Plone hotfix, 2026-11-10
========================

It is a chain of several issues, which are fixed separately:

- Products.CMFEditions: missing security declarations on the conditional
  modifiers in ``portal_modifier``.  Anonymous users could change their TALES
  condition, which is evaluated when content is versioned.
  See GHSA-67qm-q795-jh7h.
- Products.CMFPlone: ``allow_module`` was used on whole modules
  (``Products.CMFPlone.utils``, ``Products.CMFPlone.browser.navtree``,
  ``OFS.ObjectManager``), which made everything those modules import available
  to restricted code, for example ``os``.
  ``allow_class`` could be called from restricted code.
  See GHSA-92qw-564p-pmg6.
- Products.MimetypesRegistry: ``allow_module`` on the ``common`` module also
  made ``allow_class`` available to restricted code.
  See GHSA-xcj2-cmp9-fj62.
- plone.batching: ``allow_module`` made ``allow_class`` and ``allow_module``
  available to restricted code.
  See GHSA-6hcx-c235-cxh3.
- plone.restapi: ``allow_module("json")`` made ``json.dump`` and ``json.load``
  available to restricted code.  These call the protected ``write`` and
  ``read`` methods of any object without security checks.
  See GHSA-vgxm-pwch-89q6.

Each fix is only applied when the package is installed.
When a package is not installed, the hotfix skips that fix and logs it.


Compatibility
=============

This hotfix should be applied to the following versions of Plone:

* Plone 6.2, 6.1 and 6.0, on Python 3
* Plone 5.2, on Python 2.7 and Python 3
* Plone 5.1, 5.0 and 4.3, on Python 2.7

The fixes will be included in the next releases of the affected packages.
When you use fixed versions of all these packages, you do not need this hotfix,
but it does no harm either.


Plone 5.2 and older
-------------------

Note that Plone 5.2 and older have been out of security support since several years.
In this case we made an exception.
If you still use such an unsupported Plone version, your site may have vulnerabilities that have been published the past few years.
You should upgrade to Plone 6 soon.
See the `Plone release schedule <https://plone.org/download/release-schedule>`_.


Python 3.10 and older
---------------------

Python version 3.10 and older are out of security support from Python itself.
You should upgrade to Python 3.11 or higher soon.
See `python.org <https://www.python.org/downloads/>`_.


Installation
============

Choose one of these ways, then restart all Zope instances.

* Buildout: add ``Products.PloneHotfix20261110`` to the ``eggs`` of your
  instance and run buildout.

* pip: ``pip install Products.PloneHotfix20261110``.

* Manual, for old Plone versions 5.1 or earlier: copy the
  ``Products/PloneHotfix20261110`` folder from the source distribution
  into the ``products`` directory of your instance,
  for example the directory that the ``products`` option of
  ``plone.recipe.zope2instance`` points to.
  No buildout run is needed.


Plone 6.2
---------

If you use Plone 6.2, especially if you install it using ``zc.buildout``, you may get an error like this on startup::

    ModuleNotFoundError: No module named 'Products.PageTemplates'

It can be a different module within the ``Products`` namespace.
You can fix this by installing a helper package::

    bin/pip install horse-with-no-namespace

See the `Plone 6.2 upgrade guide <https://6.docs.plone.org/backend/upgrading/version-specific-migration/upgrade-to-62.html#move-to-native-namespaces>`_.


What the hotfix changes
=======================

Module security
  The modules that were opened with ``allow_module`` are closed again.
  Only explicit names stay available to restricted code (Python Scripts,
  page templates, TALES expressions).
  ``Products.CMFPlone`` calls ``allow_module`` in its own ``initialize``
  function, which Zope calls after the hotfix is imported, and since Plone 6.0
  a second time at the end of the product initialization.
  So the hotfix closes the modules again in its own ``initialize`` function and
  at the end of startup, before Zope serves any request.

  For compatibility with the skin scripts and templates of Plone 4.3 to 6.0
  these names also stay available:
  ``PloneMessageFactory``, ``PloneLocalesMessageFactory`` and ``Batch``
  from ``Products.CMFPlone``, ``getNavigationRoot`` from
  ``Products.CMFPlone.browser.navtree`` and ``isLinked`` from
  ``Products.CMFPlone.utils``.

  If your own Python Scripts import other names from these modules, they now
  get an ``Unauthorized`` error.  Declare the names you need in your own
  add-on with ``ModuleSecurityInfo(module).declarePublic(name)``.
  Never use ``allow_module`` for this.

AccessControl
  ``allow_module``, ``allow_class``, ``allow_type``, ``ClassSecurityInfo``,
  ``ModuleSecurityInfo`` and ``setSecurityPolicy`` can never be called from
  restricted code.  The same is true for the ``os``, ``sys``, ``subprocess``
  and ``shutil`` modules.

CMFEditions modifiers
  ``edit`` of the conditional modifiers requires the ``Manage portal``
  permission, the other methods require ``View management screens``, and the
  internal hooks of the size guard modifiers are private.


Q&A
===

Q: How can I confirm that the hotfix is installed correctly and my site is protected?
  A: On startup, the hotfix logs messages like these to the Zope event log::

    INFO [Products.PloneHotfix20261110] Applied accesscontrol patch (GHSA-92qw-564p-pmg6).
    INFO [Products.PloneHotfix20261110] Applied cmfplone patch (GHSA-92qw-564p-pmg6).
    INFO [Products.PloneHotfix20261110] Closed module Products.MimetypesRegistry (was opened with allow_module).
    INFO [Products.PloneHotfix20261110] Applied mimetypesregistry patch (GHSA-xcj2-cmp9-fj62).
    INFO [Products.PloneHotfix20261110] plone.restapi is not installed: restapi patch not needed.
    ...
    INFO [Products.PloneHotfix20261110] Hotfix installed.
    INFO [Products.PloneHotfix20261110] Closed module Products.CMFPlone.utils (was opened with allow_module).
    ...
    INFO [Products.PloneHotfix20261110] No changed modifier conditions found.

  The exact messages depend on the packages you use.
  If a patch fails, the hotfix logs an error that says "Could not apply".
  This may mean that you have a non-standard installation.
  Please investigate.

Q: What does the warning "POSSIBLE ATTACK: MODIFIED VERSIONING CONDITIONS FOUND" mean?
  A: At the end of startup the hotfix checks the TALES conditions of the
  modifiers in ``portal_modifier`` of every Plone site.
  The hotfix stops new attacks, but a condition that an attacker has already
  changed stays in the database.
  If any condition differs from the default, the hotfix logs one warning
  instead of "No changed modifier conditions found."
  You should investigate whether this difference is intentional or not.
