If it is the case *and* the action script does not redirect, the password will be
in user's browser history.
There can be two different reasons to not redirect:
- not following the API (ie, intentionally not redirecting)
- letting an exception reach ZPublisher
Also, if the non-redirection causes an HTML page to be rendered, resources
loaded by that page will have a referrer containing the password, leaking it
to potentially foreign servers.

Before fixing this bug, 'listbox_previousPage:method' input button was
submitted but with no value (''). However, this was not handled by the
backward-compatibility code and thus next/previous page buttons would
not work properly if erp5_xhtml_style is not updated.

ListBox: Navigation methods should not be created when rendering ListBox (#20161014-741678).

These methods were generated when rendering the ListBox and with the id
of the ListBox in their name. However, a customer reported the following
problem on Accounting Periods ListBox:

  1. Display Accounting Period ListBox on ZEO-1.
       => The ListBox will be rendered and 'listbox_period_list_*' methods will be generated on ZEO-1.
  2.  Click on 'Next Page' button and the user is redirect to ZEO-2 where the ListBox has never been generated.
       => The method does not exist yet and thus a 404 error is raised.

Instead of having one method per ListBox ID, only one is now created (eg
listbox_setPage() for SelectionTool.setPage()) at Zope startup and the
ListBox ID previously defined in the method name is now defined in the
value attributes of the buttons.

Portal Type as Classes: Fix memory leak: Workflow method list was never emptied and thus reset Workflow Methods were never GC.

ERP5Site.log and Base.log are wrappers to the 'log' function from
Product.ERP5Type.Log, but parameters were forwarded in a wrong way
when called with a single argument:

  self.log(message) # Base method

This was equivalent to:

  log(message, '')  # function from Product.ERP5Type.Log

And the whole message was later part of subsystem in:

  logger = logging.getLogger(subsystem)

But because loggers are never freed, it is important that 'subsystem' does not
vary too often, to avoid a memory leak.

The fix is to simply forwarding parameters with catchall arguments, instead of
duplicating the signature from Product.ERP5Type.Log.

Of course, it remains important to call these methods correctly, otherwise
memory leaks can happen again. For this reason, catchall arguments also
prevents ERP5Site.log and Base.log to be called by ZPublisher.
Reported-by: Kirill Smelkov <kirr@nexedi.com>
Reviewed-by: Kirill Smelkov <kirr@nexedi.com>

Make sure that catalog knows portal_type column and reference column. If catalog does not know those columns, then it will fetch all cataloged objects and will cause memory bloat. This can happen when MariaDB server disk is full.

Also, factorise related key string generation.

As MKCOL_handler() is not implemented on OFS.Folder.Folder class, the one from
ERP5Site was acquired when calling webdav.NullResource.NullResource.MKCOL().

Only Constraints to be kept could be specified by reference, but sometimes
it is convenient to apply all Constraints but one.

Fix mass workflow transition function. If transition is customized and its actbox_url does not use ERP5 Form, then use the default workfl
ow action dialog form instead.

we can and should use 'update_catalog' argument instead to clear catalog.

From Chromium 31, pressing enter key to select ListBox page submit the form
through JS (submitFormOnEnter) *and* wrongly on the default button, at the end
following HTML5 behavior (4.10.22.2 Implicit submission).

Conflicts:
	product/ERP5/bootstrap/erp5_xhtml_style/bt/change_log
	product/ERP5/bootstrap/erp5_xhtml_style/bt/revision

other ZEO clients even if ZODB Components are not.

Steps to reproduce:

  1/ On zope1, view and edit a person to make sure class is fully loaded.
  2/ On zope2 add an interaction in person_interaction_workflow and add a script raising an exception.
  3/ Edit a person on zope2. The exception is raised, confirming that the interaction is called.

  When editing a person on zope1, the exception is not raised.

Fix a problem that access-tab-front-page wrongly caching old page, for example,
even if a user switching to use 'https' from 'http', old 'http' links are
remaining at the front page.

That was because the key of the CachingMethod which was used for caching the
page was ('user' and 'language').
Now the caching key is ('user', 'language' and 'site_url').

This is not a new feature, this behavior is compatible with the old caching
implementation that was using inventory_stock table.
In other words, this brings backs the backword compatibility in invetory
caching.

Selection: Do not set Selections if the new and store name differs instead of raising AssertionError.

http://bugs.jquery.com/attachment/ticket/5968/0001-Fix-jQuery.ajax-success-function-being-called-when-H.patch

When importing back ace.js containing a last line with whitespaces only, the
last line was not imported, and thus the file could never been downloaded
completely as its really size was less than the one on the File ZODB object.

Tests may login/logout with different users. This fixes
testDynamicClassGeneration.TestZodbTestComponent.testRunLiveTest.

ZODB Components: Only Manager or Developer Role should be able to access Component Tools and Components.

Otherwise, without passing the new height/width to resize() and without force,
text is not visible when switching to maximize/fullscreen mode.

Since a29456bc, only import lock is used instead of aq_method_lock, dynamic
modules locks and import lock. However, it was creating another deadlock:

when the import lock is held in one thread (for instance when trying to
perform migration to Portal Type as Classes and ZODB Property Sheets), and an
object is loaded from ZODB, a request is sent to ZEO, and this blocks until
another thread (asyncore) gets the ZEO reply and sends it back to the first
thread.

However, if the asyncore thread receives an Exception, it will tries to import
its module and thus create a deadlock as the import lock is still held by the
first thread.

ZODB Components: No need to migrate Component Tool, only exist since Portal Type as Classes and ZODB Property Sheets.

Because of recently added Component Tool, POSKeyError exception was raised
when trying to load it from ZODB during migration of Portal Type classes and
ZODB Property Sheets (PickleUpdater() in ERP5Site.migrateToPortalTypeClass),
so make sure that there is a commit before loading anything from ZODB.

This has several benefits:

* No need to exit maximize/fullscreen modes to save.
* The cursor position in the editor does not change.

This implementation is hackish because it is too Component-specific, but until
RenderJS is being used, there is no probably no better way.

How it happened while upgrading PathTemplateItem:
  1. Tries to remove the existing broken object and succeeds removing
  2. However it is a broken object so self.unindexCatalog() is
     never called and the old catalog is remaining
  3. Add new object of PathTemplateItem and tries to reindex the object
  4. Since old catalog is remaining, the catalog uid and object uid is
     different so catalogObjectList fails with FATAL error.

The test is tests/BusinessTemplate.py#test_UpgradeBrokenObject.