Planet Plone - Where Developers And Integrators Write

Announcing the Plone Conference 2019 selection process

Posted by PLONE.ORG on August 18, 2018 12:45 PM

With Plone Conference 2018 drawing near, it is time to begin planning for our next conference in 2019.The annual Plone Conference brings together users, integrators, developers, designers, and other interested folk from throughout the world for a week of training, talks, and sprinting. Plone conferences are also an expression of community spirit: they are organized by a company, user group, or other entity with ties to and a history with the Plone community and are in essence not-for-profit events.

The Plone Foundation is soliciting proposals to host the 2019 Plone Conference. The selection process this year begins in time to allow for final selection of the conference venue during this year's Conference. The extended timeline allows groups and organizations interested in hosting the 2019 Plone Conference (or beyond) to work with the Tokyo team for hands on experience during this year's conference.

Let's revisit where we've been so we can determine where we might want to go: we've traveled the world from New Orleans, Louisiana, USA for the first Plone Conference to:

  • Vienna, Austria
  • Seattle, Washington, USA
  • Naples, Italy
  • Washington, D.C., USA
  • Budapest, Hungary
  • Bristol, UK
  • San Francisco, CA, USA
  • Arnhem, Netherlands
  • Brasilia, Brazil
  • Bucharest, Romania
  • Boston, MA, USA
  • Barcelona, Catalunya, Spain

and this year to Tokyo, the capital of Japan. But, there are many places yet to explore! If you have a place in mind, don't be shy: submit a proposal!

The Plone Foundation will accept proposals beginning September 1 through October 15, 2018.

The Foundation Board of Directors will review proposals and open those that are viable for voting by the Foundation membership between November 1–5, 2018. The winning proposal will be announced at the end of Plone Conference 2018 in Tokyo.

Everything you need to know to submit a proposal, including the full schedule for the process and in-depth requirements for hosting, is outlined in the official Plone Conference 2019: Call for Proposals.

On behalf of the entire Plone community, we look forward to your conference proposals!

TestTheDocs Sprint

Posted by TestTheDocs on August 01, 2018 04:32 AM
Sprinting Time Join us in Szeged the sun city of Southern-Hungary, or online from your favorite spot!

Pastanaga Editor Status Report - Plone Beethoven Sprint 2018

Posted by kitconcept GmbH on July 20, 2018 11:24 AM

During the Plone Beethoven Sprint in Bonn, we worked hard on creating a first version of a new content editor for Plone-React.

Here is a short demo of what the editor looks like right now:

Demo of the Pastanaga Editor with tiles

We already had a first implementation based on DraftJS that allows inline styles (e.g. bold, italic), block styles (headlines, (un)ordered lists), and links to remote URLs.

The new version of the editor is based on a “tiles” backend, that is build by Victor Fernandez de Alba during the sprint and released with plone.restapi 3.2.0.

This allows us adding more complex content elements such as images, videos, and in the future more complex layout elements.

With the new backend in place, Rob Gietema went ahead and implemented the basic editor that Albert Casado designed as part of the new Pastanaga UI for Plone.

pastanaga editor Mobile Pastanaga Editor design by Albert Casado

The user can type in the title, description and the text content of the document without worrying about form fields or be distracted by tabs and fieldsets.

In addition to the standard text editing it is now possible to add an image tile that can be placed on the left or right side, on the center of the page or in full page width.

Rob also added a YouTube tile that allows the editor to add a YouTube video URL and then displays the video within the editor and the page view.

Text, image, and video tiles can be added to a page. They can be deleted and moved up and down to change the order of the elements.

Next Steps

The new editor is a great accomplishment. The tiles endpoint in plone.restapi allows us to further enhance the current version of the editor with more advanced layout variants and tiles.

We plan to continue with our iterative and agile approach of building a useful, fully functional version of the editor with each step, that allows Plone companies to use the editor and Plone-React today in their client projects.

The next steps are polishing the editor and the existing tiles. Work out some UX issues that we found when working with the editor and building more advanced tiles.

Stay tuned for more news and features after the Costa Brava sprint…

IMIO wins European Commission prize, donates to the Plone Foundation

Posted by PLONE.ORG on July 06, 2018 06:53 PM


Award and Donation

On March 29, 2018, the European Commission awarded IMIO the €15,000 first prize in the local government category of the Sharing and Reuse Award.

IMIO has generously donated €10,000 of the prize money to the Plone Foundation.

The Sharing and Reuse Award, for interoperable solutions for public administration, businesses and citizens in Europe, recognizes government agencies that have set up and shared IT solutions with broad potential for reuse.

Of the 16 nominated projects, 10 (including IMIO's) are open source.

Governments are able to realize substantial savings and efficiencies when they reuse "cross-functional" components such as authentication systems and electronic invoicing. 

in Sorrento, Italy

IMIO's Statement on Plone

"If IMIO has won the Share and Reuse Award of the European Commission, it is due not only to the support and unconditional collaboration of its members, but also to the innovative aspects of its approach, be it organizational or technical.

This latter element, namely "Plone", is often unknown because the close relationship between IMIO and local governments masks the activity of a host of other private and public actors who created this technology that is the basis for most of IMIO's tools.

However, without them, IMIO would probably not have reached this technological maturity and nor have been able to respond as effectively to the needs of local authorities. Given its limited capabilities, IMIO has not been able to contribute directly to Plone core software. The software is indeed "free": no funds in the form of license fees were spent on this technology. Nevertheless, IMIO contributed to the community in the form of our team's services during international sprints, creation of generic modules, community support (contributions to forums), presentations at conferences, and evangelizing, either directly or through our subcontractors.

The prize money donated by IMIO is a token of appreciation for the hard work of the Plone community and its Foundation, with which we have worked for 11 years. The €10,000 donation will allow the Foundation to continue supporting its activities."

About the Plone Foundation

Plone is 100% funded by sponsorships from forward-thinking organizations and individuals. With the help of these financial contributions, the Plone project has continued to thrive and maintain an astonishing level of activity and innovation for 17 years.

The mission of the Plone Foundation is to protect and promote Plone. Foundation expenses are primarily related to:

  • an ambitious support programme for organizing and attending strategic sprints, conferences and marketing events
  • paying the Plone release manager a travel stipend to evangelize, plus a small stipend for major and minor software releases
  • registration of Plone’s trademark in countries around the world
  • legal work to secure Plone’s intellectual property in the Foundation’s “software conservancy”
  • the development and production of marketing materials
  • provisioning servers for our web sites, community forum, testing and continuous integration processes
  • a stipend to support the Plone marketing/communications team lead's attendance at Plone and related events

In order to continue this work, the Plone Foundation relies on sponsorships to create and sustain a reliable stream of income.

In recent years, we have aggressively supported strategic sprints, which are designated by the Framework Team as being significantly important to the continuing development of Plone. These include projects such as the headless CMS initiative, the porting of Plone to Python 3, the new Pastanaga UI, the integration of Angular and React JavaScript frameworks, and the REST API. Each of these represents important avenues for Plone's future growth, and these have been the primary expenditures of the Foundation, funded by vital sponsorships.

For further information:

Plone Beethoven Sprint 2018 - Sprint Report - Day 3

Posted by kitconcept GmbH on June 30, 2018 06:24 PM
Report of the third day of the Plone Beethoven Sprint 2018 in Bonn, Germany.

The Beethoven Sprint was a “strategic” sprint that took place June 21-25 at the kitconcept office in Bonn, Germany. The focus of the sprint was to work on the Pastanaga editor, Plone-React, plone.restapi, and Guillotina. This is the report of the third day of the sprint.

day3 wrap up all Day three wrap-up meeting at the kitconcept office

UTC DateTime Discussion

After having breakfast and doing a quick stand-up, we started a discussion about how to store datetimes in Plone. This was a discussion that came up when we implemented plone.restapi. Though, this question is more related to As seen many times in the Plone community, when it comes to complex technical matters, offline discussions work way better than discussing issues back and forth via github comments.

Since we had all the experts at the sprint, we decided to schedule a discussion to solve the issue. In the end we reached an agreement that dates should be stored as UTC and that the local time zone should be stored separately in an additional field, for instance to calculate recurring dates.


Thomas Buchberger worked on the workflow endpoint and added a feature to change the workflow state recursively, to set the effective and expiration date and to allow workflow comment.

Lukas Graf finished his work on implementing redirects in based on The redirects do not only work for simple GET requests but also redirects POST, PATCH, und DELETE requests.

Sune Brøndum Wøller finished the portlets endpoint for plone.restapi.

Mikel Larreategi made plone.restapi return cachable image resources to improve the caching of images in plone.restapi.

Roel finally wrote a PLIP for the IPloneSiteRoot and fixed edge cases and a few bugs in the current implementation.


Victor completed his work on plone.schema, allowing to use a JSON field in Plone that validates the JSON structure within the field and also allows through-the-web editing. He also finished the backend behavior for tiles and blocks to store the tiles and the tiles layout on a Plone content object.

Eric Steele added a backend implementation for the add-ons control panel that he wrote for Plone-React. Eric presented a fully working add-ons control panel that allows to install add-ons via Plone-React by the end of the day.

day3 wrap up eric add ons control panel Plone-React add-ons control panel presented by Eric Steele

David completed his work on the vocabularies endpoint by implementing the frontend widgets that rely on those vocabularies to make sure the endpoint serves its purpose.

Davi Lima and Victor continued to work on the override mechanism for Plone-React (JBOT) to customize widgets and views in a config.js file using a babel plugin.

Pastanaga Editor

day3 wrap up rob editor video Rob presenting the new video tile for the Pastanaga editor

As always, Rob did not give us any time to breath and added a YouTube video tile to the Pastanaga Editor, that shows a YouTube video in the editor itself and on the content view.

Of course that wasn’t enough for a day, so he fixed a few other smaller issues and worked on exposing the sitemap.xml via Plone-React.

Dinner and some late night hacking

Dinner Hans im Glueck Dinner at “Hans im Glück”

Rob might not admit it, but after claiming he could fix all those issues mentioned above in one day, he continued to work on the sitemap during our dinner at a local burger restaurant in the inner part of the city. We’ve been there ourselves, so we didn’t mind, while we were enjoying our tasteful cocktails. After a good meal, some drinks, and having to say good by to Eric, we went back to the office.

We said good bye again to our fantastic Dutch Plone-React team Rob and Roel and then went on to hack a little bit more on the stuff we were (and still are) so enthousiastic about.

Plone Beethoven Sprint 2018 - Sprint Report - Day 2

Posted by kitconcept GmbH on June 29, 2018 06:24 PM
Report of the second day of the Plone Beethoven Sprint 2018 in Bonn, Germany.

The Beethoven Sprint was a “strategic” sprint that took place June 21-25 at the kitconcept office in Bonn, Germany. The focus of the sprint was to work on the Pastanaga editor, Plone-React, plone.restapi, and Guillotina. This is the report of the second day of the sprint.


After having breakfast at the office, we started the day with a stand-up/wrap-up meeting with Ramon Navarro Bosch presenting Plone-React running on Guillotina. The user can add new content, edit existing content, and browse the content with Plone-React and Guillotina, which is a huge acomplishment and a promise for the future of Plone. After the stand-up Ramon had to say good bye to the other sprinters and head home to Barcelona.

Pastanaga Editor

Rob Gietema continued his work on the Pastanaga editor. At the end of the day, he was able to present a working version where the user can add a title and a description tile as well as a text tile with inline styles such as bold, italic, headlines, links, and lists.

IMG 6754 6b052ccf7a9ed291599dc6a7047a71cc Pastanaga Editor with basic text editing

Rob also added an image tile that allows you to upload images. The uploaded images then can be aligned left, right, in the middle and in full width or just be deleted.

IMG 6756 abcbc897d406fc882d25dca889402298 Image tile that can be aligned left, right, center and displayed with full width.

Victor Fernandez de Alba finished his work on the tiles backend for the Pastanaga editor (, so Rob could present a fully functional editor that actually stores the content (text and images) in Plone tiles.


Eric Steele continued his work on the add-on control panel and was able to present a first version at the wrap-up at the end of the day.

IMG 6758 144f319424d81d358e6410f2aea3d41f Add-ons control panel written in React by Eric Steele

Carsten Senger worked on implementing the users and groups control panel in Plone-React which now allows to add and delete users.

Victor worked on being able to use Plone-React as a library that allows developers to override React components. The system is supposed to work the same way as JBOT (just-a-bunch-of-templates) works in Plone.

Johannes Raggam and Andrea Cecchi continued their work on the reference widget and were able to present a first prototype. We agreed that we have to put some effort into the UX/UI of that widget, but that was beyond the scope of a sprint and requires the help of a UX specialist.


Thomas Buchberger finished the pull request for the object create order and started to to work on the workflow endpoint enhancements.

David Glick worked on enhancing the vocabularies endpoint with batching and filtering.

Sune Brøndum Wøller fixed some nasty bugs with time freezing and transactions errors in the Plone 5.2 of plone.restapi (e.g.,

Lukas Graf continued his work on the translations of the REST response data, fixed a few bugs and wrote a script that tests the Sphinx-based documentation for warnings and errors and fails the Travis build if there is a problem.

Mikel Larreategi finished the pull request for the history endpoint and documented the Accept-Language headers in plone.restapi. He also started working on making the image scales that plone.restapi returns cachable.

Roel Bruggink continued his quest on the folderish site root and fixed errors in CMFPlone,, and in

We were able to release 1.1.1 and plone.restapi 2.1.0 as well as plone.schema 1.2.0 with a JSON field that is required for the tiles endpoint in plone.restapi.

Hacking Night

Germany was playing at the soccer world cup in the evening, so we decided to order Pizza for dinner and then split up between people that wanted to code and people that wanted to watch the game. As you might have guessed the latter group was rather small. We ended up in a bar because the public viewing was already full. Though I guess the sprinters got a taste of the German soccer culture. After the game we went back to the office to join forces with the others again to wrap up the day and hack the night away.

PloneGov growing in the Basque Country

Posted by CodeSyntax on June 29, 2018 08:11 AM
PloneGov is an international initiative with the goal of getting a powerful on-line eGovernment tool. Most eGovernement needs and requirements are similar and PloneGov wants to satisfy them in a effective and efficient way thanks to its open source project. CodeSyntax is part of PloneGov thanks to its UdalPlone initiative.

Plone Beethoven Sprint 2018 - Sprint Report - Day 1

Posted by kitconcept GmbH on June 28, 2018 06:24 PM
Report of the first day of the Plone Beethoven Sprint 2018 in Bonn, Germany

The Beethoven Sprint was a “strategic” sprint that took place June 21-25 at the kitconcept office in Bonn, Germany. The focus of the sprint was to work on the Pastanaga editor, Plone-React, plone.restapi, and Guillotina. This is the report of the first day of the sprint.


day1 standup Stand-up of the first day

We started the day with a stand-up meeting giving people a heads up on the current state of affairs of plone.restapi, plone-react, and Guillotina.

I started with plone.restapi, which is considered stable and battle tested in production.

Victor Fernandez de Alba then gave a brief introduction to our first Plone-React based project VHS-Ehrenamtsportal, that we successfully shipped to our client a few weeks ago and run without any issues since then.

IMG 4031 565f311943de0d1be7694a4b1c0e79a8 Victor introducing VHS Ehrenamtsportal

After this, Rob Gietema gave a short introduction to the current state of Plone-React.

Last but not least, Ramon Navarro Bosch presented “Guillotina”, an async server written in Python with a Cockroach DB / ElasticSearch backend that adopts some of the core concepts of Zope and Plone.

With a group of 15 sprinters, we decided to split up in four different groups for the main sprint topic. Thomas Buchberger led the plone.restapi group, Rob the Plone-React group, Victor the Pastanaga Editor group, and Ramon the Guillotina group.

Pastanaga Editor

22 06 18 4 Rob Gietema going though the different approaches we discussed during the Tiles planning meeting

Right after the stand-up, we had a longer discussion about the “tiles” endpoint in plone.restapi and the editor implementation in Plone-React. We already reached an agreement of the API design at the Plone-React sprint a few months ago. Though, it turned out that implementing that on top of the existing plone.tiles implementation was harder than we thought and we did not anticipated all the problems that came along with that.

We decided to keep the API design and to write a simple Dexterity behavior that adds a “tiles_layout” field for the layout information and a “tiles” field that holds the actual data of the tiles. Ramon already wrote a JSON-field in the Guillotina code that we decided to re-use for our implementation.

Rob Gietema already wrote a first prototype of the new editor at the Plone-React sprint and he was waiting for the backend code to be implemented. While we were working on the backend implementation, he focused on the prototype.


22 06 18 24 Planning board with plone.restapi issues

Lukas Graf added missing translations in plone.restapi responses and simplified the test setup and did some clean up on the code (

Thomas Buchberger worked on fixing the plone.restapi object creation logic to behave more like through-the-web object creation ( and separated the object creation from firing the events.

Sune Brøndum Wøller cleaned up and upgraded multiple Plone versions in plone.restapi (, worked on portlets and portletmanager serialization and fixed a ReadConflictError in the plone.restapi tests for the documentation that was bugging us for quite some time (

David Glick and me worked on Zope 4 compatibility for and plone.restapi. It turned out that one of my fixes on was already sufficient and that the test failures in plone.restapi were caused by a plone.testing issue that David found and fixed (

Roel Bruggink continued his efforts on turning the Plone site root into a Dexterity object. He worked on making the IPloneSiteRoot interface / content object behave more like content and he attached behaviours to the IPloneSiteRoot to edit them without relying on a default page.

Mikel Larreategi finished his work on the translation of the content-type names on the @types endpoint ( and the translation of the actions and workflow state and transitions on the @history endpoint (


Rob gave an introduction to the Plone-React codebase and explained the basic concepts and libraries that we use in Plone-React.

