--- schema_version: "1" id: 2a150ac7b5712d78fb17842588027a4dcdf3984bd7b02b9f3139b6eaf0c14893 title: Patch Notes for CloudCraze 4.8 collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/commerce/264-0-0/cloudcraze_4_8_patches.md canonical_url: https://help.salesforce.com/s/articleView?id=commerce.cloudcraze_4_8_patches.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: b19fa9820202d8386c1b607af57380ee6aca8f44f950bde4eeda4e589908e917 description: Patch notes for CloudCraze. products: - Commerce - B2B Commerce release: "264" --- # Patch Notes for CloudCraze 4.8 Patch notes for CloudCraze. ### Required Editions
Salesforce Compatibility Salesforce Classic and Lightning Experience for Enterprise, Performance, Unlimited, and Developer editions.

B2B Commerce Compatibility

Any org installing a patch for CloudCraze 4.8
![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-commerce-b2b_commerce_release_notes-264-0-0-production-enus/dd2bc651-f664-4278-bce2-a3d325362afb/images/icon_important.png) Important These patch notes are provided for maintaining existing CloudCraze 4.8 solutions. However, most information in these help topics applies only to B2B Commerce for Visualforce Summer ’18 (version 4.9) or later. ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-commerce-b2b_commerce_release_notes-264-0-0-production-enus/dd2bc651-f664-4278-bce2-a3d325362afb/images/icon_tip.png) Tip - If you install a particular build in a sandbox and test and validate against that version, ensure that you also install the _same_ build in production. For example, if you install build 3.133.2 in a sandbox, ensure that you also install build 3.133.2 in production. - The installation URLs for these patches—in either a sandbox org or production org—are available only by submitting a case through Support & Services. ## 3.133.32—March 1, 2024
ID Fix
W-14628858

Added the ability to filter the static resources that the ccrz.cc_util_UserInterface API utility class queries. This query includes static resources that contain your storefront's product images, theme files, and so on. This enhancement works around limits in your org if you've installed multiple managed packages, and allows you to specify the static resource namespaces that you want to query.

UPGRADE IMPACT: To implement this filter in your org, create metadata for a new configuration in the User Interface module that uses the API name nsList. Then, in your storefront settings, set the value of this configuration to a comma-separated list of the namespaces that you want to query. Avoid spaces between comma values, and be sure to include the default ccrz namespace in the list. For example, enter ccrz,other-namespace where other-namespace is a custom namespace that you want to include. For more information, see Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.

## 3.133.31—March 14, 2023 | ID | Fix | | --- | --- | | W-11148792 | Upgraded the versions of these JavaScript libraries distributed with the managed package: jquery-ui-custom.js from 1.11.4 to 1.13.2 and jquery.validate.js from 1.14.0 to 1.19.5. This change updates the `ccrz.cc_hk_UserInterface.standardIncludes` method for both the Bootstrap 3 and classic interfaces. For more information about the changes in these versions, see the [jquery-ui.js release notes](https://jqueryui.com/changelog/1.13.2/) and [jquery.validate.js](https://github.com/jquery-validation/jquery-validation/releases/tag/1.19.5) release notes. | ## 3.133.30—January 13, 2022 | ID | Fix | | --- | --- | | W-9877348 | Upgraded the versions of these JavaScript libraries distributed with the managed package: handlebars.js from 4.7.6 to 4.7.7 and underscore.js from 1.8.3 to 1.13.1. This change updates the `ccrz.cc_hk_UserInterface.standardIncludes` method for both the Bootstrap 3 and classic interfaces. For more information about the changes in these versions, see the [handlebars.js release notes](https://github.com/handlebars-lang/handlebars.js/blob/master/release-notes.md) and [underscore.js release notes](https://github.com/jashkenas/underscore/releases/tag/1.13.1). | | W-9811689 | Fixed a potential vulnerability related to the My Orders section of the My Account page. | | W-9811544 | Fixed an issue where an admin could potentially inject cross-site scripting (XSS) when creating custom configuration modules. | ## 3.133.29—March 23, 2021
ID Fix
W-8509438

