Merge branch 'master' into ofs_handle_svg_images

.github/workflows/tests.yml

@@ -28,7 +28,7 @@ jobs:
         - ["3.9",   "py39"]
         - ["3.10",  "py310"]
         - ["3.11",  "py311"]
-        - ["3.12.0-alpha.7",  "py312"]
+        - ["3.12.0-rc.1",  "py312"]
         - ["3.9",   "docs"]
         - ["3.9",   "coverage"]
         exclude:
@@ -41,7 +41,7 @@ jobs:
           # macOS/Python 3.11+ is set up for universal2 architecture
           # which causes build and package selection issues.
           - { os: ["macos", "macos-11"], config: ["3.11",  "py311"] }
-          - { os: ["macos", "macos-11"], config: ["3.12.0-alpha.7",  "py312"] }
+          - { os: ["macos", "macos-11"], config: ["3.12.0-rc.1",  "py312"] }
 
     runs-on: ${{ matrix.os[1] }}
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name

.meta.toml

@@ -2,7 +2,7 @@
 # https://github.com/zopefoundation/meta/tree/master/config/zope-product
 [meta]
 template = "zope-product"
-commit-id = "dec712c6"
+commit-id = "28abbfda"
 
 [python]
 with-pypy = false
@@ -46,6 +46,7 @@ testenv-commands = [
 coverage-basepython = "python3.8"
 coverage-command = "coverage run {envdir}/bin/alltests {posargs:-vc}"
 testenv-additional = [
+    "allowlist_externals = *",
     "",
     "[testenv:pre-commit]",
     "basepython = python3",

CHANGES.rst

@@ -7,11 +7,20 @@ since the branch point at Zope 4.1.2.
 The change log for the previous version, Zope 4, is at
 https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
 
-5.8.4 (unreleased)
+
+5.8.5 (unreleased)
+------------------
+
+- Tighten down the ZMI frame source logic to only allow site-local sources.
+
+- Update to newest compatible versions of dependencies.
+
+
+5.8.4 (2023-09-06)
 ------------------
 
 - Disable a ``ZCatalog`` (more precisly: ``Products.PluginIndexes``)
-  performance test which occasionally fails on GITHUB.
+  performance test which occasionally fails on GitHub.
   For details, see
   `#1136 <https://github.com/zopefoundation/Zope/issues/1136>`_.
 
@@ -20,6 +29,8 @@ https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
 
 - Update to newest compatible versions of dependencies.
 
+- Add preliminary support for Python 3.12rc1.
+
 - Make ``mapply`` ``__signature__`` aware.
   This allows to publish methods decorated via a decorator
   which sets ``__signature__`` on the wrapper to specify
@@ -30,7 +41,13 @@ https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
   and var keyword parameters.
 
 - Make Zope's parameters for denial of service protection configurable
-  `#1141 <https://github.com/zopefoundation/Zope/issues/1141>_`.
+  `#1141 <https://github.com/zopefoundation/Zope/issues/1141>`_.
+
+- Update ``RestrictedPython`` to version 6.2 to mitigate a security problem.
+  (CVE-2023-41039)
+
+- Update ``AccessControl`` to version 6.2 to mitigate a security problem.
+  (CVE-2023-41050)
 
 - Added image dimensions to SVG file properties 
   `#1146 <https://github.com/zopefoundation/Zope/pull/1146>`_.

buildout.cfg

@@ -16,7 +16,7 @@ parts =
     requirements
 sources-dir = develop
 auto-checkout =
-    RestrictedPython
+
 