Eric Steele started to work on creating the add-ons control panel in React. Carsten Senger took over the work that Rob started before the sprint to bring the users and groups control panel to Plone-React.

Andrea Cecchi. and Johannes Raggam worked on the React-based widget for references in Plone.


After giving an introduction to Guillotina to the sprinters, Ramon went ahead and made Plone-React work on top of Guillotina. Since it origins, plone.restapi and Guillotina were supposed to share the same API to allow us to switch the backend for our new frontend at some point in the future. Ramon was also heavily involved in the API design of plone.restapi and wrote the first version of before he decided to invent Guillotina. Over the time both APIs differed because of differences in the underlying implementation.

Ramon and Rob worked on this and by the end of the day they could present a working version that allows basic content editing and browsing.

Roadmap / Plone 6

We had a hangout with Philip Bauer from Munich who is leading the efforts to migrate Plone to Python 3 and Zope 4.

Hangout with Philip Bauer

Philip and I already had a longer discussion about a possible roadmap for Plone 6 and how to bring our efforts on the frontend together with the efforts of the group that works on Python 3 and Zope 4. We discussed the outlined roadmap and the upcoming sprints where we plan the implementation of the roadmap.

Lunch / Dinner / Evening

We went to have lunch in a Vegan cafe (Black Veg) and to a traditional brewery in the old part of the town for dinner (Bierhaus Machold). After dinner and a few drinks, we decided to head back to the office for some late night hacking. Not without stopping by at a local “Kiosk” for some customary buying of beverages for the evening.

World Plone Day 2014: manufacturing internationalization strategy

Posted by CodeSyntax on June 22, 2018 08:47 AM
World Plone Day was last wednesday, april the 30th, and as in previous occasions, we did celebrate it at CodeSyntax's offices, with some customers and Plone users of the Basque Country.

Presenting Buildout at PySS 14

Posted by CodeSyntax on May 29, 2018 01:10 PM
Buildout is a tool we use in all of the development and deployments of our applications, and we have given a talk about it at PySS 14.

Porting Plone to Python 3

Posted by on May 23, 2018 07:26 PM

Since I wrote the proposal to Port Plone to Python 3, so much has happened that a status update is needed.

Let's step back a little: The first steps towards Python 3 were taken during the sprint at the Plone conference in Barcelona. The epic PLIP to update to Zope 4 was merged and we started porting individual packages to Python 3 without being able to run any tests. With the help of sixer and python-modernize we tried to get the most obvious import and syntax issues out of the way. That work was continued at the Alpine City Sprint in Innsbruck and in the end, we treated more than 150 packages like this. Some of this work is documented in the Plone tracker.

Along the way I wrote a best-practice guide on how to port Plone packages this way.

As the PLIP states, there are several approaches to porting Plone to Python 3:

  1. Migrate and test packages that have no dependency to CMFPlone and test them in Python 2 and 3.
  2. Prepare packages for Python 3 without being able to test them in Python 3.
  3. Start up Plone on Python 3 and fix whatever breaks. When start-up works, create a Plone Site and again, fix whatever breaks.
  4. Port plone.testing and to Python 3 and start running tests. Fix what breaks during the setup of the layers.
  5. Run the tests with Python 3 and fix all broken tests.

At the sprint in Innbruck I started with #3 and kept going after the sprint until I was able to create an instance. At the Plone Tagung in Berlin I was able to demo the creation of a site but nothing was rendered yet.

After that, I kept going and I was finally able to create a site and manage content, which is what a CMS is about. It looked a bit raw but I was able to add and edit some content - yay!

early screenshot of plone with python 3

Work continued at an unsteady pace, and with important contributions from Michael Howitz, Alessandro Pisa and David Glick, things started to get better. Even the theme and js started working. Slowly broken features became the exception, not the rule.

Last week at the Zope 4 Welcome Sprint in Halle we removed all feature blockers that we had found so far. Plone with Python 3 looks and feels like it used to in Python 2. During the sprint there was also a lot of progress on:

  • the wsgi setup
  • logging and tracebacks when using wsgi
  • porting plone.testing
  • a new theme for the ZMI
  • beta releases for many packages.

There was also some progress on the difficult issue of database migrations. It seems like zodbupdate is the best tool to do that but there is probably a lot of work ahead.

Read more about the sprints outcome in the blogpost by Michael Howitz.

There is a Jenkins job and as of today, it is running (not passing) tests for all packages (except Archetypes) with Python 3.

At the moment we run 6594 tests from 115 packages with 257 failures and 315 errors - not bad when you keep in mind that we still focus on features, not on tests. Tests for a couple of packages are green, including plone.api which is great since plone.api uses most of our stack one way or another. Jenkins runs every three hours and here you can see the progress over time.

Here is a screenshot from today that shows Plone doing some pretty non-trivial things: Editing a recurring Event and also Richtext with Images and Links:

screenshot today

Next steps:

  • Create a demo site running on Python 3 that people can use to find broken features. This will happen at the Plonator Sprint in Munich.
  • Fix all tests that look like they fail because of a broken feature.
  • Fix all remaining tests to pass in Python 2 and Python 3. Since there are a gazillion doctests that will take some time.
  • Port to python 3 and fix robottests.
  • Experiment with porting a ZODB with Plone to Python 3.

If you want to participate you can simply look at the failing tests and start fixing them. You can also try to fix one of the open issues.
The setup of a coredev environment with Python 3 is really simple and documented.

Rural Sprinting: Two New Plone Add-ons and Progress on Python 3

Posted by Jazkarta Blog on May 17, 2018 06:56 PM

Jazkarta Team

We returned to my house in rural Massachusetts for our annual sprint this year and had a great time sampling local beers and ciders,

Buying supplies for the sprint

eating big meals together,

Making pizzas at the sprint

admiring the Milky Way,

Nightime view at Sally's house

and working on some fun projects. Normally we work remotely – everyone in their own home office, spread across 3 countries and 2 continents. But it’s really nice to get together in person, and we try to do it once a year.

Here’s what we worked on.

Witek and Alec created 2 new Plone add-ons and released them to Pypi.

  • jazkarta.abtesttile Provides a new Mosaic tile type that can be used for A/B testing parts of a page layout. Managers can define 2 rich text fields on one tile, and a ratio for how often each should be displayed (for example, 70%/30% or 50%/50%). Plone will randomly show users one field or the other in that ratio. Managers can optionally specify Javascript snippets for use in analytics tracking. Managers can also optionally enable a query string variable, which is added in the rendered HTML to links in the rich text fields. This will indicate whether option A’s or B’s rich text was the source of a page visit. A custom permission allows usage of the add-on to be restricted to privileged users.
  • collective.siteimprove Provides integration with There is a control panel for requesting and saving a token that registers the domain with Siteimprove. (You must first sign up for a Siteimprove account.) A Siteimprove button is shown to authorized users on all default views. Publicly visible content shows authorized users a Siteimprove recheck action in the Plone toolbar that checks the individual page. This add-on is essentially done but untested since we have not yet met with the Siteimprove sales person who will provide an account for us to test with. We hope to be able to do that next week.

David, Matthew and Jesse decided to contribute to the ongoing effort to port Plone – Python’s open source enterprise CMS – to Python 3. They were in the porting groove because we recently ported our Dallinger project to Python 3. They made some good progress:

  • David made it possible to run Plone tests without including Archetypes, so that developers can run the tests in Python 3 without worrying about porting Plone’s old content type system. After that he investigated why cookies on Python 3 are preventing logins from staying logged in. He traced it to PAS and create a branch with all tests passing on both Python 2 and 3. Hopefully it will get merged during the Halle sprint this week.
  • Matthew found and fixed some Chameleon problems. This included an old error that had nothing to do with Python 3 where Chameleon puts spurious context into error messages. He also converted plone.namedfile to Python 3 and fixed some tests in plone.protect (CSRF protection). His work resulted in a fairly large pull request, which was approved and merged.
  • Jesse got all tests running for and made a bit of progress on the test failures for

Thanks to all these fixes, we got to the point of being able to save a Plone page on Python 3 and it “sort of” works. (At least it didn’t give an error!)

David also did some evaluation of plone-react with Nate. This is a React-based front-end for Plone that is built on plone.restapi. It’s in early stages of development but looks promising. In the process, Nate ran into a bug in Plone’s unified installer, tested it in Plone 5.1.2 and and filed a ticket for it. Back to his Plone roots!

Plone Goes To Pycon

Posted by Jazkarta Blog on May 15, 2018 05:56 PM

Plone booth at Pycon

I’ve just returned from Pycon where I had a great time staffing the Plone Foundation’s booth. It was fun to see old friends and introduce new people to Plone, Python’s open source, enterprise-grade content management system. Pycon attendees are wonderfully friendly and curious, always interested in learning new things. The venue – Cleveland’s downtown convention center – was lovely and the rain mostly held off. We gave away dozens and dozens of Plone-branded neck pillows and water bottles and multi-tools and pins and magnets, not to mention blue M&Ms arranged in the shape of the Plone logo. I arrived with 2 suitcases full of swag and left with 2 empties. Thanks to Witek and Nate from Jazkarta and to Chrissy, Anthony and Carol from Six Feet Up for helping set up and run the booth, and to the Plone Foundation for sponsoring Pycon. Open source rocks!

Plone Welcomes Students for Google Summer of Code 2018

Posted by PLONE.ORG on May 03, 2018 08:07 PM

For 2018, the Plone Foundation has been granted four Google Summer of Code student project slots.

Google Summer of Code is a global program focused on bringing more student developers into open source software development. Students work with an open source organization on a 3 month programming project during their break from school.

After careful selection of the many project proposals presented, we are pleased to announce that the following students will be working on various aspects of Plone:

  • Shriyansh Agrawal (IFTTT plugin for Plone)
  • Akshay (Command Line Plone Tools)
  • Ajay NS (GatsbyJS Integration with Plone)
  • Nilesh Gulia (Create-React-App for Plone-React)

Read more about their projects

To our new students: welcome to the Plone community – we wish you a great learning experience over the coming summer. Congratulations!

Mentoring these students will be:

  • Timo Stollenwerk (former Plone GSoC student!)
  • Rob Gietema
  • Victor Fernandez de Alba
  • Asko Soukka
  • Andrea Cecchi
  • Paul Roeland
  • Alexander Loechel
  • Maik Derstappen
  • Encolpe Degoute
  • Nejc Zupan (former Plone GSoC student!)
  • Sally Kleinfeldt
  • T. Kim Nguyen

To our mentors: thank you for introducing new developers to open source and our community!

Plone-React Sprint Bonn 2018

Posted by kitconcept GmbH on April 23, 2018 04:46 PM

From March 12th to 15th, we hosted a Plone-React sprint at our office in Bonn. The main goal of this three day sprint was to contribute back the work we did for a recent client project. We also planned to upgrade Plone-React to React 16 and improving the error handling.

A small and very focused sprint with the core contributors of Plone-React was the perfect opportunity to do so. Participants were Rob Gietema, Roel Bruggink, Asko Soukka, Victor Fernandez de Alba, Carsten Senger and me.

Sprint Day 1

We started the first day of the sprint by doing a quick stand up and planning meeting. We used the days before the sprint to outline our main goals and objectives, so we could get started right away.

IMG 2572 725ac0c3d0acdf94e31efebb6c23f318 Planning board after the stand up

React 16

On the first day Rob and Victor worked on upgrading plone-react to use React 16 and Webpack 4.

We postponed the upgrade to React router version 4, because some of the dependencies that we need, are still in alpha phase and staying with the old version does not hurt right now.

IMG 2576 4ffa46024dfcc49456d639f9059e5581 Card to upgrade to React 16

Error Boundaries

The main reason why we were eager to upgrade to React 16, was a new feature called “error boundaries”, which allows catching errors in React components and handle them gracefully, without failing the entire app.

Victor implemented error boundaries for client and server side components and for the Redux middleware. It is also possible to pass those errors to Sentry for aggregation and further error handling.

Since we are about to launch our first Plone-React-based project in the next weeks, this was something that was especially important for us.

IMG 2580 d0283e182b2c866ad960a1d3c3a44de3 Error message in plone-react

Token Expiration Middleware

Rob added a token expiration middleware to plone-react that improves the handling of JWT auth token in Plone-React. Working with plone-react on a daily basis revealed a few edge cases where the current authentication failed. The new middleware solves those issues.


Roel and Carsten focused on plone.restapi. Even though this was not planned to be a major topic for the sprint, we had to fix some issues that were causing troubles in the Plone-React frontend.

Carsten worked on fixing an issue that was preventing to allow the API consumer to reset field values to “None”.

Roel started to work on exposing widgets with tagged values via plone.restapi. This is necessary to support autocomplete or reference widgets in Plone-React.

Test Setup

Asko, who joined the sprint remotely, worked on a brand new end-to-end testing setup with Robot Framework. Because this would be way to easy for a super-smart guy like Asko, he decided to wrap the components into a Docker containers, to make it easier for non-Python devs to set it up. Making Plone PIP-installable is also something that we want to have for quite a while. Asko decided to also mix that in. To make this fun, he decided to add support for Jupyter notebook, which makes it super easy to write Robot Framework tests.

IMG 2579 7764cc8777f896ebb057573f308488c1 Hangout with Asko

I started the day discussing the acceptance testing setup with Asko, quietly listening to Rob and Victor and discussing the plone.restapi issues with Roel and Carsten.

Pastanaga Toolbar

During the first day, we started a discussion how plone.restapi could support a toolbar that automatically adapts to the permissions of the logged in users and shows only the actions that this particular user has permission for.

Before the sprint Victor worked on implementing the new super fancy adaptable Pastanaga toolbar, and we were eager to build a proper backend implementation for this.

Victor's tweet with a short demo of the new Pastanaga toolbar

Sprint Day 2


On the second day of the sprint, Rob and Victor started to look into building a “create-react-app”-like functionality for Plone-React. create-react-app is a widely popular code skeleton generator by the React team at Facebook. It hides lots of complexity from the user (e.g. Webpack, libraries, configuration) and makes it easy to get started with React. This is super important for the adoption of Plone-React because it also allows to use Plone-React as a library and basis for custom client projects.

Rob and Victor created a proof-of-concept that kind of works but it became clear that this requires a lot more effort before this becomes ready-to-use.

Pastanaga Editor

We scheduled a time slot for a discussion and planning session about the new “Pastanaga editor” user experience. We already implemented basic text editing based on the DraftJS editor from Facebook. The current editor allows basic text editing as well as inline (italic, bold, etc.) and block styles (e.g. headlines, bullet points) and external links.

The next step on our agenda to make this editor based on Tiles to make it extendable and allow the user to add images, videos and other media objects.

We agreed on moving forward with an agile approach of building something useful step-by-step, making sure to build a fully functional and useful editor at any point of the development stage, rather than building the full Mosaic-like functionality at once.

Right after this was settled, we started to draft a tiles endpoint that would build the basis for the next iteration of the Pastanaga editor.


Rob started to work on implementing the context-aware toolbar. This was a challenge because the toolbar needs to adapt to the content that is shown in the main column. This means a component deep down the component hierarchy (content) needs to be able to update a component that lives outside of the DOM hierarchy of the parent component. Luckily for us, “Portals” in React support exactly that use case.

Victor worked on the flexbox styling of the toolbar as well as on optimizations of the Webpack configuration.

plone.restapi, Tiles, and Testing

Roel and Carsten continued to work on plone.restapi issues. Roel continued to work on the tagged values representations and Carsten finished the actions endpoint for the context-aware toolbar.

I followed our established documentation-first approach on plone.restapi and wrote the docs for the new tiles endpoint.

With the basic test setup already in place, Asko struggled with the Travis CI setup running different versions of Node and Python at the same time. Problem is that the ZEO version requires the latest Python 2.7.13 which is not shipped by default with Travis CI.

He also worked on a Docker compose option to support an option to run the API server. This would allow faster development of Robot Framework tests since the API server does not need to restart for each test (iteration).

Sprint Day Three

We started the last day of our sprint discussing the create-react-app use case we worked on the day before. Afterwards, we did a hangout with a student who is interested in working on this during the Google Summer of Code 2018.

IMG 2583 f900eaa919019cf508c8a20e6313de48 Hangout with a possible Google Summer of Code student

Right after this call, Asko gave me a tour of the new, Docker compose based, PIP-installable, Jupyter notebook enhanced test setup.

My head was still spinning from Asko’s amazing work, when Rob asked me for a minute to show me a prototype of the new Medium-like Pastanaga editor.


The sprint was extremely productive and fun. Having a small and dedicated group of developers with a clear goal and focus really worked well for us.

IMG 6425 1 Group photo in front of the kitconcept office

We contributed back all our re-usable code from our client project, upgraded Plone-React to React 16. We fixed some important issues in plone.restapi and build a super fancy test setup that will allow us to further improve the software quality of Plone-React.

We also laid the groundwork for the next important steps forward: Building the new Pastanaga editor with a tiles-based backend and allowing to use Plone-React as an extensible library with a “create-react-app”-like functionality.

We are already looking forward to the upcoming Beethoven Sprint and the Costa Brava sprint where we will continue to push Plone-React, Pastanaga and plone.restapi.

Plone 5.1 Has Been Released

Posted by PLONE.ORG on March 08, 2018 02:48 AM

As with all Plone minor version releases, 5.1 includes many bug fixes and under-the-hood improvements, with a modest selection of enhancements visible to users, editors, and site administrators.