Upgraded the version of the following default third-party JavaScript libraries that the managed package distributes:

  • bootstrap.js to 3.4.1 (for Bootstrap 3-enabled themes only)
  • handlebars.js to 4.7.6
  • jquery-ui-custom.js to 1.12.1

This change updates the ccrz.cc_hk_UserInterface.standardIncludes extension point method. For more information about the changes in these versions, see the appropriate release notes:
W-8115342 Fixed an issue where a subscription for a kit or dynamic kit didn't correctly evaluate recurring cost when adding to a cart or after pricing the cart.
## 3.133.28—September 24, 2020
ID Fix
W-7976755

Enabled the Secure attribute for the following cookies:

  • apex__cc_anonymous_Country
  • apex__cc_anonymous_Currency
  • apex__cclgtkn
  • apex__currCartId
  • apex__effacc
  • apex__CSRportalUserId

This attribute ensures that the managed package sends cookie data securely through an encrypted request over HTTPS protocol. For more information, see:
W-7765192

Fixed an issue where a buyer wasn't able to log in to the storefront. This issue occurred in an org that's resolved the security alerts for preventing unauthorized guest user access to their storefront data. If the user configured as the Default Record Owner owned multiple active carts that were abandoned, the heap size filled up. As a result, no community users could log in.

UPGRADE IMPACT: This fix updates the ccrz.ccLogicUserLogin.determineStartURL() logic provider method in the following ways:

  • The call to ccrz.ccApiUser.fetch() specifies ccrz.ccService.QUERYLIMIT => 1 and ccrz.ccService.WODAO => True.
  • The call to ccrz.ccApiCart.fetch() specifies ccrz.ccService.QUERYLIMIT => 1.
W-7566522

Updated the default ccrz.cc_hk_UserInterface extension point class to distribute the latest stable, secure versions of jQuery (3.5.1) and jQuery Migrate (3.3.0).

UPGRADE IMPACT: This upgrade also introduces a breaking change where non-void HTML elements that use self-closing tags, such as <div/>, no longer render. This HTML compatibility change affects the default Handlebars templates included in the managed package, and can affect front-end extensions or customizations that you've already developed. For more details about the jQuery upgrade and the impact on the HTML used in your storefront, see the Salesforce Knowledge article, Upgrade to jQuery 3.5.1 in B2B Commerce for Visualforce Spring ’20 (Version 4.12) or Earlier.
## 3.133.26—June 12, 2020
ID Fix
W-7453580

Fixed potential security vulnerabilities in some extension point classes.

UPGRADE IMPACT: This fix deprecates the ccrz.cc_hk_EffectiveAccount.fetchAccountData() method.
W-7371931 Fixed an out-of-date URL in an Apex method comment.
W-7226649 Added the ViewRoles permission to some permission sets that the managed package installs. This fix resolves a Salesforce requirement for assigning the Customize Application permission to the affected permission sets.
## 3.133.25—February 18, 2020 | ID | Fix | | --- | --- | | W-7093593 | Fixed an issue where multiple CC Order records were created. This issue occurred when a buyer pressed the space bar, Enter (Windows), or Return (macOS) multiple times after clicking the Process Payment button during checkout. | ## 3.133.24—January 3, 2020
ID Fix
Multiple items

Fixed several issues that ensure that guest users can continue to self-register and create carts after you complete the required Communities security alerts for guest security.

UPGRADE IMPACT: Complete the following steps:

  1. Install patch 3.133.24 to upgrade the managed package.
  2. Create metadata for the Default Record Owner configuration in the User Profile (Registration) module. See Create Metadata for the Namespace List Configuration Added in a Patch in the B2B Commerce for Visualforce Release Notes and Upgrade Guide
  3. Complete the steps in Resolve Guest User Security Alerts to Keep Your Storefronts Secure by Default in the B2B Commerce for Visualforce Release Notes and Upgrade Guide. These steps describe how to manually resolve each security alert.
  4. Complete the steps in Update Order Confirmation Email Permissions in the B2B Commerce for Visualforce Release Notes and Upgrade Guide.
## 3.133.23—October 16, 2019
ID Fix
Multiple items

Fixed several issues that enhance the security of CloudCraze custom objects against unauthorized access. These fixes don’t require any action after you upgrade.

