Patch Notes for B2B Commerce for Visualforce Summer ’18 (Version 4.9)

Added the ability to filter the static resources that the ccrz.cc_util_UserInterface API utility class queries. This query includes static resources that contain your storefront's product images, theme files, and so on. This enhancement works around limits in your org if you've installed multiple managed packages, and allows you to specify the static resource namespaces that you want to query.

UPGRADE IMPACT: To implement this filter in your org, create metadata for a new configuration in the User Interface module that uses the API name nsList. Then, in your storefront settings, set the value of this configuration to a comma-separated list of the namespaces that you want to query. Avoid spaces between comma values, and be sure to include the default ccrz namespace in the list. For example, enter ccrz,other-namespace where other-namespace is a custom namespace that you want to include. For more information, see Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

Upgraded the version of the following default third-party JavaScript libraries that the managed package distributes:

• bootstrap.js to 3.4.1 (for Bootstrap 3-enabled themes only)
• handlebars.js to 4.7.6
• jquery-ui-custom.js to 1.12.1

This change updates the ccrz.cc_hk_UserInterface.standardIncludes extension point method. For more information about the changes in these versions, see the appropriate release notes:

• Bootstrap release notes
• Handlebars release notes
• jQuery UI release notes

Fixed an issue where products with a significant number of price list items were excluded from the product index batch jobs, due to Apex governor limits. This fix adds two storefront configuration settings in the Product Indexing module, Override Default Batch Size and Custom Batch Size. Set values for these configurations to fine-tune the performance of your product index batch jobs.

UPGRADE IMPACT: After you install patch 3.136.39, create metadata for the Override Default Batch Size and Custom Batch Size configurations in the Product Indexing module. For more information, see Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

Enabled the Secure attribute for the following cookies:

• apex__cc_anonymous_Country
• apex__cc_anonymous_Currency
• apex__cclgtkn
• apex__currCartId
• apex__effacc

This attribute ensures that the managed package sends cookie data securely through an encrypted request over HTTPS protocol. For more information, see:

• (Mozilla Developers) Using HTTP cookies
• (Open Web Application Security Project) Secure Cookie Flag

Fixed an issue where a buyer wasn't able to log in to the storefront. This issue occurred in an org that's resolved the security alerts for preventing unauthorized guest user access to their storefront data. If the user configured as the Default Record Owner owned multiple active carts that were abandoned, the heap size filled up. As a result, no registered users could log in.

UPGRADE IMPACT: This fix updates the ccrz.ccLogicUserLogin.determineStartURL() logic provider method in the following ways:

• The call to ccrz.ccApiUser.fetch() specifies ccrz.ccService.QUERYLIMIT => 1 and ccrz.ccService.WODAO => True.
• The call to ccrz.ccApiCart.fetch() specifies ccrz.ccService.QUERYLIMIT => 1.

Updated the default ccrz.cc_hk_UserInterface extension point class to distribute the latest stable, secure versions of jQuery (3.5.1) and jQuery Migrate (3.3.0).

UPGRADE IMPACT: This upgrade also introduces a breaking change where non-void HTML elements that use self-closing tags, such as <div/>, no longer render. This HTML compatibility change affects the default Handlebars templates included in the managed package, and can affect front-end extensions or customizations that you've already developed. For more details about the jQuery upgrade and the impact on the HTML used in your storefront, see the Salesforce Knowledge article, Upgrade to jQuery 3.5.1 in B2B Commerce for Visualforce Spring ’20 (Version 4.12) or Earlier.

After you install patch 3.136.38, create metadata for the Restore Legacy jQuery HTML Prefilter configuration in the User Interface module. For more information, see Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

Fixed potential security vulnerabilities in some extension point classes.

UPGRADE IMPACT: This fix deprecates the ccrz.cc_hk_EffectiveAccount.fetchAccountData() method.

Fixed several issues that ensure that guest users can continue to self-register and create carts after you complete the required security alerts for guest security.

UPGRADE IMPACT: Complete the following:

• Install patch 3.136.36 to upgrade the managed package.
• Create metadata for the Default Record Owner configuration in the User Profile (Registration) module. See Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.
• Complete the steps in Resolve Guest User Security Alerts to Keep Your Storefronts Secure by Default in the B2B Commerce for Visualforce Release Notes and Upgrade Guide. These steps describe how to manually resolve each security alert.
• Complete the steps in Update Order Confirmation Email Permissions in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

Fixed an issue where an order item’s status didn’t appear on the Order View page.