Plone 5.1 contains these user-facing improvements:

  • Plone pages load faster now with better bundling of JavaScript and CSS resources
  • Plone’s built in search indexing is much faster and CPU-efficient
  • Plone supports the display of higher resolution HiDPI (“Retina”) images

Content editors and site administrators will find these enhancements:

  • Site administrators can create, edit, and manage portal actions (menu items and links) through a new control panel
  • Direct linking to groups’ details from the Sharing tab
  • New configuration registry control panel lets site administrators export, import, and add new records
  • Improved HTML filtering for preventing malicious HTML
  • Fine grained control over thumbnail images in portlets and display views
  • Support for image rotation metadata: the image will show up with the rotation that the photographer intended
  • The default order of search results is now configurable

Plone 5.1 also includes these developer-oriented changes:

  • Ability to conditionally import configuration registry records (by checking on the presence or not of specific features and Plone versions)
  • Removal of OpenID login support from Plone core
  • Removal of the old portal_quickinstaller (may be a breaking change for add-on developers)

To get Plone 5.1, please visit the downloads page

For help using or upgrading to Plone 5.1, see the support page


Photo by Airman 1st class Alex Echols

The Mountaineers Keep Climbing

Posted by Jazkarta Blog on February 22, 2018 04:40 PM

The Mountaineers' Website's New Look

Some non-profits fund raise for major technology upgrades, then breathe a sigh of relief and ignore technology until things start breaking. Rinse and repeat. Other non-profits avoid this feast-or-famine approach to technology spending by budgeting for continuous improvements. The Mountaineers is in the latter camp. In 2014 they completed a major technology upgrade and launched a new Plone+Salesforce website. Every year since, they have budgeted for significant improvements to their website and its back end. They did this through modest support contracts with their technology partners (Jazkarta and Percolator Consulting), plus focused spikes of work that were done through a series of agile iterations. Over the last 3 years we have released enhanced versions of the website 10 times, with an overwhelming number of improvements – you can read all about that on their technology blog. These changes have allowed members, staff, volunteers, instructors, and the organization to get better and better at what they do.

The latest update is the biggest one yet. It has brought and together into one, integrated website. The new and improved header and main navigation helps users know where they are and get to where they’re going. It looks great! We’re really proud to have helped bring it into the world.


Plone Selected for 2018 Google Summer of Code

Posted by PLONE.ORG on February 17, 2018 09:43 PM

Plone, the secure, enterprise-scale Python web content management system, is one of the organizations that have been selected for the 2018 Google Summer of Code (GSoC).

GSoC is a global program focused on bringing more student developers into open source software development. Students work with an open source organization on a 3 month programming project during their break from school.

Organizations are selected on the basis of their application, which takes the form of a proposal based either on a student’s own idea or one selected from a list compiled by Plone. Proposals are judged on their utility to Plone, depth of planning and likelihood to succeed.

Cris Ewing, the main organizer behind our GSoC 2017 programme, reprises his role as Plone’s GSoC administrator for 2018. Cris is a former Plone Foundation Board member and co-organizer of the 2016 Boston Plone Conference.

Student developers interested in submitting a GSoC proposal to the Plone Foundation should read the introductory information about Summer of Code at and take a look at Plone’s ideas list at Applications open on March 12, 2018, but students are welcome to get in touch before then in our forum at for feedback on their ideas.

For more information


Three New Members Join the Plone Foundation

Posted by PLONE.ORG on February 17, 2018 02:23 PM

The Plone Foundation welcomes 3 new members after unanimous confirmation by the Foundation's Board of Directors on February 8, 2018. Membership in the Foundation is conferred for significant and enduring contributions to the Plone project and community. The Plone Foundation Membership Committee overwhelmingly recommended each applicant for their ongoing contributions to Plone.

Sven Strack

Sven Strack

Sven has given talks and training at several Plone conferences, was the organizer of the Stroopwafel sprint, the creator of Plone Docker images and of the UI installer. He is best known as Plone's documentation czar, having led the Documentation Team for years with verve. His most recent new responsibilities in the Admin and Infrastructure Team have already resulted in the move of critical Foundation servers to new, more reliable facilities.

David Bain

David Bain

David first presented at the 2008 Plone conference and hasn't stopped giving conference talks and training since then. He is a steadfast advocate for Plone, Python, and Jamaica, having organized Plone meetups and Python events in Jamaica, including PyCon Jamaica. David regularly engages with newcomers and old timers alike in our forum, and has been a key member of Plone's Google Summer of Code participation. David's continuously innovative spirit has resulted in new code and new ways of thinking, particularly in the areas of approachability and onboarding.

Franco Pellegrini

franco pellegrini

Franco first burst onto the public Plone scene with his mind-blowing creation, the PloneIDE. He has authored and contributed at least a dozen add-ons, including the popular collective.cover, is a member of the Framework Team, and a contributor to Plone core and the Mockup project. He has given talks and trainings at Plone symposia, conferences, and local events since 2010.



The Foundation is the trustee for Plone's intellectual property, works to protect and promote Plone, and has 78 active members.

Random News And Updates

Posted by TestTheDocs on February 11, 2018 12:32 PM
Docs We are happy to announce that is back ! For the moment there is not much to see, we are starting slowly to add more and more content ! Contribute Also, we are looking for contributions !!! We would like to see more content about testing, tools, tip and tricks, etc, etc !!! Future Planning We are playing with a new way of testing, building and deploying our docs.

Plone News Roundup, February 2018

Posted by PLONE.ORG on February 03, 2018 09:24 PM

Welcome to 2018! Plone has continued its flurry of activity since our wonderful conference in Barcelona last October...

Phew! If we missed something, please let us know!

RoboCon 2018 and Robot Framework Jupyter support

Posted by Asko Soukka on January 27, 2018 06:48 PM

It's already over a week since I got back home from the first Robot Framework conference ever – RoboCon 2018. It was a pleasure to be there, and I really feel privileged that I was accepted there as a speaker.

My RoboCon 2018

RoboCon 2018 was a single day conference about Robot Framework test automation ecosystem, held in the heart of Helsinki, Finland, on 18th of January 2018. The conference venue was quite if not completely full, so there must have been around 250 participants. The event was in English and had pretty good international participation. Yet, most of the participants came from Finland, where Robot Framework has become de-facto standard for test automation.

Pekka Klärck presenting the history, present and future of Robot Framework

RoboCon 2018 had only a single track, so that had to be packed to include something for everyone in its diverse audience. In addition, there was plenty of time and a separate space for networking with the other participants and conference sponsors. There was also organized social program before and after the conference, but unfortunately, I was unable to attend those at this time.

In my opinion the program was well balanced: The conference started with introductory talks, continued with variety of differnet case studies (Kone, Plone and Texas Instruments), and ended with more technical talks about specific Robot Framework addons (SeleniumLibrary, the most awesome new REST library and pabot). And in the middle of everything, there was my personal favorite: Ed Manlove's talk about building successful open source communities. My presentation was called Robot Framework in Plone CMS Project: a case study, story and some technical details, how Robot Framework got successfully adopted in distributed open source community behind Plone.

The most important part of this conference, of course, was getting a lot of Robot Framework users and developers to meet in the same place at the same time. After all, RoboCon 2018 was the first Robot Framework conference ever. My personal absolute highlight during the conference was meeting a former Plonista, Ed Manlove. He was the one who first introduced me to Selenium testing in San Francisco Plone Conference in 2011, and whom I had not seen after that. Until now. I really hope takes less than seven yeras to see him again...

Ed Manlove presenting his talk: The Importance of Open Source Communities

Jupyter kernel for Robot Framework

After the conference on Thursday came the single day conference sprint on Friday. And if the conference was a success, the sprint was even more so: the sprint venue, three large office rooms, was packed full of sprinters, many of them participating their first open source sprint (and got a good introduction to open source development from Ed).

The sprint facilities were provided by Eficode

Because I had to leave early in Friday, I had planned a very specific sprint goal for myself: a MVP Robot Framework kernel for Jupyter notebook.

Jupyter notebook (previously known as IPython notebook) is an open-source web application for creating and sharing documents that contain live code, equations, visualizations and narrative text. The architecture behind Jupyter notebook separates the notebook application from its language specific ”kernels” that are responsible for executing the code in notebooks. Syntax highlighting in notebooks, on the other hand, is provided by CodeMirrorproject for the interactive frontend, and Pygments for server side generated highlighting.

I'm happy to say that I made it. And the more I use it, the more confident I get on that Jupyter makes a great platform for learning also Robot Framework. And not only for learning by yourself, but also for sharing your notes with others.

Check my example notebooks to judge the kernel by yourself.

Please, note that while these examples are static renderings at, they can be opened and interacted live in any running Jupyter notebook with the new kernel and required Python packages. See the repository for more details.

The main Jupyter Robot Framework support features shown in those examplesare:

  • Support for defining and executing Robot Framework test suite cumulatively step by step in successive notebook cells. The main limitation is that each cell should start with a test suite section header (settings, variables, keywords or test suites) even when the same header was already defined in some cell before.
  • HTML log and report files are linked below the executed cells containing the tests. Both files are actually bundled with the notebook in a way that sharing the notebook also shares the log and report files.
  • Images generated during test execution are shown below the executed cells generating the images. Similarly to HTML logs and reports also images are bundled with the notebook for sharing.
  • Support for %%python module LibaryName ”cell magic” to allow defining custom Robot Framework keyword libraries in Python in fly. Once thell cell with a Python library class definition is executed, it can be imported in a successive Robot Framework code cell.
  • Syntax highlighting. But, unfortunately, until the CodeMirror plugin derived from brackets-robotframework-project is accepted into upstream, it must be manually patched into CodeMirror version shipped with Jupyter notebook-distribution. (I have not yet submitted a pull for it.)
  • If the last keyword of the last test case in the executed cell returns JSON string, it is rendered as cell execution output. I added this quite specific feature to make it more fun to learn RESTinstance library with Jupyter (Output keyword of RESTinstance library returns JSON).

Obviously, while the current versions is already fully functional on Python 3, there's still a lot of work (QA, packaging and Python 2 support) left to polish the code for release. I'm looking forward to finish it during the spring.

Happy hacking! And hopefully see you in RoboCon next year – or whenever it is organized and I'll manage to participate it for the next time! :)

Pastanaga icon system

Posted by kitconcept GmbH on January 25, 2018 07:24 PM

The way we deal with icons in the web has evolved over the years. Images, images sprites, fonts, SVG, SVG sprites… I’ve been looking lately for the current best practice in order to include it in Pastanaga and I wanted to share with you my results. Please note that it’s not closed and I’m open to suggestions. PRs are welcome too!

Abandon font-based systems

It was clear to me that font-based icon systems are a no longer an option today. For several reasons:

  • The font is loaded every single time on the page, regardless if we use all the icons or none of them. This bloats the application size and forces an additional request (in the best case scenario).
  • An existing font is difficult to create, maintain and update. You can use some online (free) services to do that and even you can forge your custom icon font with them but it’s cumbersome and not practical.
  • Forces you to maintain a parallel CSS that maps the icon name with its actual character in the font (which is obscure). The font creation tool helps you with that, but…
  • Extending them with new icons is also complex, especially for newbies, and you need access to the source and reload the source in the same tool that was created.

only to name a few.

Time to move on: inlining SVG

The rise of SVG in modern web developing is for a good reason:

  • SVG is a vector format, so it looks great in HiDPI displays
  • It’s lightweight and portable, since it’s not a binary file
  • It can be styled (and animated) easily using CSS (provided they are inlined, not used with the <img /> tag
  • You can control it via JS

My initial feeling was that using a SVG sprite based system would be the best approach, but I soon was discouraged, after reading to Chris Coyier, CSSTricks: A Pretty Good SVG Icon System

All in to inlining SVGs, then.

So, we need an SVG icon system. Luckily for us, Pastanaga already has a complete set of icons based on SVG organized in one file per icon.


Our main goal is to provide inline SVGs in our applications, having in mind:

  • It should be performant and small in size
  • Only the used icons should be loaded in the given view, compatible with lazy loading
  • Has to be a no-brainer and clutter-less from the developer point of view
  • You should be able to extend (or override) the default icon set with your own icons easily
  • Valid for all modern frameworks, with focus on Angular and React

Harnessing the power of Webpack and modern JS

As developers we want to use the tooling that we have at our hands in the best possible way. So our icon system should use simple ES6/7/* and TypeScript conventions.

import myIcon from './icons/my-nice-icon.svg';
import Icon from './components/Icon';

and the from JSX:

<Icon name={myIcon} />

or angular template:

<Icon [name]="myIcon"></icon>


<div icon [name]="myIcon"></div>

Deconstructing the SVG and put it back together again

According to all the use cases shown in this interesting article by Amelia Bellamy-Royds in CSSTricks: How to Scale SVG the most sensible approach when inlining SVGs is to simply just set the viewBox on your <svg> tag, and set one of height or width to auto. The browser will adjust it so that the overall aspect ratio matches the viewBox. As Amelia points out, that would work for all modern browsers back until 2014. If we have to support older ones, we will need to apply for those the famous padding-bottom hack. Let’s keep things simple for now.

Let’s assume that our SVG is not perfect, and we want to have the all the flexibility that a modern browser can achieve handling SVGs. We will take the existing SVG, deconstruct it and get all the SVG attributes, then the content. We will then put it all together in our components, exactly the way we want it.

The Webpack part

We can accomplish all our goals by using a Webpack loaders combo for loading SVG:

    test: /\.svg$/,
    include: path.join(paths.appSrc, 'icons'),
    use: [
        loader: 'svg-loader',
        loader: 'svgo-loader',
        options: {
            plugins: [
            { removeTitle: true },
            { convertPathData: false },
            { removeUselessStrokeAndFill: true },
            { removeViewBox: false },

We will use svg-loader a super simple inline svg loader that provides you extra flexibility when handling your SVG. Initially I tried the popular Webpack Team’s svg-inline-loader but it was not that flexible at the end. svg-loader returns an object with the contents and the attributes of the svg separatedly that we can later manipulate in our components. We are also filtering the SVG using the well known SVGO utility svgo-loader, we can extend or add more filtering options to optimize our SVGs thanks to it.

We are also restricting this loader to the icons folder, just in case we are handling the other SVGs in our app differently, but of course, you can use it for all SVGs removing the include key.


Make it work in React is very straight forward. We need to add the loader to our Webpack config, then add an icons folder and the Icon component.

import React from 'react';
import PropTypes from 'prop-types';

const defaultSize = '100%';

const Icon = ({ name, size, color }) => (
    style={{ height: size, width: 'auto', fill: color }}
    dangerouslySetInnerHTML={{ __html: name.content }}

Icon.propTypes = {
  name: PropTypes.shape({
    xmlns: PropTypes.string,
    viewBox: PropTypes.string,
    content: PropTypes.string,
  size: PropTypes.string,
  color: PropTypes.string,

Icon.defaultProps = {
  size: defaultSize,
  color: null,

export default Icon;

That’s it. Our React component takes as props: the name of the imported module of the SVG, the size, and the color. If not given, the SVG will inherit the fill color set in the parent element (or itself). Also, if not specified, the SVG will scale to the parent container height.

Take a look into the JSX of the example

<div style={{ height: '100px' }}>
    <Icon name={Add} />
<Icon name={Add} size="45px" />
<Icon name={Add} size="45px" color="red" />
<Icon name={Plone} size="60px" color="#1782BE" />
<Icon name={Guillotina} size="60px" color="#EC5528" />


For the angular icon component we needed the same recipe for the Webpack config and this icon component.

import {
    ChangeDetectionStrategy } from '@angular/core';

import { DomSanitizer, SafeHtml } from '@angular/platform-browser';
import { OnInit } from '@angular/core';

const defaultSize = '100%';

  // tslint:disable-next-line:component-selector
  selector: '[icon], icon',
  template: `
  encapsulation: ViewEncapsulation.None,
  changeDetection: ChangeDetectionStrategy.OnPush
export class IconComponent implements OnInit {

  constructor(private sanitizer: DomSanitizer) {}

  svgContent: SafeHtml;
  defaultSize = defaultSize;
  height: string;

  @Input() color: string;
  @Input() size: string;
  @Input() name;

  ngOnInit() {
    this.svgContent = this.sanitizer.bypassSecurityTrustHtml(;
    this.height = this.size ? this.size : defaultSize;


We also use the same approach using the component, the Angular template way:

<div icon [name]="Add"></div>
<div icon [name]="Add" color="green"></div>
<icon [name]="Add" color="red" size="45px"></icon>
<icon [name]="Plone" color="#1782BE" size="60px"></icon>
<icon [name]="Guillotina" color="#EC5528" size="60px"></icon>

Our Angular component takes the same three properties as the React one.

In addition, Typescript forces us to overcome some tiny things.


In order to be able to import the SVG as a module, we need to add this typing to our app:

declare module "*.svg" {
  const content: any;
  export default content;

Add the imported SVG object as a Class member

The Angular template won’t be able to use it if the imported SVG object is not a Class member, like:

import { Component } from '@angular/core';
import Add from '../icons/add.svg';
import Plone from '../icons/plone.svg';
import Guillotina from '../icons/guillotina.svg';

  selector: 'app-root',
  templateUrl: './app.component.html',
  styleUrls: ['./app.component.css']
export class AppComponent {
  Add = Add;
  Plone = Plone;
  Guillotina = Guillotina;


While there are other approaches out there like the Icon component that @angular/material has, they all feel to me like too much and all of them are bloated with lots of options that we don’t really need. I’d like to use a more lightweight and approachable solution like the exposed here that only does what we really need. At the end, it’s not rocket science.

If you have any suggestion, please contact me or open an issue on Github. PRs are welcome!

collective.recipe.backup version 4

Posted by Maurits van Rees on January 25, 2018 12:48 PM

Since the end of 2017, there is a new version 4.0 of collective.recipe.backup. There are lots of changes since version 3.1. Let's see some of the highlights.