This patch removes a requirement to have the View All Users permission enabled on your storefront’s guest user profile. This permission was previously required to work around a Salesforce Communities security fix. If you previously enabled this permission, update your guest user profile to disable the View All Users permission. This change ensures that you’re providing the least privilege to guest users to help keep your storefront data secure, while still supporting self-registration.
## 3.133.19—July 29, 2019 | ID | Fix | | --- | --- | | W-6339162 | Fixed an issue where the tax amount was calculated incorrectly during checkout when multiple currencies were enabled for your storefront. | ## 3.133.18—July 16, 2019 | ID | Fix | | --- | --- | | W-6339162 | Fixed an issue where the estimated tax amount that’s calculated during checkout could be circumvented. | ## 3.133.17—June 21, 2019 | ID | Fix | | --- | --- | | W-6210494 | Fixed an issue where the Reorder button in the My Orders section of the My Account page still appeared unexpectedly. This issue occurred even when the Show Reorder Button configuration of the My Orders module was FALSE. This fix applies only to the Bootstrap 3 page templates. | ## 3.133.16—February 7, 2019 | ID | Fix | | --- | --- | | W-5833069 | Fixed an issue where an internal user accessing a community disrupted storefront service for guest users when platform cache was enabled. | ## 3.133.15—November 6, 2018 | ID | Fix | | --- | --- | | W-5491861 | Fixed an issue that reduces the impact of multiple supported locales when generating the category tree. | ## 3.133.13—October 5, 2018 | ID | Fix | | --- | --- | | W-5559164 | Fixed an issue where overriding pricing logic did not correctly handle effective dates for price list items. | ## 3.133.12—August 13, 2018
ID Fix
W-5321579 Fixed an issue where disabled Product Media records still displayed in the storefront.
W-5315657

Fixed an issue where a CC Cart Item record's Unit of Measure field was empty instead of matching the corresponding CC Product record's value.

UPGRADE IMPACT: To update your existing CC Cart Item records, execute the following anonymous Apex code from the Developer Console:

System.debug('---start---');
Savepoint sp = Database.setSavepoint();
List<ccrz__E_CartItem__c> cartItems = [SELECT Id,ccrz__UnitOfMeasure__c,ccrz__Product__r.ccrz__UnitOfMeasure__c,ccrz__Cart__r.Id
                                    FROM ccrz__E_CartItem__c
                                    WHERE ccrz__UnitOfMeasure__c=NULL AND ccrz__Product__r.ccrz__UnitOfMeasure__c!=NULL];
System.debug('count: '+cartItems.size());
try {
    for(ccrz__E_CartItem__c ci : cartItems) {
        if (String.isNotBlank(ci.ccrz__Product__r.ccrz__UnitOfMeasure__c)) {
            ci.ccrz__UnitOfMeasure__c = ci.ccrz__Product__r.ccrz__UnitOfMeasure__c;
            System.debug('updating ' + ci.Id + ' of Cart ' + ci.ccrz__Cart__r.Id);
        }
    }
    update cartItems;
} catch(DMLException dmle) {
    Database.rollback(sp);
    System.debug(dmle.getMessage());
} finally {
    System.debug('---end---');
}
## 3.133.11—July 26, 2018
ID Fix
W-5233843 Fixed an issue where friendly URL links break when you've set up multiple storefronts in the same community.
W-5231086

Fixed an issue where links to the storefront Home page were broken when both of the following conditions were true:

  • Any product in the org was missing an SEO ID value.
  • You've enabled friendly URLs and refreshed the site index.
## 3.133.10—July 3, 2018 | ID | Fix | | --- | --- | | W-5149741 | Fixed an issue where an effective account's billing and shipping addresses weren't updated before starting the checkout process. This fix invokes the `ccrz.cc_hk_EffectiveAccount.saveCart` method from the Shopping Cart page. | ## 3.133.9 | ID | Fix | | --- | --- | | PATCH-3357 | Fixed an issue where the default purchase order (PO) payment type didn't work correctly when using a gross layout override. | | PATCH-3375 | Fixed an issue where a product quantity rule defaulted to an increment of 1 when a buyer clicked Add to Cart with a specified quantity of 0. This fix applies the specified increment value instead of 1. | | PATCH-3351 | Fixed multiple potential vulnerabilities related to cross-site scripting (XSS), and enforced a sharing rule to meet security standards. | ## 3.133.7 | ID | Fix | | --- | --- | | PATCH-3304 | Fixed issue where accessing the site index with a secure URL opened the sitemap with an unsecure URL. This fix ensures that a sitemap opens with a secure URL when accessing the site index. | | PATCH-3268 | Fixed an issue where the `fetchMinicart` and `getheaderinfo` methods were called twice when using effective accounts. | ## 3.133.6 | ID | Fix | | --- | --- | | PATCH-3280 | Fixed an issue where the storefront name parameter didn't pass from the request parameter to the Payment section of the Checkout page. | | PATCH-3274 | Fixed an issue where omitting a base price list for a supported currency affected storefront performance. | | PATCH-3262 | Fixed an issue where the Order Review section of the Checkout page didn't show the Requested Delivery Date field. This issue occurred only on a mobile device for a storefront using the classic interface. | ## 3.133.5 | ID | Fix | | --- | --- | | PATCH-3238 | Fixed issue where the pricing feature filter slider didn't show on Product List Page for Microsoft® Internet Explorer® 11. | ## 3.133.4 | ID | Fix | | --- | --- | | PATCH-3226 | Fixed an issue where the apex\_\_currCartId cookie didn't work correctly for Microsoft® Internet Explorer®. | | PATCH-3190 | Increased the timeout for the `fetchCart` remote action on the Shopping Cart page to 120 seconds. | | PATCH-3178 | Fixed an issue where unnecessary logging was applied to subscriber theme static resource references. | | PATCH-3172 | Fixed an issue where the Shopping Cart page didn't update when the CC Cart record already specified a value for its PO Number field. | | PATCH-3160 | Fixed an issue that affected internal menu links when using Salesforce Classic in an org with multiple storefronts for a single community. | | PATCH-3154 | Fixed API version 6 or later for the `ccrz.ccApiCart.price` method to honor the `ccrz.ccApi.SZ_REFETCH` data size request flag. | | PATCH-3136 | Updated the `ccrz.ccApiCart.place` method to respect the order status input parameter `ccrz.ccApiOrder.PARAM_ORDER_STATUS`. | | PATCH-3124 | Fixed an issue where CSR flow resulted in redundant cart header fetches when the cardId URL parameter was empty or missing. | ## 3.133.2 | ID | Fix | | --- | --- | | PATCH-3110 | Fixed an issue where the Slider filter type for spec values on the Product List page didn't render correctly. This issue occurred only on a storefront that uses the Bootstrap 3 interface. | | PATCH-3098 | Fixed an issue where repricing a cart didn't update invalid cart items with the invalid item status. | | PATCH-3092 | Fixed an issue where a coupon didn't apply a discount when the source requirement was a product spec value. | | PATCH-3086 | Fixed an issue where a product search returned a No results found message when the search didn't return any entitled products. | | PATCH-3074 | Fixed an issue where a cart total coupon didn't correctly apply the discount. This issue occurred when the coupon discounted the cart total lower than the coupon's Cart Total Amount criteria. | | PATCH-3062 | Fixed an issue where the `ccrz.ccApiCart.addTo` method didn't honor the `ccrz.ccApiCart.ISREPRICE` input key. | | PATCH-3050 | Fixed an issue where Forgot Password page didn't render from the Reset Password email. This fix updates the default behavior for storefront associations when the storefront URL parameter is empty or missing. | | PATCH-3032 | Updated the ccrz.CCSiteIndex and ccrz.CCCatSiteMap Visualforce pages to render the XML UTF-8 declaration. | | PATCH-3026 | Updated the Home page so that `` elements in the HTML `` reference the SEO keywords and description specified in your storefront's general settings. | | PATCH-2966 | Added page labels for the search placeholder text and filter search term breadcrumb on the Product List page. |