Patch Notes for B2B Commerce for Visualforce Spring ’20 (Version 4.12)

Added the ability to filter the static resources that the ccrz.cc_util_UserInterface API utility class queries. This query includes static resources that contain your storefront's product images, theme files, and so on. This enhancement works around limits in your org if you've installed multiple managed packages, and allows you to specify the static resource namespaces that you want to query.

UPGRADE IMPACT: To implement this filter in your org, create metadata for a new configuration in the User Interface module that uses the API name nsList. Then, in your storefront settings, set the value of this configuration to a comma-separated list of the namespaces that you want to query. Avoid spaces between comma values, and be sure to include the default ccrz namespace in the list. For example, enter ccrz,other-namespace where other-namespace is a custom namespace that you want to include. For more information, see Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

Fixed an issue where the Checkout page returned an Apex error that prevented checkout flow from completing successfully. This issue occurred when both of the following conditions were satisfied:

• The Address Owned by User configuration of the Checkout module (co.uown) was TRUE.
• A customer service representative (CSR) was logged in to the storefront using CSR flow and selected an effective account.

UPGRADE IMPACT: After you upgrade the managed package, update the Checkout module's Address Owned by User configuration to apply to all pages instead of only the Checkout page (co). Then, build and activate a new configuration cache.

Fixed an issue where multiple quantity controls were available for the Add to Cart button. This issue occurred when the storefront enabled product quantity rules with an increment value of 1.

UPGRADE IMPACT: This fix updates the Handlebars templates that render quantity controls. This fix also adds an example inner class, single, to the ccrz.cc_api_ProductQuantityRule extension point in the API. This inner class adds increase (+) and decrease (-) Increment buttons to all quantity input controls, but no Skip Increment buttons. To enable this inner class on your storefront, edit the Product Quantity Rule API Class field in your storefront settings to cc_api_ProductQuantityRule:single.

Fixed an issue where the sharing rules for the following custom objects potentially exposed personal identifiable information (PII) in carts, orders, and addresses:

• CC Cart
• CC Contact Address
• CC Order

These sharing rules were previously required for a storefront that allows a guest buyer to create a cart and check out. This fix removes the dependency on the specific sharing rules. Guest user carts and checkout continue to behave correctly without these rules.

UPGRADE IMPACT: After you install the patch, to remove the affected sharing rules and update sharing attributes in the default order confirmation email template, complete the steps in Remove Sharing Rules for Carts, Orders, and Addresses in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

Enabled the Secure attribute for the following cookies:

• apex__cc_anonymous_Country
• apex__cc_anonymous_Currency
• apex__cclgtkn
• apex__currCartId
• apex__effacc

This attribute ensures that the managed package sends cookie data securely through an encrypted request over HTTPS protocol. For more information, see:

• (Mozilla Developers) Using HTTP cookies
• (Open Web Application Security Project) Secure Cookie Flag

Fixed an issue where the Email Us link in the Site_Get_In_Touch page labels didn't link to an actual email address. Instead, the link redirected a buyer to the current storefront page. This issue affected the following Visualforce pages:

• ccrz.CCException
• ccrz.CCFileNotFound
• ccrz.CCInMaintenance
• ccrz.CCUnauthorized
• ccrz.CCUnderConstruction

UPGRADE IMPACT: After you install the patch, update the affected page labels. Complete the steps in Update the Page Labels for Site Admin Email on Exception Pages in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

Fixed an issue where changing a cart item's quantity to zero and updating the cart didn't also change the cart item quantity in the buyer's session cache. This issue occurred when all the following conditions were true:

• The Allow Zero Quantity configuration of the Cart module was TRUE.
• Platform cache was enabled,
• The buyer changed the quantity of only one cart item to zero.

Fixed an issue where duplicate internationalized spec values appeared on the Product Compare page. This issue occurred when both of the following conditions were true:

• At least two CC Spec records had the same Name (such as Color), but different Locales (such as en_US and ja_JP).
• A product had a spec value assigned for each spec.

Fixed an issue where a buyer wasn't able to log in to the storefront. This issue occurred in an org that's resolved the security alerts for preventing unauthorized guest user access to their storefront data. If the user configured as the Default Record Owner owned multiple active carts that were abandoned, the heap size filled up. As a result, no registered users could log in.

UPGRADE IMPACT: This fix updates the ccrz.ccLogicUserLogin.determineStartURL() logic provider method in the following ways:

• The call to ccrz.ccApiUser.fetch() specifies ccrz.ccService.QUERYLIMIT => 1 and ccrz.ccService.WODAO => True.
• The call to ccrz.ccApiCart.fetch() specifies ccrz.ccService.QUERYLIMIT => 1.

Updated the default ccrz.cc_hk_UserInterface extension point class to distribute the latest stable, secure versions of jQuery (3.5.1) and jQuery Migrate (3.3.0).

UPGRADE IMPACT: This upgrade also introduces a breaking change where non-void HTML elements that use self-closing tags, such as <div/>, no longer render. This HTML compatibility change affects the default Handlebars templates included in the managed package, and can affect front-end extensions or customizations that you've already developed. For more details about the jQuery upgrade and the impact on the HTML used in your storefront, see the Salesforce Knowledge article, Upgrade to jQuery 3.5.1 in B2B Commerce for Visualforce Spring ’20 (Version 4.12) or Earlier.

Fixed an issue where a service override wasn’t available in CC Admin for the ccrz.ccServiceFeatured data service provider class.

UPGRADE IMPACT: To make this override available after you upgrade the managed package, execute the following anonymous Apex code from the Developer Console:

ccrz.ccApi.registerService(new Map<String, Object>{
    'SFP' => 'ccServiceFeatured'
});

Fixed an issue where an error occurred when showing shipping options during checkout. This issue occurred after the following sequence of events:

1. A buyer first selected a shipping option during checkout.
2. The buyer exited checkout flow, returned to their cart, and changed the cart's contents in such a way that the selected shipping option became invalid.
3. Finally, the buyer returned to the checkout flow.

This fix removes the invalid shipping option from the CC Cart record when proceeding through checkout again.

Fixed an issue where the Checkout page didn't reliably load the account's default shipping or billing address. Previously, B2B Commerce for Visualforce allowed multiple shipping or billing account address book records to have the Default field set. This fix enforces a limit of one shipping and one billing account address book entry per account.

UPGRADE IMPACT: Edit the account address book record that you want to use for the default selected during checkout, and enable its Default field. B2B Commerce for Visualforce uses whichever record where Default was most recently enabled as the default address during checkout.

Fixed potential security vulnerabilities in some extension point classes.

UPGRADE IMPACT: This fix deprecates the ccrz.cc_hk_EffectiveAccount.fetchAccountData() method.

Fixed an issue where the CC Admin tab didn't load for a user whose admin profile didn't have Create access on the E_Foo__c object.

As a result of this change, a user with the admin profile can’t download files from CC Admin | Global Settings | Settings Loader.