Safety and exactness of restore

  • When restoring, first run checks for all filestorages and blobstorages. When one of the backups is missing, we quit with an error. This avoids restoring a filestorage and then getting into trouble due to a missing blobstorage backup.
  • When restoring to a specific date, find the first blob backup at or before the specified date. Otherwise fail. The repozo script does the same. We used to pick the first blob backup after the specified date, because we assumed that the user would specify the exact date that is in the filestorage backup. Note that the timestamp of the filestorage and blobstorage backups may be a few seconds or minutes apart. So now the user should pick the date of the blob backup or slightly later. This date will give the same result with 3.1 and 4.0. But: when you use the new blob_timestamps == true option, these dates are the same.

Blob timestamps

  • Added blob_timestamps option. Default is false. By default we create blobstorage.0. The next time, we rotate this to blobstorage.1 and create a new blobstorage.0. With blob_timestamps = true, we create stable directory names that we do not rotate. They get a timestamp, just like the repozo backup. For example: blobstorage.1972-12-25-01-02-03.
  • When backing up a blobstorage, use the timestamp of the latest filestorage backup. If a blob backup with that name is already there, then there were no database changes, so we do not make a backup.
  • Automatically remove old blobs backups that have no corresponding filestorage backup. We compare the timestamp of the oldest filestorage backup with the timestamps of the blob backups. This can be the name, if you use blob_timestamps = true, or the modification date of the blob backup. This means that the keep_blob_days option is ignored, unless you use only_blobs = true.
  • Note: it is fine to switch to blob_timestamps even when you already have 'old' backups. Restoring those will still work.
  • blob_timestamps = true may become the new default later (maybe 4.1). This may even become the only valid value later (maybe 5.0), removing the creation of blobstorage.0. This would simplify the code. If you don't like this, please speak up and create an issue.

Archiving and compressing blobs

  • Renamed gzip_blob option to archive_blob. Kept the old name as alias for backwards compatibility. This makes room for letting this create an archive without zipping it.
  • Added compress_blob option. Default is false. This is only used when the archive_blob option is true. When switched on, it will compress the archive, resulting in a .tar.gz instead of a tar file. When restoring, we always look for both compressed and normal archives. We used to always compress them, but in most cases it hardly decreases the size and it takes a long time anyway. I have seen archiving take 15 seconds, and compressing take an additional 45 seconds. The result was an archive of 5.0 GB instead of 5.1 GB.
  • Note that with both archive_blob and blob_timestamps set to true, you get filenames like blobstorage.1972-12-25-01-02-03.tar.
  • Added incremental_blobs option. This creates tarballs with only the changes compared to the previous blob backups. This option is ignored when the archive_blob option is false.


  • No longer create the fullbackup script by default. You can still enable it by setting enable_fullbackup to true.
  • Added Python 3 support. The integration with plone.recipe.zope2instance is not tested there, because there is no Python 3 compatible release of it yet.


  • In most cases you can simply use the new version without changes.
  • Adding blob_timestamps = true is highly recommended. If you do this, you can remove the keep_blob_days option, unless you use only_blobs = true.
  • If you want the fullbackup script, enable it by setting enable_fullbackup to true.
  • When you used the gzip_blob option, you should rename this to archive_blob. Maybe enable the compress_blob option, but you are probably better off without this.

plone.restapi 1.0.0 released - A Story of Successful Open Source Collaboration

Posted by kitconcept GmbH on January 19, 2018 07:24 PM

After more than three years of development and 25 alpha and one beta release, we are very happy and proud to announce the release of plone.restapi 1.0.0.

plone.restapi is a RESTful hypermedia API for the Plone Open Source Content Management System. It exposes the unique and powerful features of Plone, including the core content management features as well as dynamic content type creation, workflows, permissions, versioning and more.

plone.restapi builds a bridge between a stable and mature Open Source CMS that has been around for more than 15 years and modern state-of-the-art JavaScript-based solutions like React, Angular, Vue and others.

A Little Bit of History

PLOG 2014

The development of plone.restapi started in beautiful Sorrento, Italy at the Plone Open Garden in 2014 after I gave a talk about building an AngularJS application on top of Plone.


A long discussion with Simone Deponti under the Italian sun, about REST API design principles and hypermedia (of course), led to the first commit and the development of a first proof-of-concept implementation. and PLOG 2015

One year later we gathered in Sorrento again. Laurence Rowe, Ramon Navarro Bosch and I spent our days and nights discussing the details of the REST API design and drafted multiple endpoints.


One of the main obstacles to building a RESTful API on top of Plone was the missing ZPublisher support for HTTP verbs such as PATCH, PUT or DELETE. In 2015, I sat together with Ramon Navarro Bosch in Sorrento (again) and we (he really did all the heavy lifting) started to build, a small package that adds support for HTTP verbs to Plone.

Archetypes and Serializers

We never planned to support Archetypes in plone.restapi. Though, when Thomas Buchberger and Lukas Graf came along and offered to build it, we did not object (of course not, this is Open Source). Their company 4teamwork planned to build a REST api on top of Plone for their OneGov GEVER platform.

Instead of building something on their own, they decided to join forces and share their work and code with the community. Along the way, they heavily refactored the code, added tons of adapters for loose coupling and the ability to customize the JSON serialization.

After this, we were confident to do a first alpha release of plone.restapi on June 14th 2016.

Beethoven Sprint

In March 2017, fourteen Plone developers from eight different countries gathered in Bonn, at the kitconcept office, for the Beethoven Sprint to work on plone.restapi and related topics. In addition to sorting out the last remaining design decision, many exciting new projects were started and announced.



At the Beethoven sprint, Eric Brehault started to work on an Angular SDK for plone.restapi. A release followed soon and Eric gave a very successful and crowded training at the Plone Conference 2017 in Barcelona.

Today, Angular SDK is a mature package for Angular 2 that makes it really easy for front-end developers to interact with Plone and a fantastic starting point for newbies.

Eric and I mentored Noel Varghese during last year’s Google Summer of Code to build a Progressive Web App for Plone in Angular 2. Noel gave a nice presentation of his successful project at the Plone Conference in Barcelona.


Rob Gietema and Roel Bruggink started to build a React-based front-end on top of plone.restapi at the Beethoven sprint in Bonn. Later that year, they went to Toulouse in September 2017 to implement the Pastanaga CSS together with the Plone Angular team.

In November they visited Bonn again for the Pastanaga Sprint where we started to implement the new Pastanaga UI for plone-react.


At kitconcept, we started to use plone-react with Pastanaga for an ongoing project. We can’t wait to release our work and contribute it back to the community.


Inspired by the Angular SDK and plone-react, Kevin Bieri started to build a VueJS plone-vuejs implementation on top of Plone at the Plone Conference 2017 in Bareclona.


Ramon Navarro Bosch and Nathan van Gheem revelead the name of “Guillotina”, a blazing fast async Python framework that shares the public API with plone.restapi at the Beethoven sprint in Bonn.

Successful Open Source Collaboration

plone.restapi started with an idea and discussions. People and companies jumped in and contributed in many ways that haven’t been dreaming about at first.

Simone, Laurence, Ramon and other helped to shape the initial idea. Lukas, Thomas, Roel, Carsten, Victor, Mikel and many others contributed new endpoints, bugfixes, etc.

Eric, Rob, Noel, Kevin, and others started to build frameworks and solutions on top of plone.restapi.

Many companies such as 4teamwork, Code Syntax, Markina Corpus, VNC invested and contributed to plone.restapi.

The Plone Foundation always supported our efforts by funding sprints.

plone.restapi is a true community effort and the joy that we feel when collaborating with wonderful people pays us back for the countless hours we spend on hacking on code.

Future Plans

A Plone Improvement Proportal (PLIP) to ship Plone 5.2 with plone.restapi has been accepted by the Plone Framework Team:

With plone.restapi considered stable and close to being feature complete, we will continue working on what could become the next Plone…stay tuned.

Configuring the ufw firewall to allow Cloudflare IP addresses

Posted by T. Kim Nguyen on January 03, 2018 01:56 AM

I have a Linode running Ubuntu 16.04, and I use the ufw firewall.

I have a web site running on that server, originally accessible via HTTPS on port 443 from anywhere on the internet.

The domain for that web site is managed via Cloudflare. I want the site to be available only through the domain, and not via the Linode's IP address.

Cloudflare publishes the IP addresses it uses to access your web site:

Here is a page describing the overall idea of using ufw to allow access to your web site only from those Cloudflare IP addresses:

In this repo there is a script that does this:

I modified it a bit so that:

  • it uses the /tmp directory
  • it uses a unique filename (containing the current process ID) when retrieving the Cloudflare IP addresses
  • it specifically allows connections only on port 443 (you may want to allow connections on port 80 as well or instead)
  • it just outputs to the screen the commands that it would issue using ufw; If the commands look sane/good to you, copy and paste them into your terminal to run them

Here is my script:

cd /tmp
wget -O ips-v4-$$.tmp
wget -O ips-v6-$$.tmp

for cfip in `cat ips-v4-$$.tmp`; do echo "ufw allow from $cfip to any port 443 proto tcp"; done
for cfip in `cat ips-v6-$$.tmp`; do echo "ufw allow from $cfip to any port 443 proto tcp"; done

Once I ran the script and copied and pasted its output into a terminal, ufw was configured as follows:

# ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22                         ALLOW IN    Anywhere
[ 2] 443/tcp                    ALLOW IN
[ 3] 443/tcp                    ALLOW IN
[ 4] 443/tcp                    ALLOW IN
[ 5] 443/tcp                    ALLOW IN
[ 6] 443/tcp                    ALLOW IN
[ 7] 443/tcp                    ALLOW IN
[ 8] 443/tcp                    ALLOW IN
[ 9] 443/tcp                    ALLOW IN
[10] 443/tcp                    ALLOW IN
[11] 443/tcp                    ALLOW IN
[12] 443/tcp                    ALLOW IN
[13] 443/tcp                    ALLOW IN
[14] 443/tcp                    ALLOW IN
[15] 443/tcp                    ALLOW IN
[16] 22 (v6)                    ALLOW IN    Anywhere (v6)
[17] 443/tcp                    ALLOW IN    2400:cb00::/32
[18] 443/tcp                    ALLOW IN    2405:8100::/32
[19] 443/tcp                    ALLOW IN    2405:b500::/32
[20] 443/tcp                    ALLOW IN    2606:4700::/32
[21] 443/tcp                    ALLOW IN    2803:f800::/32
[22] 443/tcp                    ALLOW IN    2c0f:f248::/32
[23] 443/tcp                    ALLOW IN    2a06:98c0::/29

I tested by browsing to my web site's domain (e.g. and it worked. Then I tried to browse to my server's IP address (e.g. and it did not work, as expected and as intended.

Update: January 3, 2018: Thank you to Florian Schulze who suggested the use of Cloudflare's authenticated origin pulls, described at With this method, you don't have to worry that Cloudflare may have changed its IP addresses (the reason why you would need to update your ufw rules periodically).

There is also TLS client side authentication, a feature described at It is, however, available only to Enterprise Cloudflare customers.

Continuous Performance Analysis with Lighthouse and Jenkins

Posted by kitconcept GmbH on December 22, 2017 06:11 AM

Lighthouse is an open-source, automated tool for improving the quality of web pages by Google. It measures the performance of a website and provides metrics for accessibility, best practices for modern web apps, search engine optimization, and assess web applications for adherence to Progressive Web App standards.

Lighthouse Logo Lighthouse Logo

Together with WebPageTest and Google Page Speed Insights it is an indispensable tool to optimize your website performance.


Lighthouse can be installed in any JavaScript-based project by just running ‘npm install’:

$ npm install lighthouse -g

If you don’t have a package.json in your project, just install npm and run ‘npm init’ before installing.

Running Lighthouse

You can check the performance of any website by calling the ‘lighthouse’ command with the URL of the website you want to test. Append the --view parameter to show the HTML report, right after the command has finished:

$ lighthouse --view

The report will give you five different ratings about PWA, performance, accessibility, performance best practices, and SEO.

Lighthouse Results Lighthouse Results

Continuous Performance Measurements

If you run your performance test every now and then, you always risk to hurt your website performance without noticing. If a performance regression happens unnoticed, it is usually very hard and time consuming to figure out which change caused the performance regression.

You can easily fix this and save lots of time when you run your performance tests and analysis continuously.

Unfortunately Lighthouse does not allow you to set performance test specifications that your CI system can test against, like WebPageTest or Google Page Speed Insights do (we will cover those tools in later blog posts). Though, it is still very convenient to run the performance test on a regular basis for each commit and include them into your CI report.

Install Lighthouse locally for CI

When it comes to a Continuous Integration, a local installation is prefered over a global one, which is usually harder to manage and to maintain. Especially if you have multiple projects with different sets of package versions on your CI.

Therefore we install Lighthouse locally in our project directory:

$ npm install lighthouse --save-dev

This command will install Lighthouse to your local package.json file. We recommend to use yarn or npm package-lock.json to lock down the package version you are using for a repeatable and stable project build.

For convenience, we add a “lighthouse” script to our package.json:

"scripts": {
  "lighthouse:ci": "node_modules/lighthouse/lighthouse-cli/index.js \
  --output-path=./lighthouse-report.html --quiet \

We call the locally installed lighthouse binary and set a static output path (by default, Lighthouse creates a file with the current date/time in the filename which makes it harder to publish on your CI).

We also include the --quiet option and run it on headless chrome, so we don’t need to install and run an X server on our CI system.

At the end, we hard-code our project URL into the command so we do not have to type it manually each time we run this command.

Now we can just run:

$ npm run lighthouse:ci

and it will create a nice HTML report that we can publish in our CI.

Configure Lighthouse for your local development environment

For convenience, we also add a command that you can run locally:

"scripts": {
  "lighthouse": "node_modules/lighthouse/lighthouse-cli/index.js \
  --output-path=./lighthouse-report.html --quiet \

The --view parameter will fire up a browser with the report at the end of the performance analysis. This is something we clearly don’t want on our CI system.

Publish Lighthouse Reports in Jenkins CI

Travis and other lightweight CI system usually lack the option to publish any reports except the command line output. Though, if you are using Jenkins CI, you can use the HTML publisher plugin to publish your Lighthouse report.

sh 'npm install'
sh 'npm run lighthouse'
publishHTML (target: [
  allowMissing: false,
  alwaysLinkToLastBuild: false,
  keepAll: true,
  reportDir: '.',
  reportFiles: 'lighthouse-report.html',
  reportName: "Lighthouse"

After adding publishHTML to your Jenkins pipeline, you will see a “Lighthouse” link under the ‘Artifacts’ tab:

Link to Lighthouse report in Jenkins Link to Lighthouse report in Jenkins

There is a caveat though. Jenkins 1.641 / 1652.3 introduce the Content-Security-Policy header to static files served by Jenkins. The default header is set to a very restrictive set of permissions to protect Jenkins users from malicious HTML/JS files in workspaces.

To allow Jenkins to display the Lighthouse reports, we have to add the following JAVA_ARGS to the Jenkins startup (for instance by adding the following line to your /etc/default/jenkins file):

allow-scripts; default-src 'unsafe-inline'; img-src * data:\""

For more details see the Content Security Policy Reference and the Jenkins docs on configuring Content Security Policy.

After you fixed the Content Security Policy of your Jenkins you will see the full report when clicking on the ‘Lighthouse’ link on the ‘Artifacts’ tab on your Jenkins build:

Lighthouse full report in Jenkins Lighthouse Report in Jenkins

Jenkins Declarative Pipeline Stage for Performance Tests

A full declarative pipeline stage for lighthouse looks like this:

stage('Performance Tests') {
  agent {
    label 'master'
  when {
    branch 'master'
  steps {
    checkout scm
    sh 'npm install'
    sh 'npm run lighthouse'
  post {
    always {
      publishHTML (target: [
        allowMissing: false,
        alwaysLinkToLastBuild: false,
        keepAll: true,
        reportDir: '.',
        reportFiles: 'lighthouse-report.html',
        reportName: "Lighthouse"

We run the performance test stage on ‘master’ agents and only on the master branch. The steps performed are a simple “npm install” to set up the project build and then we run ‘npm run lighthouse’ to produce the HTML report. If you already have an npm build from a previous step you can of course just unstash the build artifact.

Jenkins pipeline with lighthouse performance tests Jenkins pipeline with Lighthouse performance tests stage


Lighthouse is a valuable and indispensable tool if you want to deliver a fast and user friendly website. Running the analysis on a continuous basis on your CI is a good idea if you take performance seriously. Setting it up is fast and easy. Maybe in the future Lighthouse will also provide a testspec feature that will allow us to fail a CI build (or mark it as unstable) on performance regressions. Though, if you run WebPageTest or Google Page Speed Insights additionally, this is not really needed.

Jazkarta Sponsors Northwest Youth Leadership Summit

Posted by Jazkarta Blog on December 07, 2017 08:21 PM

NWYLS Group Shot

Jazkarta is pleased to have recently sponsored the North Cascades Institute‘s Northwest Youth Leadership Summit. This event is intended to empower Cascadia’s future leaders in conservation by:

  • Enhancing their skills in preparation for job and college applications
  • ​Connecting with regional environmental organizations and businesses to learn about jobs and internships
  • Learning from like-minded peers about career options available in the conservation, outdoor and environmental fields

More than 220 students participated and are now better equipped to take action towards conservation. The Summit was free to all participants to ensure that underrepresented youth are given opportunities to get involved in the outdoor and environmental fields.

The sponsorship added another dimension to our existing partnership with North Cascades Institute. Just before the summit, we had given the non-profit’s Plone+Salesforce website a mobile refresh to make it work smoothly on phones and tablets. If we say so ourselves, the results are quite beautiful. Kudos to Neal Maher for the designs and to the Jazkarta team (Christine Winckler and David Glick) for a smooth implementation.

North Cascades Institute is not the only environmental non-profit organization that Jazkarta is working with – we created The Mountaineers‘s website and the Washington Trails Association ‘s volunteer management system. Both organizations were involved in the Summit. It was hosted at The Mountaineers’ Seattle Program Center, here is one of the students using the climbing wall.

