:26 INFO Products.PloneHotfix20200121 Hotfix =
installed</pre></div><p style=3D"max-width: 100%;" class=3D"">Not all =
patches are needed in all Plone versions, and may depend on which extra =
packages you have installed. For example the 'pac' patch is only applied =
when you use plone.app.contenttypes. Patches that are not relevant for =
you, do not appear in the log.</p><p style=3D"max-width: 100%;" =
class=3D"">If the hotfix tries to apply a patch and there is an error, =
then you may have a setup that we did not consider. Please investigate =
then. You will get an error like this, followed by a traceback:</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">2020-01-21 13:10:26 ERROR =
Products.PloneHotfix20200121 Could not apply =
content</pre></div></div></div></div></blockquote></div></body></html>=
--Apple-Mail=_FFAD0DC5-BEFD-4033-9621-339D0B29FAE3--
--===============7095789476159852517==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============7095789476159852517==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Want community news? Subscribe to our newsletter http://eepurl.com/S4wfL
Plone-Announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/plone-announce
--===============7095789476159852517==--