Sane defaults to address: Deleted users keep the roles they had

[jensens]

see plone/Products.CMFPlone#3937

[mister-roboto]

@jensens thanks for creating this Pull Request and helping to improve Plone!

TL;DR: Finish pushing changes, pass all other checks, then paste a comment:

@jenkins-plone-org please run jobs

To ensure that these changes do not break other parts of Plone, the Plone test suite matrix needs to pass, but it takes 30-60 min. Other CI checks are usually much faster and the Plone Jenkins resources are limited, so when done pushing changes and all other checks pass either start all Jenkins PR jobs yourself, or simply add the comment above in this PR to start all the jobs automatically.

Happy hacking!

[jensens]

@jenkins-plone-org please run jobs

[jensens]

Probably there are some failing tests... lets see

[davisagli]

@jensens I want to do some testing in volto before I review this.

[mauritsvanrees]

I agree this makes sense security-wise. And we only do this for new sites. Should be okay for Plone 6.1.

It does deserve a mention in the upgrade docs.

It would be good to have this in a PLIP for more visibility. The PLIP does not need to have a long description. It would be good though, if that PLIP addresses your comments about how plone.api and plone.restapi behave: if we change the defaults here in plone.base, and plone.restapi and plone.api flat out ignore this, it is not very helpful.

[jensens]

if we change the defaults here in plone.base, and plone.restapi and plone.api flat out ignore this, it is not very helpful.

Because the implementation is wrong. This needs a separate fix.

[jensens]

@jenkins-plone-org please run jobs