NWYLS Student on The Mountaineers Climing Wall

Andrew Pringle of the Washington Trails Association led a breakout session titled “Trip Planning 101: An Introduction to Leading Backcountry Adventures”, and both organizations ran booths, talking with participants about activities, internships and employment options for young outdoor leaders.  Here’s Andrew at the WTA booth.

WTA's Andrew Pringle at the NWYLS

We feel very lucky to be helping all of these organizations further their missions.


— Photos by North Cascades Institute staff


Posted by PLONE.ORG on November 28, 2017 12:00 AM
Several XSS and redirect fixes, and a sandbox escape fix.

Security patch released 20171128

Posted by PLONE.ORG on November 28, 2017 12:00 AM
This is a routine patch with our standard 14 day notice period. There is no evidence that the issues fixed here are being used against any sites.

CVE numbers not yet issued.

Versions Affected: All supported Plone versions (4.x, 5.x). Previous versions could be affected but have not been tested.

Versions Not Affected: None.

Nature of vulnerability: Low severity, no data exposure or privilege escalation for anonymous users.

The patch was released at 2017-11-28 15:00 UTC.


Full installation instructions are available on the HotFix release page.

Standard security advice

  • Make sure that the Zope/Plone service is running with minimum privileges. Ideally, the Zope and ZEO services should be able to write only to log and data directories. Plone sites installed through our installers already do this.
  • Use an intrusion detection system that monitors key system resources for unauthorized changes.
  • Monitor your Zope, reverse-proxy request and system logs for unusual activity.
  • Make sure your administrator stays up to date, by following the special low-volume Plone Security Announcements list via email, RSS and/or Twitter

These are standard precautions that should be employed on any production system, and are not tied to this fix.

Extra Help

If you do not have in-house server administrators or a service agreement for supporting your website, you can find consulting companies at

There is also free support available online via the Plone forum and the Plone chat channels.

Q: When will the patch be made available?A: The Plone Security Team will release the patch at 2017-11-28 15:00 UTC.

Q. What will be involved in applying the patch?A. Patches are made available as tarball-style archives that may be unpacked into the products folder of a buildout installation and as Python packages that may be installed by editing a buildout configuration file and running buildout. Patching is generally easy and quick to accomplish.

Q: How were these vulnerabilities found?A: The vulnerabilities were found by users submitting them to the security mailing list.

Q: My site is highly visible and mission-critical. I hear the patch has already been developed. Can I get the fix before the release date? A: No. The patch will be made available to all administrators at the same time. There are no exceptions.

Q: If the patch has been developed already, why isn't it made available to the public now? A: The Security Team is still testing the patch against a wide variety of configurations and running various scenarios thoroughly. The team is also making sure everybody has appropriate time to plan to patch their Plone installation(s). Some consultancy organizations have hundreds of sites to patch and need the extra time to coordinate their efforts with their clients.

Q: How does one exploit the vulnerability?A: This information will not be made public until after the patch is made available.

Q: Is my Plone site at risk for this vulnerability? How do I know if my site has been exploited? How can I confirm that the hotfix is installed correctly and my site is protected?

A: Details about the vulnerability will be revealed at the same time as the patch.

Q: How can I report other potential security vulnerabilities?

A: Please email the Plone Security Team at rather than publicly discussing potential security issues.

Q: How can I apply the patch without affecting my users?

A: Even though this patch does NOT require you to run buildout, you can run buildout without affecting your users. You can restart a multi-client Plone install without affecting your users; see  

Q: How do I get help patching my site?

A: Plone service providers are listed at  There is also free support available online via the Plone forum and the Plone chat channels

Q: Who is on the Plone Security Team and how is it funded?

A: The Plone Security Team is made up of volunteers who are experienced developers familiar with the Plone code base and with security exploits. The Plone Security Team is not funded; members and/or their employers have volunteered their time in the interests of the greater Plone community.

Q: How can I help the Plone Security Team?

A: The Plone Security Team is looking for help from security-minded developers and testers. Volunteers must be known to the Security Team and have been part of the Plone community for some time. To help the Security Team financially, your donations are most welcome at

General questions about this announcement, Plone patching procedures, and availability of support may be addressed to the Plone support forums If you have specific questions about this vulnerability or its handling, contact the Plone Security Team at

To report potentially security-related issues, email the Plone Security Team at We are always happy to credit individuals and companies who make responsible disclosures.

Information for Vulnerability Database Maintainers

We will apply for CVE numbers for these issues. Further information on individual vulnerabilities (including CVSS scores, CWE identifiers and summaries) will be available at the full vulnerability list.

Security vulnerability pre-announcement: 20171128

Posted by PLONE.ORG on November 26, 2017 10:30 PM
This is a routine patch with our standard 14 day notice period. There is no evidence that the issues fixed here are being used against any sites.

CVE numbers not yet issued.

Versions Affected: All supported Plone versions (4.x, 5.x). Previous versions could be affected but have not been tested.

Versions Not Affected: None.

Nature of vulnerability: Low severity, no data exposure or privilege escalation for anonymous users.

The patch will be released at 2017-11-28 15:00 UTC.


This is a pre-announcement of availability of this security fix. 

The security fix egg will be named Products.PloneHotfix20171128 and its version will be 1.0. Further installation instructions will be made available when the fix is released.

Standard security advice

  • Make sure that the Zope/Plone service is running with minimum privileges. Ideally, the Zope and ZEO services should be able to write only to log and data directories. Plone sites installed through our installers already do this.
  • Use an intrusion detection system that monitors key system resources for unauthorized changes.
  • Monitor your Zope, reverse-proxy request and system logs for unusual activity.
  • Make sure your administrator stays up to date, by following the special low-volume Plone Security Announcements list via email, RSS and/or Twitter

These are standard precautions that should be employed on any production system, and are not tied to this fix.

Extra Help

Should you not have in-house server administrators or a service agreement for supporting your website, you can find consulting companies at

There is also free support available online via the Plone forum and the Plone chat channels.

Q: When will the patch be made available?A: The Plone Security Team will release the patch at 2017-11-28 15:00 UTC.

Q. What will be involved in applying the patch?A. Patches are made available as tarball-style archives that may be unpacked into the products folder of a buildout installation and as Python packages that may be installed by editing a buildout configuration file and running buildout. Patching is generally easy and quick to accomplish.

Q: How were these vulnerabilities found?A: The vulnerabilities were found by users submitting them to the security mailing list.

Q: My site is highly visible and mission-critical. I hear the patch has already been developed. Can I get the fix before the release date? A: No. The patch will be made available to all administrators at the same time. There are no exceptions.

Q: If the patch has been developed already, why isn't it made available to the public now? A: The Security Team is still testing the patch against a wide variety of configurations and running various scenarios thoroughly. The team is also making sure everybody has appropriate time to plan to patch their Plone installation(s). Some consultancy organizations have hundreds of sites to patch and need the extra time to coordinate their efforts with their clients.

Q: How does one exploit the vulnerability?A: This information will not be made public until after the patch is made available.

Q: Is my Plone site at risk for this vulnerability? How do I know if my site has been exploited? How can I confirm that the hotfix is installed correctly and my site is protected?

A: Details about the vulnerability will be revealed at the same time as the patch.

Q: How can I report other potential security vulnerabilities?

A: Please email the Plone Security Team at rather than publicly discussing potential security issues.

Q: How can I apply the patch without affecting my users?

A: Even though this patch does NOT require you to run buildout, you can run buildout without affecting your users. You can restart a multi-client Plone install without affecting your users; see  

Q: How do I get help patching my site?

A: Plone service providers are listed at There is also free support available online via the Plone forum and the Plone chat channels

Q: Who is on the Plone Security Team and how is it funded?

A: The Plone Security Team is made up of volunteers who are experienced developers familiar with the Plone code base and with security exploits. The Plone Security Team is not funded; members and/or their employers have volunteered their time in the interests of the greater Plone community.

Q: How can I help the Plone Security Team?

A: The Plone Security Team is looking for help from security-minded developers and testers. Volunteers must be known to the Security Team and have been part of the Plone community for some time. To help the Security Team financially, your donations are most welcome at

General questions about this announcement, Plone patching procedures, and availability of support may be addressed to the Plone support forums If you have specific questions about this vulnerability or its handling, contact the Plone Security Team at

To report potentially security-related issues, email the Plone Security Team at We are always happy to credit individuals and companies who make responsible disclosures.

Information for Vulnerability Database Maintainers

We will apply for CVE numbers for these issues. Further information on individual vulnerabilities (including CVSS scores, CWE identifiers and summaries) will be available at the full vulnerability list.

fail2ban configuration error fix

Posted by T. Kim Nguyen on November 26, 2017 04:09 PM

If you have this in your /etc/fail2ban/jail.local configuration file:

# "bantime" is the number of seconds that a host is banned.
bantime = 31536000 # 1 year

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 604800 # 7 days

and you get these errors when you restart fail2ban (service fail2ban restart):

WARNING Wrong value for 'findtime' in 'ssh'. Using default one: '600'
WARNING Wrong value for 'bantime' in 'ssh'. Using default one: '600'

change it to this (put the comment on a separate line):

# "bantime" is the number of seconds that a host is banned.
# 1 year
bantime = 31536000

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
# 7 days
findtime = 604800

This is explained in the following bug report:

fail2ban: Incorrect parsing of commented text after reading a value from config file

If you want to set a permanent ban time, use a negative number.

# "bantime" is the number of seconds that a host is banned.
# permanent ban
bantime = -1

Pastanaga Sprint Bonn 2017

Posted by kitconcept GmbH on November 23, 2017 05:02 PM
Pastanaga is a new user experience framework for the web, designed by Albert Casado.


Pastanaga was first presented in March 2017, at the Plone Open Garden in Sorrento. In July, we started with an initial implementation during the Midsummer Sprint in Jyväskylä, Finnland.

Pastanaga was also present at the recently held Plone Conference in Barcelona, where Albert gave a presentation on it. In addition, Eric Steele, the Plone release manager, gave us the opportunity to present Pastanaga to the audience during his keynote on the first day of the conference.

With all the positive feedback and energy we took from the Plone Conference, we wanted to push things further and we just couldn’t wait until our “Beethoven Sprint”, which is planned for early 2018. Therefore we decided to organize a small and focused sprint at our office in Bonn to work on the implementation of Pastanaga.

The Pastanaga Minimal Viable Product

As an Open Source community (and software engineers) with many years of experience in designing and building complex Content Management System applications, we sometimes have the tendency to try to solve all problems at once.

Over the years we encountered and solved many complex problems and when we build something new, this can be both a source of wisdom as well as a baggage that you carry around.

This sometimes led to a situation where we were over-engineering solutions, to solve all the problems that we encountered over the years at once. Enhancements sometimes stayed around for years without really becoming production ready and usable in real-world projects.

To avoid this from happening when working on implementing Pastanaga, we decided in Jyväskylä to focus on a Minimal Viable Product.

A Minimum Viable Product (MVP) is a product with just enough features to satisfy early customers, and to provide feedback for future product development. The Pastanaga MVP needs to provide what we consider the essentials of a Content Management System:

  • A site administrator can and add, edit, and delete a page

  • A user can view the created pages and navigate the site structure

In order to be usable for public facing website projects, we added two additional technical requirements:

  • The page should be fully rendered within 500 milliseconds

  • Google should be able to crawl the contents of the website

Those requirements might sound very simple, but they are actually not.

Pastanaga aims to leverage the editing experience and reduce the complexity that we took for granted over the years. We aim to simplify the user experience for the editors by getting rid of things that we got used to. For instance, adding an image to a page should be as simple as just dragging and dropping an image to the page and Plone will take care about the heavy lifting of automatically uploading and resizing the image.

You can find a list of all the user stories that we plan to implement as part of the MVP here:

Having the goals and scope for this set the only thing that was needed was a bunch of Plone devs and three days and nights of coding.

Sprint Day One

After the sprinters arrived, we started with our sprint planning session. We decided to focus on the implementation of the Pastanaga MVP and work on the other issues (e.g. plone.restapi) only if we need them for the MVP.

After the planning meeting, Rob gave us an introduction to plone-react, a ReactJS-based implementation of the Plone UI that he and Roel worked on over the past months and that we decided to use as a basis for our MVP.

We went through all components, reducers, bells and whistles of the application and discussed best practices, developer environments and developer approachability.

After that session, Rob and Victor started with the implementation of Pastanaga. Davi created a pull request that adds an uninstall profile for plone.restapi and started to learn about React. Roel started to look into a way to turn the Plone site root into a Dexterity object, something that we would need to simplify the Plone editing experience. I worked on the basic Robot Framework acceptance test setup and updated the contents of the Pastanaga github repository, which is supposed to be just an entry point for all our initiatives around Pastanaga:

Day Two

On the second day, Victor finished the login form and made the error messages work.

Rob implemented the document edit accordion menu, fixed the button styling, made plone-react use the Pastanaga icons and started to work on the toolbar.

document edit

Davi added a search widget to the header, implemented the breadcrumbs navigation and added styles for the document heading and description.

document view

Right before the wrap-up meeting of day two, Roel showed us a Plone site with a “containerish” Dexterity-based site root. We did not really expect that much progress and went to bed (some of us a lot later) still very impressed by his accomplishment.

Day Three

On day three, Rob started to work on the new Pastanaga document edit view. He made the new edit view to show multiple content items (e.g text, image, video) and allowed to change the order of those content items via drag and drop.

Davi continued to work on the header and breadcrumbs styling. Victor looked into the mobile views of our responsive design, fixed some issues with the status messages and briefly started to look into GatsbyJS (which we plan to use to implement


After three days (and nights) of hacking, we had:

A fully functional login form with error messages and password forgotten functionality:


A fully functional Pastanaga Toolbar that can be collapsed or expanded. With all the menu items present and the personal toolbar functionality available:


A view to add and edit pages with all the existing functionality:

document edit

In three sprint days, we accomplished our main goals and were able to create the first iteration of a Minimal Viable Product that we can use to build things upon. We plan to continue to work on this, use it in our current and upcoming projects, and of course: contribute back as much as we can.

Stay tuned for more updates on this soon!

Successful Pastanaga Sprint 2017 in Bonn

Posted by PLONE.ORG on November 23, 2017 01:00 PM

Pastanaga is a new user experience framework for Plone designed by Albert Casado. Albert presented his vision during his talk at the Plone Conference 2016 in Boston. Eric Steele, the Plone release manager gave us the opportunity to present Pastanaga during his keynote at the same conference. Albert gave another presentation on the progress made and the more developed vision for Pastanaga at the Plone Conference 2017 in Barcelona.

To bring Pastanaga to life, five Plone developers gathered in Bonn, at the office of the kitconcept GmbH, for a small and focused sprint (see the announcement and the event) from November 15-17, 2017, to work on the implementation on top of plone-react, a ReactJS-based Plone frontend written by Rob Gietema.

The three-day sprint was a major success. The sprinters were able to implement a "Minimal Viable Product" of Pastanaga with React on top of the new Plone RESTful API. See the full sprint report for details.

The sprint was kindly sponsored by the Plone Foundation and kitconcept GmbH.

Successful Google Summer of Code 2017

Posted by PLONE.ORG on November 16, 2017 05:47 PM

Google Summer of Code ("GSoC") is an annual international program open to university students in which Google awards stipends to all students who successfully complete a free and open-source software  project.

The Plone community is proud to announce four successful projects were completed for GSoC 2017. 

All five GSoC students were offered sponsorship by the Plone Foundation to travel to Barcelona for the Plone Digital Experience 2017 conference. Oshane, Mikko, Noel, and Shriyansh Agrawal (content import and export) were able to attend and present their work to enthusiastic audiences.

Cris Ewing was our new-for-2017 coordinator of the Plone community's GSoC involvement. The Plone Foundation Board expresses its gratitude to him on behalf of the entire Plone community for having managed this very important project.

We also truly appreciate the time and effort of our GSoC students and their mentors in continuing to move Plone forward.

On to 2018, for which we have already begun soliciting project ideas

Plone Foundation Officers 2017-2018

Posted by PLONE.ORG on November 15, 2017 08:25 PM

All seven Plone Foundation Board members' nominations were accepted at the Annual General Meeting held in Barcelona on October 20, 2017: 

  • Paul Roeland
  • Alexander Loechel
  • Carol Ganz
  • Chrissy Wainwright
  • Víctor Fernández de Alba
  • Philip Bauer
  • T. Kim Nguyen

At the first Board meeting of the new term on November 2, 2017, the officers of the Foundation were voted in. The officers are elected annually:

  • President: Paul Roeland
  • Vice President: Alexander Loechel
  • Secretary: Chrissy Wainwright
  • Treasurer (non-voting): Jen Myers

Apart from these official Foundation roles, there are further roles and tasks that the Board attends to:

  • Marketing lead: T. Kim Nguyen
  • Framework team liaison: Philip Bauer
  • Security team liaison & Higher Education liaison: Alexander Loechel
  • Communications/Marketing team lead: T. Kim Nguyen
  • Front End team lead: Víctor Fernández de Alba
  • Foundation Membership committee co-chairs: Érico Andrei, T. Kim Nguyen

For more information on the Plone Foundation or its board, visit, or drop an e-mail to .

Plone is an open source web content management system excelling in usability, accessibility, and versatility. The Plone Foundation is a US 501(c)3 tax-exempt organization that protects and promotes Plone.

Thank you, Barcelona!

Posted by PLONE.ORG on November 15, 2017 06:02 PM

The Plone Digital Experience Conference 2017 in Barcelona was an exhilarating success, bringing together the Plone, Python web, and modern JavaScript front end communities in the beautiful city of Barcelona. 

