- Feb 07, 2023
-
-
Oliver Hader authored
This reverts commit d38764ff. Reason for revert: Release script pushed to wrong branch Change-Id: I17778c7f3e0fd7f56a8e22725b7ff02ee0149064 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77754 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Hader authored
Change-Id: I93476c966ba30ade007c8f5ada514ef3c286fad1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77740 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Oliver Hader <oliver.hader@typo3.org>
-
Benjamin Franzke authored
As already started in #88304 (but only for NormalizedParams) and later reverted in #89312 (because of cgi-bin problems), PATH_INFO is no longer considered as a preferable SCRIPT_NAME alternative. All known server configurations set SCRIPT_NAME these days to a proper value when cgi.fix_pathinfo is set. The fallback to PATH_INFO has been introduced with the initial revision of TYPO3 and isn't needed at all nowadays, it's actually wrong, as a REQUEST_URI like /index.php/foo/bar would incorrectly be interpreted as $scriptName == "/foo/bar", which let's all calculations on $scriptName fail and even leads to XSS where values derived from $scriptName are printed without being escaped. Also any ORIG_SCRIPT_NAME evaluation is dropped, as this variable contains the SCRIPT_NAME that was set by the webserver configuration before PHP applied cgi.fix_pathinfo. Using ORIG_SCRIPT_NAME effectively meant bypassing PHP's pathinfo fix. It usually contains the cgi-wrapper paths, which is why PATH_INFO was used to overrule wrong ORIG_SCRIPT_NAME values. GeneralUtility::getIndpEnv('PATH_INFO') is adapted to trust the servers PATH_INFO information, now that we no longer allow servers to send SCRIPT_NAME as PATH_INFO (we enforce cgi.fix_pathinfo=1 for CGI installations). The normalized SCRIPT_NAME is now adapted to be encoded as a URL path by default, as all TYPO3 usages expect this to be an URL path. Note that $_SERVER['SCRIPT_NAME'] refers to the servers file system path, not the URL encoded value. This SCRIPT_NAME sanitization actually enables: a) TYPO3 to be run in a subfolder that contains characters that need URL encoding e.g. `/test:site/` – url encoded that'd be `/test3Asite/`. b) prevention of XSS in case third party extensions missed to escape any URL that is derived from SCRIPT_NAME (while making sure that properly escaped output is not double escaped) Resolves: #99651 Related: #88304 Related: #89312 Releases: main, 11.5, 10.4 Change-Id: Ief95253d764665db5182a15ce8ffd02ea02ee61e Security-Bulletin: TYPO3-CORE-SA-2023-001 Security-References: CVE-2023-24814 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77739 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Benjamin Franzke authored
Make clear that the early-bail out for empty pageArguments is done to prevent setting `disableCaches` to `true`. Also makes that that the $pageNotFoundOnCacheHashError condition is really tied to pageArguments being non-empty. Prevents us from refactoring that code and missing this bit. Resolves: #99860 Related: #99859 Releases: main, 11.5, 10.4 Change-Id: I98ffa3dffe76a37970784979a2c4f2a9a64aa5bf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77735 Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Benjamin Franzke <bfr@qbus.de>
-
linawolf authored
Resolves: #99780 Releases: main Change-Id: I5e40fb8b6470c929001da06a8d1a7a7dbcaec0db Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77688 Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Lina Wolf <112@linawolf.de> Tested-by:
Lina Wolf <112@linawolf.de>
-
Oliver Hader authored
If $GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['enforceValidation'] is enabled and the HTTP request only contains the `?id` query parameter, caching for the page is disabled - which should be avoided. Resolves: #99859 Releases: main, 11.5, 10.4 Change-Id: I14a81f5a2ec3ecabedd1abf0756a3ee32e7af4e4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77728 Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech>
-
- Feb 06, 2023
-
-
Christian Kuhn authored
A broken boolean toggle introduced with #99282 prevents page cache hits in FE under various conditions. Resolves: #99857 Related: #99282 Releases: main Change-Id: I49066f10bb27c872ebfa9ebce52d76f9cd46f05c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77727 Tested-by:
Nikita Hovratov <nikita.h@live.de> Reviewed-by:
Jochen <rothjochen@gmail.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Jochen <rothjochen@gmail.com> Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christoph Lehmann <christoph.lehmann@networkteam.com>
-
Christian Kuhn authored
This reverts commit b8151562. Reason for revert: Adding stdWrap to TS top-level 'config' object gives headaches with fully-cached page access. ContentObjectRenderer is not available in this context, so COR->stdWrap() fails. Change-Id: I895ea267da31845660dd07b6f8cfe50d0c5cef69 Resolves: #99858 Related: #99340 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77583 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Nikita Hovratov <nikita.h@live.de> Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Christoph Lehmann <christoph.lehmann@networkteam.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Christoph Lehmann <christoph.lehmann@networkteam.com> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Annett Jähnichen authored