 [testenv]
 PYTHONHASHSEED = random

constraints.txt

@@ -1,78 +1,79 @@
-AccessControl==6.1
+AccessControl==6.2
 Acquisition==5.0
 AuthEncoding==5.0
 BTrees==5.0
-Chameleon==4.0.0
-DateTime==5.1
+Chameleon==4.1.0
+DateTime==5.2
 DocumentTemplate==4.4
 ExtensionClass==5.0
 MultiMapping==5.0
 Paste==3.5.3
 PasteDeploy==2.1.1; python_version == '3.7'
 PasteDeploy==3.0.1; python_version > '3.7'
 Persistence==4.0.post1
-RestrictedPython==6.1
+RestrictedPython==6.2
 WSGIProxy2==0.5.1
 WebOb==1.8.7
 WebTest==3.0.0
 ZConfig==4.0
-ZODB==5.8.0
+ZODB==5.8.1
 Zope2==4.0
 beautifulsoup4==4.12.2
 cffi==1.15.1
 multipart==0.2.4
 persistent==5.0
 pycparser==2.21
 python-gettext==5.0
-pytz==2023.3
+pytz==2023.3.post1
 roman==4.1
 six==1.16.0
-soupsieve==2.4.1
+soupsieve==2.4.1; python_version == '3.7'
+soupsieve==2.5; python_version > '3.7'
 transaction==3.1.0
 waitress==2.1.2
 z3c.pt==4.0
-zExceptions==4.3
+zExceptions==5.0
 zc.lockfile==3.0.post1
 zc.recipe.egg==2.0.7
 zodbpickle==3.0.1
 zope.annotation==5.0
 zope.browser==3.0
 zope.browsermenu==5.0
 zope.browserpage==5.0
-zope.browserresource==5.0
+zope.browserresource==5.1
 zope.cachedescriptors==5.0
 zope.component==6.0
 zope.configuration==5.0
 zope.container==5.1
 zope.contentprovider==5.0
 zope.contenttype==5.0
 zope.datetime==5.0.0
-zope.deferredimport==4.4
+zope.deferredimport==5.0
 zope.deprecation==5.0
 zope.dottedname==6.0
-zope.event==4.6
-zope.exceptions==4.6
+zope.event==5.0
+zope.exceptions==5.0.1
 zope.filerepresentation==6.0
 zope.globalrequest==2.0
 zope.hookable==5.4
-zope.i18n==5.0
+zope.i18n==5.1
 zope.i18nmessageid==6.0.1
 zope.interface==6.0
-zope.lifecycleevent==4.4
+zope.lifecycleevent==5.0
 zope.location==5.0
 zope.pagetemplate==5.0
 zope.processlifetime==3.0
 zope.proxy==5.0.0
 zope.ptresource==5.0
-zope.publisher==6.1.0
+zope.publisher==7.0
 zope.schema==7.0.1
 zope.security==6.1
 zope.sequencesort==5.0
-zope.site==4.6.1
-zope.size==4.4
+zope.site==5.0
+zope.size==5.0
 zope.structuredtext==5.0
 zope.tal==5.0.1
-zope.tales==5.2
+zope.tales==6.0
 zope.testbrowser==6.0
 zope.testing==5.0.1
 zope.traversing==5.0

docs/INSTALL.rst

@@ -61,6 +61,12 @@ that version number with your desired version.
 Built-in standard buildout configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
+.. note::
+
+    The standard buildout configuration is designed to create scripts needed
+    for developing and testing Zope, it is not for production use. Please use
+    a custom buildout configuration, a minimal example is shown below.
+
 .. code-block:: console
 
   $ wget https://pypi.org/packages/source/Z/Zope/Zope-5.0.tar.gz

docs/conf.py

@@ -27,7 +27,7 @@
 # The short X.Y version
 version = '5.8'
 # The full version, including alpha/beta/rc tags
-release = '5.8.3'
+release = '5.8.4'
 
 
 # -- General configuration ---------------------------------------------------

docs/maintenance.rst

@@ -34,7 +34,9 @@ Steps for creating a new Zope release
   ``auto-checkout`` enter them into ``versions-prod.cfg`` and run
   ``bin/buildout`` to update ``requirements-full.txt``.
 
-- Garden the change log and check it for spelling issues.
+- Garden the change log and check it for spelling issues. Look at the changes
+  for this new release and decide on the version number. Features should
+  trigger a feature release.
 