IMG_0056.jpg IMG_0411.jpg IMG_0507.jpg IMG_7945.jpg

Some statistics: 

  • 10 training classes
  • 6 keynotes
  • 52 presentations 
  • 180 attendees from 21 countries
  • 2 organizing companies, 18 sponsors, 4 partners
  • 70 sprinters
  • 4 Google of Summer of Code 2017 students
  • 1 truly memorable conference dinner
  • 1 official Plone band 
  • dozens of volunteers

Some artifacts:

  • Speakers' slides can be found for almost all the presentations (video recordings still to come).
  • Photos of the conference
  • Tweets during the conference 

On behalf of the Plone community, thank you 2017 organizing team!

  • Victor Fernandez de Alba
  • Ramon Navarro Bosch
  • Agata Avalo
  • Albert Casado
  • Timo Stollenwerk
  • Philip Bauer
  • Paul Roeland
  • Kim Nguyen
  • Sally Kleinfeldt
  • Mikel Larreategi
  • Eric Bréhault


Obstacles on the road towards Plone 2020

Posted by on November 10, 2017 09:45 AM

During the sprint at the Plone Conference 2017 in Barcelona, Plone achieved a major milestone towards what is often called "Plone 2020". This is basically the effort to modernize Plone's backend and achieve Python 3 compatibility. In 2020, support for Python 2.7 will officially end, hence Plone 2020.

A necessary part of that effort was to migrate Zope to Python 3, a daunting task that was only possible by a flurry of activity that combined the efforts of many stakeholders (not only the Plone Community). Learn more about that in Hanno Schlichting's talk once the video is on the website, and on many blog posts on the Gocept Blog.

Getting Plone to run on that newest version of Zope (currently Zope 4.0b2) was another story and took a lot of work (some details are in my post here. Finally in Barcelona, in a daring move we merged all the work that had been done for that PLIP and decided that the result will be called Plone 5.2. But by that time not all tests were green (that's why it was daring). We worked hard to get the tests to pass and to fix some issues we found when testing manually.

By the way: At the same sprint we started to prepare Plone itself for Python 3 by fixing all imports to work in both Python 2 and Python 3. But that is a tale for another blog post.

So, despite out best efforts, even one week after the conference I was not yet able to fix all the tests, and so I created at ticket to track the remaining issues.

Here this story about two erroring tests in Products.CMFFormController actually begins. Here is the spoiler: I did not really solve the issue but finally worked around it. But I still think the approach I took might be of interest to some.

The two breaking tests, test_attacker_redirect and test_regression, were passing when I ran them in isolation or when I ran all test of Products.CMFFormController with ./bin/test -s Products.CMFFormController. To add insult to injury, Products.CMFFormController is basically dead code but is still used by some of our legacy ControllerPageTemplates.

So how could I find the issue since the traceback was not really helpful?

Here is the relevant part of the log from jenkins:

#### Running tests for group Archetypes ####
Running Products.Archetypes.tests.attestcase.Archetypes:Functional tests:


Running tests:
  Tear down Testing.ZopeTestCase.layer.ZopeLite in 0.000 seconds.
  Set up plone.testing.zca.LayerCleanup in 0.000 seconds.
  Set up plone.testing.z2.Startup in 0.101 seconds.
  Set up in 9.722 seconds.
  Set up in 2.628 seconds.
  Set up in 0.000 seconds.

Error in test test_attacker_redirect (Products.CMFFormController.tests.testRedirectTo.TestRedirectToFunctional)
Traceback (most recent call last):
  File "/usr/lib/python2.7/unittest/", line 329, in run
  File "/home/jenkins/workspace/plone-5.2-python-2.7-at/src/Products.CMFFormController/Products/CMFFormController/tests/", line 97, in test_attacker_redirect
  File "/home/jenkins/workspace/plone-5.2-python-2.7-at/src/Zope/src/Testing/ZopeTestCase/", line 43, in wrapped_func
    return func(*args, **kw)
  File "/home/jenkins/workspace/plone-5.2-python-2.7-at/src/Zope/src/Testing/ZopeTestCase/", line 127, in publish
    wsgi_result = publish(env, start_response)
  File "/home/jenkins/workspace/plone-5.2-python-2.7-at/src/Zope/src/ZPublisher/", line 254, in publish_module
    with load_app(module_info) as new_mod_info:
  File "/usr/lib/python2.7/", line 17, in __enter__
  File "/home/jenkins/workspace/plone-5.2-python-2.7-at/src/Zope/src/Testing/ZopeTestCase/", line 73, in load_app
    with ZPublisher.WSGIPublisher.__old_load_app__(module_info) as ret:
  File "/usr/lib/python2.7/", line 17, in __enter__
  File "/home/jenkins/workspace/plone-5.2-python-2.7-at/src/Zope/src/ZPublisher/", line 220, in load_app
    app = app_wrapper()
  File "/home/jenkins/workspace/plone-5.2-python-2.7-at/src/Zope/src/App/", line 78, in __call__
    return connection.root()[self._name]
  File "/home/jenkins/shiningpanda/jobs/2fa08faf/virtualenvs/d41d8cd9/lib/python2.7/", line 40, in __getitem__
    raise KeyError(key)
KeyError: 'Application'

Error in test test_regression (Products.CMFFormController.tests.testRedirectTo.TestRedirectToFunctional)
Traceback (most recent call last):


    raise KeyError(key)
KeyError: 'Application'

  Ran 68 tests with 0 failures, 2 errors and 0 skipped in 1.626 seconds.
Running testing:Integration tests:
  Set up in 0.027 seconds.
  Set up testing:Integration in 0.000 seconds.
  Ran 27 tests with 0 failures, 0 errors and 0 skipped in 9.033 seconds.


Tearing down left over layers:
  Tear down zope.testrunner.layer.UnitTests in 0.000 seconds.
Total: 733 tests, 0 failures, 2 errors and 0 skipped in 3 minutes 10.739 seconds.
#### Finished tests for group Archetypes ####

What? Why does connection.root() have no Application? This makes no sense to me, and a pdb there did not help to shed light on it at all.

First I reproduced the error by testing all packages in the test group Archetypes (where the error occurs):

./bin/test \
  -s Products.Archetypes \
  -s Products.CMFFormController \
  -s Products.MimetypesRegistry \
  -s Products.PortalTransforms \
  -s Products.statusmessages \
  -s Products.validation \

Then I only used the test layers that actually got set up according to the output:

./bin/test --layer Products.Archetypes.tests.attestcase.Archetypes \
           --layer Products.PortalTransforms.testing.PortalTransformsLayer \
           --layer Testing.ZopeTestCase.layer.ZopeLite \
           --layer \
           -s Products.Archetypes \
           -s Products.CMFFormController \
           -s Products.MimetypesRegistry \
           -s Products.PortalTransforms \
           -s Products.statusmessages \
           -s Products.validation \

That worked, I see the error. But I will not try to read 733 tests and wait for more than 3 minutes each time I think I may have fixed something!

Thus I used the divide-and-conquer strategy to figure out which combination produced the failing tests: remove half of the packages layers and see if it still fails. If they pass, try the other half. Do the same with the layers.

Remember to keep --layer and -s Products.CMFFormController in order not to skip the tests that expose the issue.

It turned out that the following combination reproduced the issue:

./bin/test \
    --layer Products.Archetypes.tests.attestcase.Archetypes \
    --layer Testing.ZopeTestCase.layer.ZopeLite \
    --layer \
    -s Products.Archetypes \
    -s Products.CMFFormController

Still way too many tests to have a look, most of them in Products.Archetypes. So I removed (actually, moved the .py files to some temp folder) all python tests and kept the doctests (and their setup). The only reason was that I hate doctests and consequently it must be a doctest that created trouble. I was right.

So I kept only one doctest that produced the issue by commenting out the others in of Products.Archetypes.

Now I needed to find a combination of three tests from these layers that still exposed the issue. To to that, I added the option -vv to the testrunner to see the names and python path of all tests that still ran.

./bin/test --layer Products.Archetypes.tests.attestcase.Archetypes --layer Testing.ZopeTestCase.layer.ZopeLite --layer -s Products.Archetypes -s Products.CMFFormController -vv
Running tests at level 1
Running Products.Archetypes.tests.attestcase.Archetypes:Functional tests:
  Set up plone.testing.zca.LayerCleanup in 0.000 seconds.
  Set up plone.testing.z2.Startup in 0.157 seconds.
  Set up in 10.252 seconds.
  Set up in 1.871 seconds.
  Set up Products.Archetypes.tests.attestcase.ATTestCaseFixture in 0.647 seconds.
  Set up Products.Archetypes.tests.attestcase.Archetypes:Functional in 0.000 seconds.
    1/1 (100.0%) /Users/pbauer/workspace/coredev/src/Products.Archetypes/Products/Archetypes/tests/traversal_4981.txt

  Ran 1 tests with 0 failures, 0 errors, 0 skipped in 0.269 seconds.
Running Testing.ZopeTestCase.layer.ZopeLite tests:
  Tear down Products.Archetypes.tests.attestcase.Archetypes:Functional in 0.000 seconds.
  Tear down Products.Archetypes.tests.attestcase.ATTestCaseFixture in 0.010 seconds.
  Tear down in 0.009 seconds.
  Tear down in 0.065 seconds.
  Tear down plone.testing.z2.Startup in 0.004 seconds.
  Tear down plone.testing.zca.LayerCleanup in 0.001 seconds.
  Set up Testing.ZopeTestCase.layer.ZopeLite in 0.009 seconds.
    1/5 (20.0%) test_parseXML_empty (Products.CMFFormController.tests.test_exportimport.CMFFormControllerImportConfiguratorTests)
    2/5 (40.0%) test_parseXML_with_info (Products.CMFFormController.tests.test_exportimport.CMFFormControllerImportConfiguratorTests)
    3/5 (60.0%) test_action_not_unicode (Products.CMFFormController.tests.test_exportimport.Test_importCMFFormController)
    4/5 (80.0%) test_normal (Products.CMFFormController.tests.test_exportimport.Test_importCMFFormController)
    5/5 (100.0%) test_partial (Products.CMFFormController.tests.test_exportimport.Test_importCMFFormController)

  Ran 5 tests with 0 failures, 0 errors, 0 skipped in 0.023 seconds.
Running tests:
  Tear down Testing.ZopeTestCase.layer.ZopeLite in 0.000 seconds.
  Set up plone.testing.zca.LayerCleanup in 0.000 seconds.
  Set up plone.testing.z2.Startup in 0.092 seconds.
  Set up in 7.227 seconds.
  Set up in 2.087 seconds.
  Set up in 0.000 seconds.
    1/4 (25.0%) testCopy (Products.CMFFormController.tests.testCopyRename.TestCopyRename)
    2/4 (50.0%) testRename (Products.CMFFormController.tests.testCopyRename.TestCopyRename)
    3/4 (75.0%) test_attacker_redirect (Products.CMFFormController.tests.testRedirectTo.TestRedirectToFunctional)

Error in test test_attacker_redirect (Products.CMFFormController.tests.testRedirectTo.TestRedirectToFunctional)
Traceback (most recent call last):
  File "/usr/local/Cellar/python/2.7.13_1/Frameworks/Python.framework/Versions/2.7/lib/python2.7/unittest/", line 329, in run
  File "/Users/pbauer/workspace/coredev/src/Products.CMFFormController/Products/CMFFormController/tests/", line 97, in test_attacker_redirect
  File "/Users/pbauer/workspace/coredev/src/Zope/src/Testing/ZopeTestCase/", line 43, in wrapped_func
    return func(*args, **kw)
  File "/Users/pbauer/workspace/coredev/src/Zope/src/Testing/ZopeTestCase/", line 127, in publish
    wsgi_result = publish(env, start_response)
  File "/Users/pbauer/workspace/coredev/src/Zope/src/ZPublisher/", line 254, in publish_module
    with load_app(module_info) as new_mod_info:
  File "/usr/local/Cellar/python/2.7.13_1/Frameworks/Python.framework/Versions/2.7/lib/python2.7/", line 17, in __enter__
  File "/Users/pbauer/workspace/coredev/src/Zope/src/Testing/ZopeTestCase/", line 73, in load_app
    with ZPublisher.WSGIPublisher.__old_load_app__(module_info) as ret:
  File "/usr/local/Cellar/python/2.7.13_1/Frameworks/Python.framework/Versions/2.7/lib/python2.7/", line 17, in __enter__
  File "/Users/pbauer/workspace/coredev/src/Zope/src/ZPublisher/", line 220, in load_app
    app = app_wrapper()
  File "/Users/pbauer/workspace/coredev/src/Zope/src/App/", line 78, in __call__
    return connection.root()[self._name]
  File "/Users/pbauer/workspace/coredev/bin/../lib/python2.7/", line 40, in __getitem__
    raise KeyError(key)
KeyError: 'Application'

    4/4 (100.0%) test_regression (Products.CMFFormController.tests.testRedirectTo.TestRedirectToFunctional)

Error in test test_regression (Products.CMFFormController.tests.testRedirectTo.TestRedirectToFunctional)
Traceback (most recent call last):
  File "/usr/local/Cellar/python/2.7.13_1/Frameworks/Python.framework/Versions/2.7/lib/python2.7/unittest/", line 329, in run
  File "/Users/pbauer/workspace/coredev/src/Products.CMFFormController/Products/CMFFormController/tests/", line 71, in test_regression
  File "/Users/pbauer/workspace/coredev/src/Zope/src/Testing/ZopeTestCase/", line 43, in wrapped_func
    return func(*args, **kw)
  File "/Users/pbauer/workspace/coredev/src/Zope/src/Testing/ZopeTestCase/", line 127, in publish
    wsgi_result = publish(env, start_response)
  File "/Users/pbauer/workspace/coredev/src/Zope/src/ZPublisher/", line 254, in publish_module
    with load_app(module_info) as new_mod_info:
  File "/usr/local/Cellar/python/2.7.13_1/Frameworks/Python.framework/Versions/2.7/lib/python2.7/", line 17, in __enter__
  File "/Users/pbauer/workspace/coredev/src/Zope/src/Testing/ZopeTestCase/", line 73, in load_app
    with ZPublisher.WSGIPublisher.__old_load_app__(module_info) as ret:
  File "/usr/local/Cellar/python/2.7.13_1/Frameworks/Python.framework/Versions/2.7/lib/python2.7/", line 17, in __enter__
  File "/Users/pbauer/workspace/coredev/src/Zope/src/ZPublisher/", line 220, in load_app
    app = app_wrapper()
  File "/Users/pbauer/workspace/coredev/src/Zope/src/App/", line 78, in __call__
    return connection.root()[self._name]
  File "/Users/pbauer/workspace/coredev/bin/../lib/python2.7/", line 40, in __getitem__
    raise KeyError(key)
KeyError: 'Application'

  Ran 4 tests with 0 failures, 2 errors, 0 skipped in 0.403 seconds.
Tearing down left over layers:
  Tear down in 0.000 seconds.
  Tear down in 0.010 seconds.
  Tear down in 0.068 seconds.
  Tear down plone.testing.z2.Startup in 0.007 seconds.
  Tear down plone.testing.zca.LayerCleanup in 0.001 seconds.

Tests with errors:
   test_attacker_redirect (Products.CMFFormController.tests.testRedirectTo.TestRedirectToFunctional)
   test_regression (Products.CMFFormController.tests.testRedirectTo.TestRedirectToFunctional)
Total: 10 tests, 0 failures, 2 errors, 0 skipped in 24.082 seconds.

24 seconds? I can work with that.

Still, I removed tests from each layer until I only had three tests left and reverted my changes to Products.Archetypes.

The result is the following:

./bin/test \
    --layer Products.Archetypes.tests.attestcase.Archetypes \
    --layer Testing.ZopeTestCase.layer.ZopeLite \
    --layer \
    -s Products.Archetypes \
    -s Products.CMFFormController \
    -t test_parseXML_empty \
    -t traversal_4981 \
    -t test_attacker_redirect \

Since more than one test still exposed the issue, I kept only very simple ones because I guessed that the issue is actually in the setup or teardown.

So next I changed the test test_parseXML_empty to a simple return. The error is still there. Trying the same with traversal_4981 makes it go away.

At this point I could skip reducing the layers since I only run three tests from two packages.

It was time to actually read what the remaining tests are doing. I stripped down all tests and their setup to the base minimum that still breaks the test run and could not find anything. I turn edCMFFormControllerImportConfiguratorTests into a ZopeTestCase and a PloneTestCase and realized that the error disappears when it is a PloneTestCase. Bad. Migrating the whole test to PloneTestCase or would be a lot of work since CMFFormControllerImportConfiguratorTests inherits from Products.GenericSetup.tests.common.BaseRegistryTests and does a lot of additional magic.

So the test layers for the two tests that did not fail or error by themselves but triggered the issue in the failing tests (traversal_4981 and test_parseXML_empty) seemed to be out of the scope of what I could do so I took a closer look at the failing tests themselves. I quickly found that I hate them but what they do is actually quite simple. Why do I hate them? Because they use the publish method of ZopeTestCase.Functional. That method (and its evil doctest-cousin Testing.ZopeTestCase.zopedoctest.functional.http) are way too clever helper methods that make things harder, not easier. I prefer to use restrictedTraverse or the testbrowser any time since both are much closer to what actually happens in the application.

This was the moment when I decided to migrate the tests in question to proper tests. It took me about 1 hour to create a pull-request which resolves the issue. The rest of the day was spent on a fruitless attempt to find the issue that must still be lurking somewhere between the three tests and their layers.

I hope that monster will never rear its ugly head again until CMFFormController is finally removed from the coredev. The PLIP 2092 by @esteele and me will remove the last remaining ControllerPageTemplates but there are some more left in Archetypes.

I fear it will be quite some time until all ZopeTestCase and PloneTestCase tests are migrated to The remaining happy thought is that many will not need to be migrated since they are part of Archetypes and will go awaaaaay with it.

