Patch Notes for CloudCraze 4.8

Added the ability to filter the static resources that the ccrz.cc_util_UserInterface API utility class queries. This query includes static resources that contain your storefront's product images, theme files, and so on. This enhancement works around limits in your org if you've installed multiple managed packages, and allows you to specify the static resource namespaces that you want to query.

UPGRADE IMPACT: To implement this filter in your org, create metadata for a new configuration in the User Interface module that uses the API name nsList. Then, in your storefront settings, set the value of this configuration to a comma-separated list of the namespaces that you want to query. Avoid spaces between comma values, and be sure to include the default ccrz namespace in the list. For example, enter ccrz,other-namespace where other-namespace is a custom namespace that you want to include. For more information, see Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

Upgraded the version of the following default third-party JavaScript libraries that the managed package distributes:

• bootstrap.js to 3.4.1 (for Bootstrap 3-enabled themes only)
• handlebars.js to 4.7.6
• jquery-ui-custom.js to 1.12.1

This change updates the ccrz.cc_hk_UserInterface.standardIncludes extension point method. For more information about the changes in these versions, see the appropriate release notes:

• Bootstrap release notes
• Handlebars release notes
• jQuery UI release notes

Enabled the Secure attribute for the following cookies:

• apex__cc_anonymous_Country
• apex__cc_anonymous_Currency
• apex__cclgtkn
• apex__currCartId
• apex__effacc
• apex__CSRportalUserId

This attribute ensures that the managed package sends cookie data securely through an encrypted request over HTTPS protocol. For more information, see:

• (Mozilla Developers) Using HTTP cookies
• (Open Web Application Security Project) Secure Cookie Flag

Fixed an issue where a buyer wasn't able to log in to the storefront. This issue occurred in an org that's resolved the security alerts for preventing unauthorized guest user access to their storefront data. If the user configured as the Default Record Owner owned multiple active carts that were abandoned, the heap size filled up. As a result, no community users could log in.

UPGRADE IMPACT: This fix updates the ccrz.ccLogicUserLogin.determineStartURL() logic provider method in the following ways:

• The call to ccrz.ccApiUser.fetch() specifies ccrz.ccService.QUERYLIMIT => 1 and ccrz.ccService.WODAO => True.
• The call to ccrz.ccApiCart.fetch() specifies ccrz.ccService.QUERYLIMIT => 1.

Updated the default ccrz.cc_hk_UserInterface extension point class to distribute the latest stable, secure versions of jQuery (3.5.1) and jQuery Migrate (3.3.0).

UPGRADE IMPACT: This upgrade also introduces a breaking change where non-void HTML elements that use self-closing tags, such as <div/>, no longer render. This HTML compatibility change affects the default Handlebars templates included in the managed package, and can affect front-end extensions or customizations that you've already developed. For more details about the jQuery upgrade and the impact on the HTML used in your storefront, see the Salesforce Knowledge article, Upgrade to jQuery 3.5.1 in B2B Commerce for Visualforce Spring ’20 (Version 4.12) or Earlier.

Fixed potential security vulnerabilities in some extension point classes.

UPGRADE IMPACT: This fix deprecates the ccrz.cc_hk_EffectiveAccount.fetchAccountData() method.

Fixed several issues that ensure that guest users can continue to self-register and create carts after you complete the required Communities security alerts for guest security.

UPGRADE IMPACT: Complete the following steps:

1. Install patch 3.133.24 to upgrade the managed package.
2. Create metadata for the Default Record Owner configuration in the User Profile (Registration) module. See Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide
3. Complete the steps in Resolve Guest User Security Alerts to Keep Your Storefronts Secure by Default in the B2B Commerce for Visualforce Release Notes and Upgrade Guide. These steps describe how to manually resolve each security alert.
4. Complete the steps in Update Order Confirmation Email Permissions in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

Fixed several issues that enhance the security of CloudCraze custom objects against unauthorized access. These fixes don’t require any action after you upgrade.

This patch removes a requirement to have the View All Users permission enabled on your storefront’s guest user profile. This permission was previously required to work around a Salesforce Communities security fix. If you previously enabled this permission, update your guest user profile to disable the View All Users permission. This change ensures that you’re providing the least privilege to guest users to help keep your storefront data secure, while still supporting self-registration.

Fixed an issue where a CC Cart Item record's Unit of Measure field was empty instead of matching the corresponding CC Product record's value.

UPGRADE IMPACT: To update your existing CC Cart Item records, execute the following anonymous Apex code from the Developer Console:

System.debug('---start---');
Savepoint sp = Database.setSavepoint();
List<ccrz__E_CartItem__c> cartItems = [SELECT Id,ccrz__UnitOfMeasure__c,ccrz__Product__r.ccrz__UnitOfMeasure__c,ccrz__Cart__r.Id
                                    FROM ccrz__E_CartItem__c
                                    WHERE ccrz__UnitOfMeasure__c=NULL AND ccrz__Product__r.ccrz__UnitOfMeasure__c!=NULL];
System.debug('count: '+cartItems.size());
try {
    for(ccrz__E_CartItem__c ci : cartItems) {
        if (String.isNotBlank(ci.ccrz__Product__r.ccrz__UnitOfMeasure__c)) {
            ci.ccrz__UnitOfMeasure__c = ci.ccrz__Product__r.ccrz__UnitOfMeasure__c;
            System.debug('updating ' + ci.Id + ' of Cart ' + ci.ccrz__Cart__r.Id);
        }
    }
    update cartItems;
} catch(DMLException dmle) {
    Database.rollback(sp);
    System.debug(dmle.getMessage());
} finally {
    System.debug('---end---');
}

Fixed an issue where links to the storefront Home page were broken when both of the following conditions were true:

• Any product in the org was missing an SEO ID value.
• You've enabled friendly URLs and refreshed the site index.