UPGRADE IMPACT: With this change, the orderItemStatus field is now included in SZ_XL return data for the ccrz.ccApiOrder.fetchOrderItems() method.

Fixed several issues that enhance the security of B2B Commerce for Visualforce custom objects against unauthorized access. These fixes don’t require any action after you upgrade.

This patch removes a requirement to have the View All Users permission enabled on your storefront’s guest user profile. This permission was previously required to work around a Digital Experiences security fix. If you previously enabled this permission, update your guest user profile to disable the View All Users permission. This change ensures that you’re providing the least privilege to guest users to help keep your storefront data secure, while still supporting self-registration.

Fixed an issue where a product with a start date that’s valid for the current date didn’t appear on the storefront. This issue occurred because the product index included only price list items whose date ranges were valid for the time that the index was built. For example, a product with a start date of September 1 didn’t appear on the storefront on September 1, because the product index was built on August 15. With this fix, a price list item with a future Start Date is now included the next time you build a new product index.

If you start including future-dated products, the size of th e index and time required to build it both increase.

Fixed an issue where orgs with B2B Commerce for Visualforce Summer ’18 (version 4.9) patch 3.136.29 or 3.136.28 couldn't upgrade. This issue occurred only when trying to upgrade to any build of B2B Commerce for Visualforce Spring ’19 (version 4.10) build 3.142 or later.

UPGRADE IMPACT: If this scenario applies to you, install patch 3.136.30 before you install 3.142 or later.

Fixed an issue where B2B Commerce for Visualforce failed to transfer ownership of a cart from a guest user to an authenticated user once the user self-registered. This failure occurred only when all following conditions were true:

• Your organization-wide default external access for the User object was set to Private.
• The Experience Cloud site’s guest user profile had the View All Users permission disabled.
• The Site User Visibility sharing setting was disabled.

Fixed several minor issues to enhance the admin experience when managing B2B Commerce for Visualforce custom objects. These fixes relate to Create-Read-Update-Delete (CRUD) access and field-level security (FLS) on B2B Commerce for Visualforce custom objects.

This patch also includes a fix that enables a Cross-Site Request Forgery (CSRF) protection checkbox on all B2B Commerce Visualforce pages used for rendering CC Admin. These fixes don't require any action after you install this patch.

Fixed several minor issues to enhance the admin experience when managing B2B Commerce for Visualforce custom objects. These fixes relate to Create-Read-Update-Delete (CRUD) access and field-level security (FLS) on B2B Commerce for Visualforce custom objects.

UPGRADE IMPACT: After installing this patch, update the permission set assigned to your admin users to include Create, Read, Edit, and Delete access on CC Product Indices. This step is required so that you can continue to build new product index records and keep the product data up to date on your storefront.

Removed cc_admin_Coupon.page as the default button behavior for the CC Coupon object. Now, clicking the New, Edit, or Clone button on the CC Coupon object uses a standard page, which removes all field dependency flows previously available with cc_admin_Coupon.page. The standard page also makes visible fields that were previously automated.

If your implementation doesn't currently use cc_admin_Coupon.page, this change doesn't impact you. Any existing customizations you've made to coupon pages for button behavior are preserved after you upgrade.

Improved SEO support on a storefront by expanding the number of pages with canonical URLs. Previous versions of B2B Commerce for Visualforce created a canonical link for only the Product Detail page. Also, the canonical link was added only when both of the following conditions were true:

• You enabled friendly URLs.
• You assigned the product to a category.

Now, B2B Commerce for Visualforce automatically creates a canonical link for the Home page, Product List page, and Product Detail page. These canonical links are created regardless of whether you enable friendly URLs or whether you assign a product to a category.

UPGRADE IMPACT: The following API changes support this change. If you previously created extensions or overrides, adjust your custom code to account for the changes where necessary.

• The ccrz.cc_hk_UserInterface extension point has a new method, canonicalUrlInclude(), which handles returning the URLs for the Home page, Product List page, and Product Detail page.
• The ccrz.ccApiProduct.getUrlFor() method includes a new key in the input map, ccrz.ccApiProduct.PRODUCTSKULIST, that also affects how the ccrz.ccApiProduct.PRODUCTURLMAP key in the output map returns data. The ccrz.ccLogicProductUrlFor class is also updated to handle this processing.