Content translation endpoint for plone.restapi

Posted by CodeSyntax on November 06, 2017 03:03 PM
plone.restapi ships with content translations support endpoint since version 1.0a22. In this post I will explain the history behind this and the decisions taken to implement it.

Plone Conference Barcelona 2017

Posted by Asko Soukka on November 03, 2017 07:35 AM

It was awesome to be back at Plone Conference this year. Finally! We have had participation in Plone conferences in 2009, 2011–2012 and 2014–2017, but for me the previous one was years ago: Plone Conference Bristol in 2014. Needless to say that I have missed the warm and welcoming atmosphere of a Plone conferences, and It's my pleasure to report that Barcelona did not let me down. Even the weather was still warm there in this October.

This year there was no single big Plone news at the conference. The latest major release of Plone CMS was released already two years ago, and the next feature release is still waiting for its gold master. Yet, there was still a lot of good news, and putting all the puzzle pieces together resulted in a clear picture of the future of Plone.

Disclaimer: These are obviously just my personal opinions on all these things Plone...

Published originally at

Plone Conference Barcelona was so much of fun that I took a piece of it with me back home.

Plone 2020 and beyond

At first, let's say it clear that Plone CMS remains to be a safe bet for a long-term enterprise CMS solution. If there ever was any doubt, whether Plone could make it to Python 3 in-time before the end of Python 2.7 maintenance in 2020, that should be no more. Plone will make it.

All the major blockers seem to have been solved, and the rest is just hard work left for our community (check some related talks by Alexander and Hannoabout the recent events on that). Python 3 version of Zope application server powering Plone is already in beta, and it is scheduled to be released within a year. Plone, for sure, has still plenty of packages to be ported from Python 2.7 to Python 3, but there are already many sprints scheduled to continue that work in near future (including the already completed Barcelona Conference sprints). We might even have an alpha version of Plone on Python 3 before end of 2018.

In addition that, it's always good to mention, that Plone Foundation has continued to do its usual great job in all the possible paper work around managing Plone's copyrights and trademarks.

All these should be good and relaxing news for any long-term Plone user.

Let's go frontend!

The greatest challenge for Plone CMS seems to be keeping up with the ever increasing UX expections of the day, while complying with the high accessibility standards. After Plone 5 rewrote the default theme and whole front-end resource management in Plone, there are no longer blockers for using any current front-end tech with Plone. But just being able to use some tech is not enough – also the real work for better UX needs to be done. And even a lot has been done for Plone 5 and 5.1, that work seems to never end.

Plone Conference Barcelona included a great amount of front-end, user experience and accessibility related talks to educate our community. So many that I can only mention a few.

At first, there were talks regarding the current Plone user interface: Johannes gave a bit technical, but very comprehensive talk how the new frontend resource registries in Plone 5 really work. My talk instructed, how to combine the ancient powers of Zope application server with the modern Plone 5 theming support to achieve shorter iterations and faster deployments when developing new UX features. Our Rikupekka talked about our migration experiences from Plone 4 to Plone 5, and gave a demo about of the UI features we have developed using the approach I discussed in my talk. Finally, I want to mention Wildcards' Kim's talk about Castle CMS, which really showcased, how much difference well lead and focused UX development for Plone based distribution could do in just about a year. Although, the fact that Castle's development had to be forked a bit from the main Plone distribution is also telling, how difficult it is to make the same UX please everyone.

Then there were many talks about the future: there's a new branch of Plone user interfaces built completely in JavaScript on top of the great Plone REST API (which Timo gave a nice presentation about). With Plone REST API it's possible to combine the great and robust CMS features of our secure Plone backend with leading edge JavaScript based frontend. It also makes Plone based solutions feasible for the current generation of frontend developers, because only very basic Plone knowledge is needed to get started. And while there is no complete replacement of Plone user interface in JavaScript yet, there are SDK like projects with many familiar UI components already for ReactJS, Angular (check Eric's talk) and even on VueJS.

If these don't feel ambitious enough, there was one more thing: Albert'stalk about Pastanaga UI – a proposal for next generation UI for generic CMSs.

Guillotina – server for a more civilized age

I'm not sure how common mistake it is, but at least we have sometimes ended up using Plone as a framework for projects, for which Plone was not really the most optimal solution. That has happened, because Plone has some very unique features we love and trust: object database with URL traversal, extremely flexible Zope Component Architecture, and very proven security model especially designed for hierarchical data.

At Barcelona conference, Nathan from Onna presented their new ”AsyncIO REST Resource Application Server” called Guillotina (open sourced through Plone Foundation)r What makes Guillotina very special and interesting is that it has all those unique features we have learned to love in Plone ”framework”, but with minimal server footprint and first class support for asynchronous programming using Python 3 AsyncIO event loop. That should allow Guillotina to go places where no Plone has gone before.

I really hope the next year brings us a suitable project to try Guillotina in practice...

There and back again

To summarize all this, here's my picture of the future of Plone on the base of Plone Conference Barcelona 2017 in three sentences:

  • Plone CMS as we know it remains here to stay – the current users remain safe with Plone
  • Plone REST API and all the UI SDKs based on it ”save Plone” by making it a feasible solution for content management related progressive web apps
  • Guillotina ”saves Plone developers” by allowing them to transfer their current Plone ”framework” knowledge into era of high-performance Python 3 AsyncIO microservices.

Obviously there was a lot more in the conference than this. There was a lot of great talks by talented speakers. It was great to see all the old friends and make some new ones. I had a chance to meet my GSOC 2017 student Oshane Bailey. And there are no parties like parties in Plone Conferences.

Thanks once again for all the organizers. It was a pleasure to be there.

We'll see if I get to see Tokyo next year...

Photo of me, Oshane Bailey and David Bain by Maik Derstappen. They said this pose is to honor Usain Bolt.

Plone Conference 2018 will be in Tokyo, Japan!

Posted by PLONE.ORG on October 27, 2017 03:33 PM

The annual Plone Conference will be held in Tokyo, Japan, on November 5 - 11, 2018!

Tokyo is a unique, exciting city of modern and traditional charms, and its infrastructure is rapidly evolving to welcome overseas guests for the Olympic and Paralympic Games in 2020. It will be the first Asian city to host the Plone Conference. The first PyCon APAC in Tokyo was held in 2013 and it attracted more than 500 participants. PyCon JP is an annual conference held in Tokyo since 2011 and the number of participants has been rapidly increasing.

tokyo leaves.png pycon apac tokyo.png

Organizers Manabu Terada, Takeshi Yamamoto, Zenichiro Yasuda, and Takanori Suzuki submitted the winning conference proposal, vetted by the Plone Foundation Board and announced at the Foundation's Annual General Meeting held last week in Barcelona.

Manabu Terada.png Takeshi Yamamoto.png Zenichiro Yasuda.png Takanori Suzuki.png

The conference will be promoted on Asian/Japanese media to grow the well-established Japanese Plone user base, and 1-day Conference tickets will be offered to increase local participation. Simultaneous translation will be provided for keynotes and other tracks. 


The Conference will be held at Ota City Plaza, a conference venue located in an area called Kamata. Kamata is famous for being the center of manufacturing and high technology of Japan. The venue is only 3 minutes-walk from Keikyu Kamata station and there are numerous hotels in walking distance. There are many restaurants and bars (or “Izakaya”, a Japanese pub) for local people to enjoy, so the participants can enjoy Tokyo’s nightlife at a reasonable price while indulging themselves in the local atmosphere.

Ota City Plaza.png

Two large halls will accommodate more than 300 in theater style each at the Ota City Plaza. Aside from these halls, there are 8 conference rooms which have the capacity for holding training, breakouts and tutorials. Microphone (wired and wireless), projector and screen are prepared for all halls and conference rooms.

Conference Track Themes

  • Python Web (Django, Pyramid, WSGI and more)
  • Frontend (JavaScript, Design)
  • Database (ZODB, NEO, SQLAlchemy, MySQL, PostgreSQL and more)

Training – November 5 (Mon) to 6 (Tue), 2018 (2 days)

Training will be held at the Ota City Industrial Plaza, which is also the venue for the Conference. Training will consist of 3 to 4 sessions, led by professionals who are globally known for their achievement. There will be a session in Japanese for local users. Wifi will be available for participants. 

Conference – November 7 (Wed) to 9 (Fri), 2018 (3 days)

The Conference will consist of 3 tracks. Each day's program will follow a theme. One of the keynotes will be given by a Japanese speaker known for their accomplishments (it will be simultaneously translated into English). In order to increase the number of local participants, in addition to the 3 tracks, there will be an entire track in Japanese presented by well-known Japanese speakers. 

Sprint – November 10 (Sat) to 11 (Sun), 2018 (2 days)

As always, sprints will be a part of the conference schedule and will be open for all (not limited to conference ticket purchasers). 

Overview of Tokyo

tokyo 3.png

Tokyo, Japan’s bustling capital city, is a modern, vibrant megalopolis which combines business, knowledge, creativity, and innovation. The city is the epitome of fusion where over 400 years of history and Japanese tradition juxtapose, providing a unique experience for all visitors. There is always something for everyone — visitors can choose from over 100,000 restaurants, enjoy any one of its 80 plus parks, immerse in the aesthetics of the Japanese tea ceremony, or indulge in a night of unique Japanese culture at a Kabuki theatre. For the 2016 instalment of its annual Quality of Life Survey, Monocle magazine has ranked the livability of some of the world's largest cities according to 22 metrics, with Tokyo coming out the top of the list.

tokyo 2.png

Host City of the Olympic and Paralympic Games in 2020

Tokyo will be hosting the Olympic and Paralympic Games in 2020. The city is rapidly enhancing its infrastructure, and the number of flights of both Haneda International Airport & Narita International Airport is expanding towards 2020.

Safest city in the world

Japan has a notably low violent crime rate amongst the 192 U.N. countries, according to the survey of UNODC (United Nations Office on Drugs and Crime). Visitors can walk the streets and feel completely comfortable even at night time. Many international visitors have wonderful stories of returned lost wallets with everything intact. Police boxes are scattered around the city and at most train stations and major city intersections. The Safe Cities Index 2015, compiled by the Economist, ranks Tokyo at the top in terms of digital security, health security, infrastructure and personal safety. The country is hospitable, clean, prompt, polite, and efficient and the tap water is safe for drinking. Therefore, it has never been heard that attendees of conferences in Tokyo became a victim of any crime.

Access to the venue from the airport

Tokyo provides great direct air accessibility for overseas travellers and is served by two international airports: Narita and Haneda. Narita International Airport offers over 1,610 international flights per week from 103 cities around the world, while Tokyo International Airport (Haneda) offers over 760 international flights per week from 31 major cities.


  • Largest number of flight arrivals/departures in Japan, serving 80 million passengers a year
  • Located in the city center, 25 minutes to Tokyo Station
  • Over 760 international arrivals per week
  • Connected with 31 cities around the world with plans for increase
  • 39 international airlines serve the Airport
  • 1 international terminal and 2 domestic terminals
  • 7 km from proposed venue and surrounding hotels


  • 2nd largest and busiest airport in Japan, serving 39 million passengers a year
  • Connected with 103 cities worldwide
  • 88 international airlines serve the Airport
  • Three international passenger terminals
  • 80 km from the proposed venue and surrounding hotels

Access to the venue from the airport.jpg

Access to the venue from the airport chart.jpg


Tokyo offers more than 98,000 rooms ranging from budget accommodation to five-star luxury hotels, all assuring friendly and high-quality service to guests. There are 4,500 rooms within 15 minutes-walk or train ride from the venue. There are also Airbnb possibilities, capsule hotels and guest houses. These budget accommodations cost approximately USD 30 at the lowest.

Map of hotels around the venue.jpg

Restaurants and bars

During the Conference, lunch will be prepared, but the attendees also have plenty of choices around the venue. There are many restaurants and bars in Kamata where local people gather. Kamata is also famous for its local shopping avenue, and you can feel the vivid atmosphere of Japan’s downtown.

tokyo food 2.png tokyo food 1.png

Cost of Living

Tokyo offers quality goods and services suited for all budgets, and participants are sure to find good value for money. Although Tokyo used to be recognized as one of the most expensive cities in the world, prices are no longer high compared with other big cities. To satisfy the demanding taste buds of locals and international visitors, restaurants, cafes and bars strive to serve quality food and drinks at affordable prices.

sample lunch prices.png

sample dinner prices.png

Social Program

For the social program during the Conference, Tokyo offers various venues at reasonable prices.


The Tokyo Metropolitan Government and TCVB will offer in-kind support, providing a Japanese Entertainment Program (i.e., Japanese Drum performance, Ninja performance, Japanese “Awaodori” Dance performance, to be decided later) at the conference social event.


Entry Requirements

Japan has a visa waiver agreement with 68 countries and regions, where participants can enter the country for a short-term stay with a valid passport. The following is the list of countries which are included in the visa waiver programme with Japan (this information is correct as of August 2018). The period of stay granted at the time of the landing is 90 days unless indicated otherwise. For participants who require a visa, we will provide an invitation letter to registered participants.

Visa Waiver Programme.jpg

* For details, please refer to the website of the Ministry of Foreign Affairs of Japan.


tokyo trees.png

Building instant features with advanced Plone themes

Posted by Asko Soukka on October 23, 2017 08:26 PM

Plone, ”The Ultimate Enterprise CMS”, ships with built-in batteries for building sophisticated content management solutions without writing a single line of new Python code. For example, a fresh installation of Plone allows to build custom structured content types with custom HTML views, define custom state based workflows, customize various user interface elements, and finish the user experience by configuring custom event triggered content rules to react on users' actions. Not to mention the Diazo based theming tool, which allows unlimited tweaking of the resulting HTML.

All this by just clicking and typing things through-the-web (TTW) with your browser.

Yet, still some say that Plone is a difficult to customize and extend.

The flip side of customizing Plone TTW is that it's way too easy to lost track of your customizations. That adds to technical debt and therefore cost of maintaining those customizations over years and upgrades to future Plone releases. The suggested solution to avoid those problems has long been to avoid TTW customizations altogether, in favor of customizing everything using ”buildout-installed file-system Python packages”. But that makes customizing Plone feel unnecessary difficult and technical.

At Plone Conference 2017 I gave a talk, where I showed an alternative way for this: if it was possible to bundle all those customizations together, for example in TTW managed theme, maintaining those customizations would no longer be the blocker.

Customizing Plone could be made easy again.


Technically, Plone has supported exporting and importing most of the possible TTW customizations for more than ten years, but the user interface for that has been cumbersomely technical. Finally, Plone 4.1 introduced a new Diazo based theming feature with easy to use theming control panel and theme editor. And now, with only a couple of extra packages in your Plone setup, Plone theming features get super powers to apply site customizations with any theme.

To complete the following example, you need a Plone site with these two extra Python packages installed: collective.themesitesetup and collective.themefragments.

As usual, those can be installed by customizing and running buildout

eggs =

or you can try out with the official Plone docker image:

$ docker run -p 8080:8080 -e PLONE_ADDONS="collective.themesitesetup collective.themefragments" plone fg

Case of the day: Wall of images

As an example feature, we build a simple folder view that displays a list of varying size images in an optimal grid layout using popular Masonry.jslayout library, with help an another library called imagesLoaded.

To summarize, building that view requires:

  • Providing JS bundles for both Masonry and imagesLoaded
  • Registering those bundles into Plone resource registry
  • A folder view template that renders images in that folder
  • Way to configure that view on a folder
  • JS code to initialize Masonry layout on that view

Getting started with theming

To get a fast start, we create a dummy theme base named demotheme that simply re-uses styles and rules from Barceloneta, the default theme of Plone 5. Your theme base should contain the following files:

  • ./index.html
  • ./rules.xml
  • ./scripts.js
  • ./styles.css
  • ./manifest.cfg

At first, ./index.html is just a copy of the same theme file from Barceloneta:

<!doctype html>
<title>Plone Theme</title>
<link rel="shortcut icon" type="image/x-icon"
href="++theme++barceloneta/barceloneta-favicon.ico" />
<link rel="apple-touch-icon"
href="++theme++barceloneta/barceloneta-apple-touch-icon.png" />
<link rel="apple-touch-icon-precomposed" sizes="144x144"
href="++theme++barceloneta/barceloneta-apple-touch-icon-144x144-precomposed.png" />
<link rel="apple-touch-icon-precomposed" sizes="114x114"
href="++theme++barceloneta/barceloneta-apple-touch-icon-114x114-precomposed.png" />
<link rel="apple-touch-icon-precomposed" sizes="72x72"
href="++theme++barceloneta/barceloneta-apple-touch-icon-72x72-precomposed.png" />
<link rel="apple-touch-icon-precomposed" sizes="57x57"
href="++theme++barceloneta/barceloneta-apple-touch-icon-57x57-precomposed.png" />
<link rel="apple-touch-icon-precomposed"
href="++theme++barceloneta/barceloneta-apple-touch-icon-precomposed.png" />
<section id="portal-toolbar">
<div class="outer-wrapper">
<header id="content-header">
<div class="container">
<header id="portal-top">
<div id="anonymous-actions">
<div id="mainnavigation-wrapper">
<div id="mainnavigation">
<div id="hero" class="principal">
<div class="container">
<div class="gigantic">
<div id="above-content-wrapper">
<div id="above-content">
<div class="container">
<div class="row">
<aside id="global_statusmessage"></aside>
<main id="main-container" class="row row-offcanvas row-offcanvas-right">
<div id="column1-container">
<div id="content-container">
<div id="column2-container">
</div> <!--/outer-wrapper -->
<footer id="portal-footer-wrapper">
<div class="container" id="portal-footer"></div>

Then, ./rules.xml does nothing more than includes the existing rules directly from the always available Barceloneta theme:

<?xml version="1.0" encoding="UTF-8"?>

<!-- Import Barceloneta rules -->
<xi:include href="++theme++barceloneta/rules.xml" />


File ./scripts.js starts empty and file ./styles.css with the following content to reuse styles from Barceloneta theme:

@import "../++theme++barceloneta/less/barceloneta-compiled.css";

.plone-breadcrumb ol {
padding: 18px 0;
font-size: 14px;

They both should be registered as the implicit ”theme bundle” (or ”Diazo-bundle”) in ./manifest.cfg by setting production-css and production-js attributes as follows:

title = Demo Theme
description =
production-css = /++theme++demotheme/styles.css
production-js = /++theme++demotheme/scripts.js

Saving these files and enabling the theme should already give the basic Barceloneta experience. But let's continue to extend it with our special feature...

