eea.kitkat

The eea.kitkat Plone add-on is a backend support for volto-eea-kitkat.

Included Plone Add-ons

eea.cache

eea.banner

eea.zotero

eea.api.layout

eea.geolocation

eea.coremetadata

eea.schema.slate

eea.sentry

eea.volto.policy

plone.volto

plone.restapi

collective.taxonomy

Main features

Easy to install/uninstall via Site Setup > Add-ons.
Will install a bundle of add-ons all together.
Will guarantee the integration between all the included add-ons.

Install

Add eea.kitkat to your eggs section in your buildout and re-run buildout:
```
[buildout]
eggs +=
  eea.kitkat
```
You can download a sample buildout from:
- https://github.com/eea/eea.kitkat/tree/master/buildouts/plone4
- https://github.com/eea/eea.kitkat/tree/master/buildouts/plone5

Or via docker:

$ docker run --rm -p 8080:8080 -e ADDONS="eea.kitkat" plone

Install eea.kitkat within Site Setup > Add-ons

Plone versions

It has been developed and tested for Plone 4 and 5. See buildouts section above.

How to contribute

See the contribution guidelines (CONTRIBUTING.md).

eea.kitkat (the Original Code) is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.

Funding

EEA - European Environment Agency (EU)

Secret Scanning

This repository uses the Betterleaks GitHub Action to scan the current repository content on every push and pull request. The scan uses the rules in .gitleaks.toml and uploads a betterleaks-report artifact when a finding is detected.

If the optional SMTP secrets are configured, failed scans also send an email to the last commit committer. The workflow expects these repository or organization secrets:

SMTP_URL
SMTP_PORT (optional, defaults to 25)
SMTP_EMAIL
SMTP_PASSWORD (optional if the SMTP server does not require authentication)

Port 465 is sent with direct TLS; other ports use the default SMTP handshake. The email includes a short finding summary from the redacted Betterleaks report, including the redacted matched line from each finding.

There are three common outcomes:

Everything is OK. The Betterleaks / Scan for secrets check is green and no action is needed. Regular references to runtime values are OK, for example:
```
token_from_cookie = request.cookies.get("auth_token")
```
A real secret was found. The check is red and the workflow log asks you to download the betterleaks-report artifact. Open the artifact from the GitHub Actions run and check the reported file, line and rule. Remove the committed value, move it to the proper secret store, and rotate it if it was exposed. A report entry looks like this:
```
{
  "RuleID": "secret-literal-assignment",
  "File": "src/config.py",
  "StartLine": 12,
  "Secret": "[REDACTED]"
}
```
The finding is a false positive. Keep the value only if it is clearly not sensitive, such as a test fixture, placeholder, or public example. Add betterleaks:allow on the same line and include a short explanation in the pull request:
```
test_password = "admin"  #betterleaks:allow
```

Do not add betterleaks:allow to real credentials.

Changelog

8.5 - (2026-07-13)

Change: fix: SonarQube report - refs #305404 [avoinea]

8.4 - (2026-04-14)

Change: Add integration tests for captchakey and CaptchaVerify [avoinea]

8.3 - (2025-11-18)

Change: Replace Python linting to ruff [mihaidobrescu1111 = refs #286821]
Change: Add plone6 tests [mihaidobrescu1111 = refs #293593]

8.2 - (2025-09-19)

Change: Fix: use plone.volto:default profile instead of default-homepage [nileshgulia1]

8.1 - (2024-05-09)

Change: Develop [alecghica]

8.0 - (2024-03-15)

Refactor: Move Version overview related code to eea.api.controlpanel [avoinea - refs #264531]

7.0 - (2023-10-18)

Breaking: Remove pas.plugin.oidc dependency [avoinea - refs #258877]

6.2 - (2023-06-06)

Change: View comments permission only for authenticated [dobri1408 - refs #251360]

6.1 - (2023-06-01)

Bug fix: Hide Footer Login action if user is logged-in [avoinea - refs #253198]

6.0 - (2023-05-31)

Refactor: Remove eea.api.taxonomy dependency [nileshgulia1 - refs #145360]

5.0 - (2023-05-05)

Task: Remove eea.cache dependency [iulianpetchesi - refs #251471]

4.7 - (2023-01-31)

Task: Add endpoint in order to get the captcha key from registry [iulianpetchesi - refs #157143]

4.6 - (2023-01-30)

Change: Modify endpoint permission [iulianpetchesi - refs #157143]

4.5 - (2023-01-30)

Task: Return true/false for captcha post [iulianpetchesi refs #157143]

4.4 - (2023-01-27)

Task: Add missing IEeaKitkatLayer for captcha restapi [iulianpetchesi refs #157143]

4.3 - (2023-01-20)

Feature: Send captcha data as bytes, add @captchaverify endpoints [iulianpetchesi refs #157143]

4.2 - (2023-01-12)

Feature: Added friendlycaptcha settings + verify to be used with redmine helpdesk block [iulianpetchesi refs #157143]

4.1 - (2022-11-25)

Feature: Add contact_extra_actions: faqs and careers [avoinea refs #151856]

4.0 - (2022-11-18)

Feature: New category actions: footer, social, copyright and contact [avoinea refs #151856]

3.1 - (2022-08-25)

Feature: Add PATCH support for @system endpoint in order to be able to update frontend version [avoinea refs #153334]

3.0 - (2022-08-23)

Feature: Added backend/frontend version registry records + automatically update the version on zope startup [iulianpetchesi refs #153334]

2.0 - (2022-06-13)

Change: Release eea.coremetadata [nileshgulia1]

1.9 - (2022-06-13)

Change: add eea.coremetadata dependency [nileshgulia1]

1.8 - (2022-03-18)

Feature: added pas.plugins.oidc as dependency [alecghica refs #137187]

1.7 - (2022-02-17)

Change: Add testing profile for cypress testing [avoinea refs #146058]

1.6 - (2022-02-15)

Change: Add eea.banner dependency [avoinea]

1.5 - (2021-12-16)

Change: Add eea.cache [avoinea refs #139888]

1.4 - (2021-11-23)

Change: Removed eea.restapi from kitkat [iulianpetchesi refs #139888]

1.3 - (2021-11-22)

Change: Added missing dependencies [iulianpetchesi refs #139888]

1.2 - (2021-11-11)

Change: Fix python version requirement [avoinea]

1.1 - (2021-11-11)

Change: Added plonesaas jenkins test [iulianpetchesi refs #139888]

1.0 - (2021-11-09)

Initial release. [eea]

Release files for eea.kitkat 8.5

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for eea.kitkat 8.5
File	Size	Uploaded
eea_kitkat-8.5.tar.gz	32.0 kB	Jul 13, 2026	Details

Release files / eea_kitkat-8.5.tar.gz

Download URL	eea_kitkat-8.5.tar.gz
Size	32.0 kB
Tags	Source
SHA-256 checksum How to use checksums	`5f7acaf75d8fe80b1baf806fab41ba103a50eff06909871ae3264970f9cb5864`
BLAKE2b-256 checksum How to use checksums	`69ad46546ca6355b313bd9db50ea7cb1b0262dc01e3260d1b8c8c6c5dddbb0ec`
Upload date	Jul 13, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.9.25`