Improved SEO support on a storefront by changing the way that links to the Home page, Product List page, and Product Detail page are managed. These links now use href attribute values that B2B Commerce for Visualforce generates when the page loads. Previous versions of B2B Commerce for Visualforce navigated one of these links during the JavaScript onClick event, but search engine bots can’t crawl these types of links. These changes apply to both the Bootstrap 3 and classic page templates.

UPGRADE IMPACT:

• If you haven’t created Handlebar template overrides for either the Bootstrap 3 or classic interface, this change doesn't affect your storefronts after upgrading.
• If you have created Handlebar template overrides, update your code with required changes. See Update Handlebar Template Overrides for SEO Improvements in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

Added a configuration in the Product List module, Spec Value Query Limit. This configuration specifies the maximum number of spec value records to search when returning results on the Product List page version 2.0.

The complexity of your product data can affect the scope of the query, regardless of the limit you specify in this configuration.

UPGRADE IMPACT:

• If you're upgrading from a previous build of B2B Commerce for Visualforce Summer ’18 (version 4.9), manually create metadata for this configuration. See Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.
• If you're upgrading from any version earlier than B2B Commerce for Visualforce Summer ’18 (version 4.9)—such as any CloudCraze build—this configuration is available. The default value is 20000. To change this limit, enter a new value with no thousands operator.

Fixed an issue, introduced in B2B Commerce for Visualforce Summer ’18 (version 4.9) patch 3.136.3, that prevented loading or upgrading the available global data in CC Admin.

UPGRADE IMPACT: If you previously installed B2B Commerce for Visualforce Summer ’18 (version 4.9) patch 3.136.3, upgrade to this patch.

Fixed an issue to improve performance when loading the Shopping Cart page. This fix slightly modifies the format of subscription data (ccrz__E_SubProdTerm__c) available to the ccrz.cc_api_PriceAdjustment or ccrz.cc_api_CartExtension extension points.

UPGRADE IMPACT: The version you're upgrading form determines whether this performance fix is enabled by default.

• If you're upgrading from a previous build of B2B Commerce for Visualforce Summer ’18 (version 4.9), this fix is enabled by default. To disable the fix and use legacy cart fetch logic, manually create metadata for the Previous Cart Fetch Logic configuration. Then, set this configuration to TRUE. See Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.
• If you're upgrading from any version earlier than B2B Commerce for Visualforce Summer ’18 (version 4.9), this fix is disabled by default. To enable the fix, change the value of the Previous Cart Fetch Logic configuration of the Cart module to FALSE. When this configuration is TRUE, B2B Commerce for Visualforce uses legacy cart fetch logic.

If you enable the performance fix and you're using ccrz.cc_api_PriceAdjustment or ccrz.cc_api_CartExtension, carefully evaluate the ccrz__E_SubProdTerm__c data those extension points are processing. If necessary, update your extensions to accommodate the changed format.

Fixed an issue where a CC Cart Item record's Unit of Measure field was empty instead of matching the corresponding CC Product record's value.

UPGRADE IMPACT: To update your existing CC Cart Item records, execute the following anonymous Apex code from the Developer Console:

System.debug('---start---');
Savepoint sp = Database.setSavepoint();
List<ccrz__E_CartItem__c> cartItems = [SELECT Id,ccrz__UnitOfMeasure__c,ccrz__Product__r.ccrz__UnitOfMeasure__c,ccrz__Cart__r.Id
                                    FROM ccrz__E_CartItem__c
                                    WHERE ccrz__UnitOfMeasure__c=NULL AND ccrz__Product__r.ccrz__UnitOfMeasure__c!=NULL];
System.debug('count: '+cartItems.size());
try {
    for(ccrz__E_CartItem__c ci : cartItems) {
        if (String.isNotBlank(ci.ccrz__Product__r.ccrz__UnitOfMeasure__c)) {
            ci.ccrz__UnitOfMeasure__c = ci.ccrz__Product__r.ccrz__UnitOfMeasure__c;
            System.debug('updating ' + ci.Id + ' of Cart ' + ci.ccrz__Cart__r.Id);
        }
    }
    update cartItems;
} catch(DMLException dmle) {
    Database.rollback(sp);
    System.debug(dmle.getMessage());
} finally {
    System.debug('---end---');
}