Registering Masonry.js bundles

Plone 5 resource registry supports many ways to configure new front end resources. We go with the easy way by simply downloading the 3rd party JS distributions and registering them mostly as such for Plone with the following steps:

  1. Create folder ./bundles into theme to keep the required front-end bundles separate from the other theme files

  2. Download the official minified Masonry.js distribution and save it as ./bundles/masonry.pkgd.min.js

  3. Download the official minified imagesLoaded distribution and save it as ./bundles/imagesloaded.pkgd.min.js

  4. Edit both of the previous files by adding line

    (function() { var require, define;

    into the beginning of the file, and line


    into the end of the file. These are required for any ”AMD packaged” JS distribution to work in Plone's Require.js based JS environment.

  5. Add two empty files ./bundles/masonry.pkgd.min.css and ./bundles/imagesloaded.pkgd.min.css for pleasing the Plone resource registry in the next step.

  6. Create folder ./install with file ./install/registry.xml with the following contents to register the above bundles into Plone resource registry:

    <?xml version="1.0"?>
    <records prefix="plone.bundles/imagesloaded-js"
    <value key="depends">plone</value>
    <value key="jscompilation">++theme++demotheme/bundles/imagesloaded.pkgd.min.js</value>
    <value key="csscompilation">++theme++demotheme/bundles/imagesloaded.pkgd.min.css</value>
    <value key="last_compilation">2017-10-06 00:00:00</value>
    <value key="compile">False</value>
    <value key="enabled">True</value>
    <records prefix="plone.bundles/masonry-js"
    <value key="depends">imagesloaded-js</value>
    <value key="jscompilation">++theme++demotheme/bundles/masonry.pkgd.min.js</value>
    <value key="csscompilation">++theme++demotheme/bundles/masonry.pkgd.min.css</value>
    <value key="last_compilation">2017-10-06 00:00:00</value>
    <value key="compile">False</value>
    <value key="enabled">True</value>

Now, once edited theme files are saved and the theme re-activated or updated, thanks to collective.themesitesetup, every response from our site should include our these new resources.

Creating a folder view with list of images

Creating a view with collective.themefragments is similar for writing any view template for Plone. Simply add a folder ./fragments into your theme with our example view ./fragments/ with the following contents:

<html xmlns="" xml:lang="en"
<metal:main fill-slot="main">
<metal:content-core define-macro="content-core">
<div class="wall-of-images container-fluid"
tal:define="items context/@@contentlisting">
<tal:image tal:repeat="item items">
<img tal:define="obj item/getObject;
scale_func obj/@@images;
scaled_image python:scale_func.scale('image', scale='preview')"

tal:replace="structure python:scaled_image.tag()"
tal:on-error="string:error" />

Please, note, how the view template uses API for iterating through every item in the folder and then API for rendering image tags for scaled images. Also, note the use of tal:on-error to suppress all possible error messages (you may not always want that, though).

Enabling the view on a site

Unfortunately, collective.themefragments' views do not magically appear into Plone toolbar display menu yet. Fortunately, those views can be either be set as the default view of a content type or manually assigned to a content item by setting its layout-property:

  1. At first, let's assume that we have a folder


  2. Then, let's open the good old properties edit form for it


  3. Finally, let's add a new property of type string with name layoutand value ++themefragment++wall_of_images

Now the content should be rendered using our brand new template, displaying all the images one after one. It still does not look as intended, though, because nothing enables Masonry.js for it.

Invoking Masonry.js on the view

To enable Masonry.js on our brand new view, we could add the following code into a theme file ./scripts.js:

jQuery(function($) {
$('.wall-of-images').imagesLoaded(function() {
itemSelector: 'img',
percentPosition: true

That code simply uses jQuery to find our view templates main element and configures Masonry.js for it after every image below it has been loaded.

An alternative for that jQuery script would be to rely on Plone's Require.js setup and define the code as a pattern:

], function(Base) {
'use strict';

var Masonry = Base.extend({
name: 'masonry',
trigger: '.wall-of-images',

init: function() {
var self = this;
self.$el.imagesLoaded(function() {
itemSelector: 'img',
percentPosition: true

return Masonry;

But something is still missing. Masonry.js is distributed without any default styles. To make our wall of images look as it should, we need to define responsive styles with our desired breakpoints in ./styles.css:

@media only screen {
.wall-of-images {
padding-left: 0;
padding-right: 0;
margin-top: -20px;
.wall-of-images img {
float: left;
width: 100%;
height: auto;
border: 5px solid transparent;

@media only screen and (min-width: 768px) {
.wall-of-images img {
float: left;
width: 50%;
height: auto;

@media screen and (min-width: 900px) {
.wall-of-images img {
float: left;
width: 33.3333333%;
height: auto;

@media screen and (min-width: 1200px) {
.wall-of-images img {
float: left;
width: 25%;
height: auto;

Finally, we'd like to make our wall of images be displayed on full browser window width. That's a bit tricky, because we need to escape Barceloneta theme's default content container, but still fully possible by adding the following Diazo rules into ./rules.xml:

<!-- Wall of Images -->
<rules css:if-content=".wall-of-images">
<!-- Make fullwidth -->
<replace css:theme=".outer-wrapper > .container"
css:content=".wall-of-images" />
<!-- Include status message -->
<before css:theme=".outer-wrapper > .container"
css:if-content=".wall-of-images" />
<replace css:content="#global_statusmessage">
<div id="global_statusmessage" class="container-fluid">
<xsl:apply-templates />

Now our wall of images shines in every resolution:

PS. If want to learn more, my talk materials include a more complex example with custom content types, workflows, permissions, portlet assignments and content rules.

Summary of Plone Conference 2017

Posted by CodeSyntax on October 23, 2017 11:18 AM
It is hard to summarize an event like this year Plone Conference. The number of talks, events and trainings, and the quality of them make it hard to explain everything, but I will try to give an overview.

Sprint wrap-up Sunday

Posted by Maurits van Rees on October 22, 2017 02:04 PM

Sprint document is on Google Docs.

  • Pyramid: a few more documentation updates.
  • Plone and Zope 4. Down to seven failing tests, very good. Everything is merged, the master branch of CMFPlone is using Zope4, the PLIP job is gone.
  • Plone to Python 3. We decides to use six, which is a dependency of Zope anyway. Lots of PRs. Experimenting with sixer, which 'sixifies' the code automatically. GenericSetup: slowly working through incompatibilities.
  • Plone rest api. Some issues solved. stores start and end date timezone aware, and the rest of the dates are timezone naive, and there is no hint in the schema on what is naive or not, so that gives us problems, evaluating how to fix it.
  • VueJS SDK. Implementing traversal. Creating edit forms out of schema. You can add views with a plugin. Automatic testing with Travis is setup. Next: component. Editor.
  • Pastanaga Angular. plone/pastanaga-angular. Demo time! mr.developer work done.
  •, creating mocks.
  • Guillotina, made pastanaga-angular work with guillotina, you can login, browse content, navigation. guillotina_cms layer. Robot framework tests, with robotframework.guillotina for test setup.
  • Plone CLI. I can show you. Main setup is in place. plonecli create addon collective.todo; plonecli build; plonecli serve. Or in one command: plonecli create addon collective.todo build serve.
  • WSGI in plone.recipe.zope2instance. All merged. Python 3 compatible.
  • websauna. Pyramid 1.9 support is 100% done. In another week we can release a new version.
  • pas.plugins.ldap. Problem that tests are not running on Travis. We now know what is happen, but not yet why, when half a year ago it worked. We got LDAP running locally on Mac, so it becomes easier to test and fix.
  • upgrade guide, just came in, documented one PLIP.
  • JSON Schema Builder with JavaScript. Demo time! You can click a form together, save it as json, and view it with Angular. From there you could save or mail the filled in data. You can do validation. We have collective.easyform which is Plone only, but this is more general: it's just json on the back end and front end. [Very impressive!]
  • Update XML-RPC to support dexterity. First pull request done.
  • Mixed bag. Removed all robot screen shots from documentation, they live under CMFPlone now, making it easier for others to write and test. Mixed results from Chrome and PhantomJS, also changing from version to version. With that, for papyrus, our documentation build system, we no longer need to build Plone.

Sprint wrap-up Saturday

Posted by Maurits van Rees on October 21, 2017 03:32 PM

Sprint document is on Google Docs.

  • Working on moving Pylons to the Plone Foundation. Tedious, painstaking work. PRs for documentation and some bugs.
  • Eric made coredev branch 5.2. Merged Zope 4 PLIP changes into that. Same amount of failures as yesterday, working on getting the build green. Work on porting databases, some mosaic problems are being fixed, most add-ons are okay. Wrote documentation for some code changes you have to do.
  • Plone to Python 3. We tried to fix all the imports in all the Plone packages that break on Python 3. Long list of PRs in the Google Doc. GenericSetup Python 3 branch that we first got to work on Python 2 again. Working through the usual string issues. Some semantic issues for PropertyManagers that we need to fix in Zope first. Gil made a list of which packages are not Python 3 yet, already in June, we ask him to update it.
  • Plone rest api. Problem with root users. There is a PR which disables that, but I have a workaround ready now.
  • VueJS SDK. plone.vuejs package, but may be renamed. Just basic stuff. Test setup. Started on some features, like traversal.
  • Pastanaga Angular. Travis setup. Universal. A mr.developer for Angular. Login form is done. Work on API and SDK.
  • Pastanaga React. Struggling with several issues.
  •, talking about license, fund raising.
  • Guillotina some work done, PR.
  • Plone CLI. Front end working. Fixing stuff in bobtemplates.
  • WSGI in plone.recipe.zope2instance. PR merged into master. Should be there in Plone 5.2. Support in the core buildout for the WSGI parts: wsgi.cfg config file. Basically done.
  • websauna. Pyramid 1.9 support is 80% done. Work on cookie cutter template to support Docker images. Will become easier to startup.
  • improvements, made mockups to make packages more visible. Set of icons will be reviewed. Should be discussed with website team. Make the listing more emotional.
  • pas.plugins.ldap. Fred chatted with Jens how we can merge back improvements from Asko and Zest. Documentation, that might be later merged to Also some collective.recipe.solr work.
  • upgrade guide, worked on documenting the PLIPs, restructuring a bit
  • JSON Schema Builder with JavaScript. Browser view with drag and drop, save in dexterity object. Angular app that traverses to the end point of the schema. Missing is the order of the fields which is not correct, and actions.
  • Mixed bag. Fixes for, new theme release with better version dropdown. Meeting with Manabu to talk about Tokyo. Server consolidation planning. Contributor agreements signed, 2.5 of them.

Lightning talks Friday

Posted by Maurits van Rees on October 20, 2017 04:07 PM

Andreas Jung: Collaborative content creation with smashdocs

Web based collaborative editor. Better than Google docs: it can be hosted by yourself. Intelligent documents. HTML and XML export. Tracking of changes. Chat and discussion. Docx import and export Integrates with the Plone sharing tab. Content life cycle indicator.


Naoki Nakanishi: Microcontrollers and Plone

I work at CMScom and I like IoT (Internet of Things). Microcontrollers can connect to Plone easily. This is because Plone has RESTful API products. We program the microcontrollers with the MicroPython language. This has the useful urequest and ujson modules. It supports many microcontrollers. I have a rough concept, but I will start to develop this from tomorrow.

Maik Derstappen: bobtemplates.plone

I have been working on bobtemplates.plone:

mrbob bobtemplates.plone:addon -O collective.todo

You can now actually add a content type in an existing package, using a sub template. It will currently overwrite code, so you want to start with a clean git checkout.

See my talk this afternoon.

Unrelated: Plone Tagung 2018 is planned on 20 March in Berlin. Main topics of this conference will be in German, but if others want to join in English, you are welcome.

Érico Andrei: several packages

  • contentrules.slack: post to a slack channel when something happens in your Plone Site.
  • collective.selectivelogin: restrict login

Alexander and Sally: Plone 5 add-ons

We had nominations and votes for Plone 5 add-ons. We had problems with losing the papers where you could vote, so this is with a grain of salt. The top results:

  1. plone.restapi
  2. eea.facetednavigation
  4. collective.easyform

On we have a list of add-ons which are managed by hand. There is a list of Plone releases, where the versions are not sorted right (alphabetically, so 1, 10, 11, 2, 3, etc). So this needs to be improved. During Google Summer of Code work was done here, getting information from PyPI. It still needs work, especially design work can help a lot, to present is nicer.

Nathan and Ramon: Docker, guillotina

Docker Compose is the new buildout? This might be a pattern that works for you.

We have a CMS on top of guillotina:

Lots of other packages:

Charles Beebe: Inclusion > Diversity

Inclusion is more than diversity.

Thank you all, this is my first Plone conference and I felt welcome. I never thought I would feel comfortable to do a presentation the first time I came to a conference.

Have you ever felt uncomfortable during a conference?

You may 'cover' yourself, hiding something of you. That does not help. Even 45 percent of white males in America do this. Do you make people feel at home? It does not have to be complicated. I got a cake from my colleagues when I got engaged.

Philip: Plone 2020

Plone 5.1 master branch with small changes works on Zope 4.

In Brasil Paul Everitt said: "You are dragging the dead body of Zope with you." In 2020 Python 2 is no longer supported.

We investigated and found out that Zope is actually not dead. Plone 5.2 will use Zope 4, discussed yesterday.

Plone minus Archetypes minus ZServer plus Python 3 will be some Plone version.

Some sprint will focus on this area:

  • Alpine City Sprint Innsbruck in January 2018
  • Amsterdam Spring 2018

Where we are now, felt impossible in Brasil 2013.

Roel Bruggink: demo of Plone

Plone demo, logging in, view documents, view history, view changes, edit, site setup, display menus.

What you see here, is bits of Pastanaga and bits of React front end.

Oshane: Plone theme editor

I worked on the theme editor during the GSOC (Google Summer of Code). I will give a demo. Contextual menu for renaming or moving files. Find a file by its name, or find text within files and go to that exact line. Drag and drop files. Import rapido apps.

Mikko Hursti: list customisation

I worked on improving the list customisation using mosaic during the GSOC.

See my final report.

Manabu Terada: Plone conference 2018 Tokyo

The Plone conference 2018 is going to be in Tokyo, Japan. Tokyo does not start with a B, but it has a Bay area, so is it okay?

Two years ago, we had the Plone Symposium Tokyo. PyconJP 2017 in September had lots of visitors.


  • English OK? Yes
  • Expensive? No, food and hotel not. Taxi, sushi, beer: a bit.
  • Safe? Yes. In 2020 we have Olympic Games.

See you next year in Tokyo, 5 to 11 November.

Ramon and Victor: Goodbye

Thank you for coming, good party, good to see new faces from other communities. I hope we keep following this path of opening up to other communities. Glad that it was safe, with all that is going on in Catalunya. We are very happy about organising this.

Thank you Agata, my beautiful wife. Thank you Timo for allowing me to spend an insane amount of time on the conference. Thank you Albert Casado for the beautiful design. Thank you Kim for all your work. Thank you to sponsors, people filling the bags, Sally, Eric, volunteers, time keepers, thanks all for joining us. It was a once in a life time experience. Hope to see you soon in the Plone world.

Éric Bréhault: Building a Cathedral Over Decades

Posted by Maurits van Rees on October 20, 2017 02:38 PM

When you build a CMS, you might start small, but you end up with a very large stack. For Plone, some of this stack is more than fifteen years old.

What do we want to work on for the future? Zope 4! Guillotina! Headless CMS! Everything! So many challenges and huge projects! In a business situation you would probably say this is bad. So why is Plone still alive? Emotions and culture.


A software developer feels like a parent to his code. An open source community is like a shared parent group. Why does this work? Love.

Open source is not business. I can prove that. Business means you are busy. Busy means you are not free. Not free means you are not open. Clear.

The business world talks about disruption. It is violent. Okay for the business world.

Business values a 10x developer. Open source knows: the only way to be a 10x developer, is to have ten developers be twice as good.

Nine couples cannot make one baby in one month. One couple makes a baby in nine months, and it takes a village to raise the baby. Open source community.

Results versus process. Process provides emotions. Results provide money.

Developing with each other is sharing emotion. The Plone community is not just sharing code, it is sharing emotions. It feels good to share.

Empathy: feel what someone else is feeling. It is not something that you decide to do. Empathy makes it possible to share emotions. Empathy is the first open source process.

We are emotion addicts. This is true for Plone developers just as much as for Justin Bieber fans.

I think people are altruists by nature, not egoists. We want to do something for another. Our need for emotion is bigger than our need for money.

Emotion is why Plone is still alive.


Culture is how Plone is still alive.

Our everyday miracle is: pluggability. This comes at a price. Would we release a module without tests, or with a funky css selector? No. People who build Plone add-ons are following the rules, so it is safe to install.

Old Greeks had the word 'Pharmaka' for something that heals, but can also be dangerous. 'Per aspera ad astra': through difficulties to the stars. We give core commit rights to anyone who wants to join us.

The Plone community as a whole has knowledge, a diamond mine.

Building a cathedral

Plone is like the Sagrada Familia. It was created by someone who has left, and it is still being built.