 - Check the future PyPI long description for ReST errors::
 

requirements-full.txt

@@ -1,79 +1,80 @@
 -e git+https://github.com/zopefoundation/Zope.git@master#egg=Zope
-AccessControl==6.1
+AccessControl==6.2
 Acquisition==5.0
 AuthEncoding==5.0
 BTrees==5.0
-Chameleon==4.0.0
-DateTime==5.1
+Chameleon==4.1.0
+DateTime==5.2
 DocumentTemplate==4.4
 ExtensionClass==5.0
 MultiMapping==5.0
 Paste==3.5.3
 PasteDeploy==2.1.1; python_version == '3.7'
 PasteDeploy==3.0.1; python_version > '3.7'
 Persistence==4.0.post1
-RestrictedPython==6.1
+RestrictedPython==6.2
 WSGIProxy2==0.5.1
 WebOb==1.8.7
 WebTest==3.0.0
 ZConfig==4.0
-ZODB==5.8.0
+ZODB==5.8.1
 Zope2==4.0
 beautifulsoup4==4.12.2
 cffi==1.15.1
 multipart==0.2.4
 persistent==5.0
 pycparser==2.21
 python-gettext==5.0
-pytz==2023.3
+pytz==2023.3.post1
 roman==4.1
 six==1.16.0
-soupsieve==2.4.1
+soupsieve==2.4.1; python_version == '3.7'
+soupsieve==2.5; python_version > '3.7'
 transaction==3.1.0
 waitress==2.1.2
 z3c.pt==4.0
-zExceptions==4.3
+zExceptions==5.0
 zc.lockfile==3.0.post1
 zc.recipe.egg==2.0.7
 zodbpickle==3.0.1
 zope.annotation==5.0
 zope.browser==3.0
 zope.browsermenu==5.0
 zope.browserpage==5.0
-zope.browserresource==5.0
+zope.browserresource==5.1
 zope.cachedescriptors==5.0
 zope.component==6.0
 zope.configuration==5.0
 zope.container==5.1
 zope.contentprovider==5.0
 zope.contenttype==5.0
 zope.datetime==5.0.0
-zope.deferredimport==4.4
+zope.deferredimport==5.0
 zope.deprecation==5.0
 zope.dottedname==6.0
-zope.event==4.6
-zope.exceptions==4.6
+zope.event==5.0
+zope.exceptions==5.0.1
 zope.filerepresentation==6.0
 zope.globalrequest==2.0
 zope.hookable==5.4
-zope.i18n==5.0
+zope.i18n==5.1
 zope.i18nmessageid==6.0.1
 zope.interface==6.0
-zope.lifecycleevent==4.4
+zope.lifecycleevent==5.0
 zope.location==5.0
 zope.pagetemplate==5.0
 zope.processlifetime==3.0
 zope.proxy==5.0.0
 zope.ptresource==5.0
-zope.publisher==6.1.0
+zope.publisher==7.0
 zope.schema==7.0.1
 zope.security==6.1
 zope.sequencesort==5.0
-zope.site==4.6.1
-zope.size==4.4
+zope.site==5.0
+zope.size==5.0
 zope.structuredtext==5.0
 zope.tal==5.0.1
-zope.tales==5.2
+zope.tales==6.0
 zope.testbrowser==6.0
 zope.testing==5.0.1
 zope.traversing==5.0

setup.py

@@ -29,7 +29,7 @@ def _read_file(filename):
 README = _read_file('README.rst')
 CHANGES = _read_file('CHANGES.rst')
 
-version = '5.8.4.dev0'
+version = '5.8.5.dev0'
 
 setup(
     name='Zope',

src/App/dtml/manage.dtml

@@ -19,7 +19,7 @@
 		name="manage_menu"
 		marginwidth="2" marginheight="2"
 		/>
-	<frame src="<dtml-var "REQUEST.get('came_from',None)!=None and REQUEST.get('came_from',None) or '%s/manage_workspace'%(REQUEST.URL1)" html_quote>"
+	<frame src="<dtml-var "getZMIMainFrameTarget(REQUEST)" html_quote>"
 		name="manage_main"
 		marginwidth="2" marginheight="2"
 		/>