Products.cmfplone: Merge patches from PloneHotfix20171128

[mauritsvanrees]

On Tuesday November 28 2017 PloneHotfix20171128 was released. This should be merged to various packages in core. This is a master ticket to track all pull requests. I will first list all items that need to be fixed. I will add a link to a PR when I create it (or when someone else has). When a PR has been merged, we can mark the checkbox.

Zope specific issues
Some of the patches are for Zope. I track those in https://github.com/zopefoundation/Zope/issues/227.
They are:

• [x] Problem 1: open redirection when calling /Redirect
• [x] Problem 2: Sandbox escape with str.format

Tests/edits in CMFPlone for the str.format changes.

• [x] CMFPlone 4.3: port fixes from AccessControl, because we are bound to AccessControl 3.0.11. https://github.com/plone/Products.CMFPlone/pull/2267
• [x] CMFPlone 5.0: require AccessControl 3.0.14. https://github.com/plone/Products.CMFPlone/pull/2269
• [x] CMFPlone 5.1: require AccessControl 3.0.14. https://github.com/plone/Products.CMFPlone/pull/2270
• [x] CMFPlone 5.2: require AccessControl 4.0b1. https://github.com/plone/Products.CMFPlone/pull/2271

Problem 3: open redirection on login form
Announcement of vulnerability. This needs a fix in CMFPlone in isURLInPortal.
PRs:

• [x] Plone 4.3: https://github.com/plone/Products.CMFPlone/pull/2233
• [x] Plone 5.0: https://github.com/plone/Products.CMFPlone/pull/2234
• [x] Plone 5.1: https://github.com/plone/Products.CMFPlone/pull/2235
• [x] Plone 5.2: https://github.com/plone/Products.CMFPlone/pull/2236

Problem 4: XSS using the home_page member property.
Announcement of vulnerability. The home_page property of a user can contain javascript, which gets inserted literally in the page. This should be fixed in Products.PlonePAS
PRs:

• [x] Products.PlonePAS 5.x (for Plone 4.3, 5.0, 5.1): https://github.com/plone/Products.PlonePAS/pull/28
• [x] Products.PlonePAS master (for Plone 5.2): https://github.com/plone/Products.PlonePAS/pull/29

Additionally for this problem, but someone can pick that up in a different ticket:

• Add a validator in plone.app.users to check the validity of the home_page property to not be malicious.
• Add an upgrade step to go through all users and check their home_page.

[mauritsvanrees]

All done. Thanks to all who helped!