From 265fc252290a236bcef824f5c98f47f5d5f70600 Mon Sep 17 00:00:00 2001
From: Eric BREHAULT <ebrehault@gmail.com>
Date: Mon, 23 Feb 2015 08:11:43 +0100
Subject: [PATCH 1/2] restore allowedFields filtering in
 FieldsVocabularyFactory

---
 plone/schemaeditor/fields.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/plone/schemaeditor/fields.py b/plone/schemaeditor/fields.py
index 5054c91..052304b 100644
--- a/plone/schemaeditor/fields.py
+++ b/plone/schemaeditor/fields.py
@@ -53,6 +53,9 @@ def editable(self, field):
 
 def FieldsVocabularyFactory(context):
     field_factories = getUtilitiesFor(IFieldFactory)
+    if context.allowedFields is not None:
+        field_factories = [(id, factory) for id, factory in field_factories
+                            if id in context.allowedFields]
     terms = []
     for (field_id, factory) in field_factories:
         terms.append(SimpleVocabulary.createTerm(factory,

From d37d552045852c6d4f3c7adfc28cb602e10d8bb5 Mon Sep 17 00:00:00 2001
From: Eric BREHAULT <ebrehault@gmail.com>
Date: Thu, 26 Feb 2015 19:42:39 +0100
Subject: [PATCH 2/2] add CSRF protection token

---
 CHANGES.rst                                         |  2 ++
 plone/schemaeditor/browser/schema/schema_listing.pt |  1 +
 plone/schemaeditor/browser/schema/schemaeditor.js   | 10 ++++++++--
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index f81ff7c..23c3b61 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -7,6 +7,8 @@ Changelog
 - Update markup and javscript for Plone 5.
   [davisagli]
 
+- Add CSRF protection token
+  [ebrehault]
 
 2.0.1 (2014-10-23)
 ------------------
diff --git a/plone/schemaeditor/browser/schema/schema_listing.pt b/plone/schemaeditor/browser/schema/schema_listing.pt
index 2b798b1..f019091 100644
--- a/plone/schemaeditor/browser/schema/schema_listing.pt
+++ b/plone/schemaeditor/browser/schema/schema_listing.pt
@@ -16,6 +16,7 @@
 
   <metal:form metal:use-macro="context/@@ploneform-macros/form">
     <metal:top-slot metal:fill-slot="formtop">
+      <input tal:replace="structure context/@@authenticator/authenticator" />
       <script type="text/javascript"
               tal:attributes="src context/++resource++schemaeditor.js"></script>
       <style type="text/css">
diff --git a/plone/schemaeditor/browser/schema/schemaeditor.js b/plone/schemaeditor/browser/schema/schemaeditor.js
index e0e8b33..9d145cb 100644
--- a/plone/schemaeditor/browser/schema/schemaeditor.js
+++ b/plone/schemaeditor/browser/schema/schemaeditor.js
@@ -139,7 +139,9 @@
             if (!confirm(trigger.attr('data-confirm_msg'))) {
                 return;
             }
-            $.post(trigger.attr('href'), null, function (data) {
+            $.post(trigger.attr('href'), {
+                _authenticator: $('input[name="_authenticator"]').val(),
+            }, function (data) {
                 trigger.closest('.fieldPreview').detach();
             }, 'text');
         });
@@ -147,12 +149,16 @@
         $('.fieldPreview.orderable').plone_schemaeditor_html5_sortable(function (position, fieldset_index) {
             var url = window.location.href.replace('/@@fields', '') + '/' + this.attr('data-field_id') + '/@@order';
             $.post(url, {
+                _authenticator: $('input[name="_authenticator"]').val(),
                 pos: position,
                 fieldset_index: fieldset_index
             });
         }, function (fieldset_index) {
             var url = window.location.href.replace('/@@fields', '') + '/' + this.attr('data-field_id') + '/@@changefieldset';
-            $.post(url, { fieldset_index: fieldset_index });
+            $.post(url, {
+                _authenticator: $('input[name="_authenticator"]').val(),
+                fieldset_index: fieldset_index
+            });
         });
         set_id_from_title = function () {
             var id = $.plone_schemaeditor_normalize_string($(this).val());