To provide a streamlined look&feel of record tables in the record list, their table header's background color now matches those of panels, e.g. the "Clipboard" at the very bottom. For the same reason, a box-shadow is applied. To achieve a better visual separation, the table margin is increased. Resolves: #99727 Releases: main Change-Id: I7a64a6c2e3373f956a506630741628b20729b7a4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77611 Tested-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com> Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
Benni Mack <benni@typo3.org>
-
Christian Kuhn authored
With the first rewrite of the install tool in 2013, Check.php came with a class comment the class shouldn't have *any* dependencies at all. It of course didn't take long until this was violated. Ten years later, the comment is totally outdated and adapted with the patch a bit to be less awkward. Resolves: #99848 Releases: main Change-Id: I8d1fd5358c5dbacaa063494cb3d2702aa2bb3142 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77715 Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Christian Kuhn authored
The comment in ext:install/Resources/Private/Php/install.php has been established with the very first rewrite of the install tool in 2013. After a series of further rewrites and adaptions it is nowadays pretty much completely outdated and fits no good purpose anymore. Let's get rid of it. Resolves: #99850 Releases: main Change-Id: Id778b6f4cfaa23c725d2b61ef8e9b43c86a2db23 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77716 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Benni Mack <benni@typo3.org>
-
Markus Klein authored
Extbase does not ask the database anymore for relations, where the uid in the database field is zero. This prevents SQL queries with where-parts like `uid IN (0)`. Since this is done when reconstituting models from the database, depending on the amount of relations of a model, the number of saved queries is huge. Resolves: #99505 Releases: main, 11.5 Change-Id: If3b6c2756674eeb43a66b59a13e44011c9845cd5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77316 Reviewed-by:
Stephan Großberndt <stephan.grossberndt@typo3.org> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Stefan Froemken <froemken@gmail.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stephan Großberndt <stephan.grossberndt@typo3.org>
-
Benni Mack authored
When no cHash is given but GET parameters are handed in which _would_ require cHash parameters, these are now properly evaluated during the frontend request. As this has a security impact, a new option called $GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['enforceValidation'] is introduced, which then skips the "requireCacheHashPresenceParameters" option. The latter is an include list, but cache Hash calculation should rather be based on the exclude list such as "excludedParameters" and "cachedParametersWhiteList". If the new option is set, but some properties such as tx_solr[q] should be allowed, then this needs to be added to the excludedList ("excludedParameters") by extension authors. A new test "SlugSiteWithoutRequiredCHashRequestTest" is added which works with a disabled feature flag compared to "SlugSiteRequestTest" which has the feature flag enabled. Resolves: #95297 Releases: main, 11.5, 10.4 Change-Id: Ib72c6a34602e77d8c2044ad2e826c0474ebd2326 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77206 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
core-ci <typo3@b13.com>
-
Max Kellermann authored
Various libraries incorporated by TYPO3 use the "token_get_all" function, crashing PHP execution if the "tokenizer" extension is not loaded. The system environment pre-check now checks the presence of the PHP extension. Also, Composer now requires the presence of the `ext-tokenizer` module. Releases: main Resolves: #99842 Change-Id: I57cb6244d8eb3d8364eae5d23430370e60fd9658 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77711 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Markus Klein <markus.klein@typo3.org> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Benni Mack <benni@typo3.org>
-
Jochen Roth authored
Additional warning about password set via cli has been added. Also the logic was changed to always prompt for password (db password and admin user password) if not set via variable/option. Resolves: #99836 Releases: main Change-Id: Ic47e100ecb328ac62b58296bc00feff9a84213aa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77707 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Andreas Fernandez authored
The class `TYPO3\CMS\Backend\Template\Components\Buttons\GenericButton` accidentally applied the wrong CSS classes on the rendered button. This bugfix now applies the correct classes for buttons and provides setter and getter methods for classes. Resolves: #99841 Related: #99806 Releases: main Change-Id: I3125a1208481da3d488b50847978171ca0b1f2bb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77710 Tested-by:
Benjamin Kott <benjamin.kott@outlook.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Benjamin Kott <benjamin.kott@outlook.com> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de>
-
Christian Kuhn authored
The "Included PageTsConfig" view is structurally similar to "Included TypoScript": Include trees are shown, conditions can be toggled. Resolves: #99827 Related: #97816 Related: #99563 Related: #99576 Releases: main Change-Id: I1149bef0ad1f2d2564ca7f45ad83825f73fa4e5b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77699 Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Jochen <rothjochen@gmail.com> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Jochen <rothjochen@gmail.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
Benjamin Kott authored
This patch streamlines the behavior of template buttons. For this, we sort all classes to match the same order. To be more flexible for the usage of `DropDownButton` we now also allow the hiding of the label text, but there must be a label text or an icon assigned. We are introducing a `GenericButton` to cover more complex situations while ensuring a unified output. Adjust the `typo3-copy-to-clipboard` element to work like a normal button element that allows keyboard navigation. Resolves: #99806 Releases: main Change-Id: Ic6e7d9036097bfd87493e51e5e128ab895af1731 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77680 Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de>
-
Stefan Bürk authored
With #97451 some hooks has been removed, and replaced with new PSR-14 events. In the commit message and rst-file one removed hook has been written wrong, which may be the reason why it has been undetected that a `ext:redirects` has used that removed hook. This change implements the now the PSR-14 event to complete the transition and restore the auto-chain information modal after page slug changes. The removed hook name in the corresponding breaking rst-file and the extension scanner matcher definition are changed to the correct name of the removed hook. Resolves: #99835 Related: #97451 Releases: main Change-Id: I537397d3849af099da4e32bb1782407aa0ee1be0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77706 Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
Georg Ringer <georg.ringer@gmail.com>
-
- Feb 05, 2023
-
-
Torben Hansen authored
The current arrow icon in position map elements is very small and may be hard to identify as an arrow. This patch replaces the icon with a better version of an arrow icon. Resolves: #99829 Releases: main Signed-off-by:
Torben Hansen <derhansen@gmail.com> Change-Id: If3a51d133afd8ed2bdb83b75bf5d4bcf264afad8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77701 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com>
-
Nikita Hovratov authored
FlexForm was using the old Bootstrap "panel" classes for its sheet tab content. Since the Bootstrap 5 update, the underlying "box-shadow" CSS property became visible. This is now fixed by simply using the "form-section" class like everywhere else for FormEngine container. In addition, the negative margin hack for this specific case can now be removed. Note: The Tabs.html template is still used in the deprecated ModuleTemplate->getDynamicTabMenu() method. As the markup has changed, it could look a bit different compared to TYPO3 v11, in case custom CSS was applied, which is very unlikely. Resolves: #99816 Releases: main Change-Id: I74b67fba421569669cbe3bf073097f6a18006acb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77691 Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com>
-
Stefan Bürk authored
`doctrine/annotations` v2 removed autoloading related methods in their `\Doctrine\Common\Annotations\AnnotationRegistry` class. With #99832 this dependency has been allowed in 1.x and 2.x, which now pulls in the version with removed methods. With #82869 `doctrine/annotations` has been added as dependency along with this autoloader register call. Versions have been raised since then multiple times. The standing 1.13.x version marked these autoloading methods as deprecated, recommending to rely on global autoloader. That means that the used composer autoloader should be sufficient, especially as it only provided a callback to the already used global autoloader. This change removes the no longer needed autoloader registration call from `\TYPO3\CMS\Core\Core\Bootstrap`. Resolves: #99833 Related: #99832 Related: #82869 Releases: main Change-Id: I4fb33e3bdb2b5e6bb2953d5f336030ca406fd175 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77705 Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Nikita Hovratov <nikita.h@live.de> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
Benni Mack authored
Various dependencies which have released major versions (to be compatible to further upstream packages) are now raised: * doctrine/annotations (allowing both 1.13 + 2) * doctrine/event-manager (For DBAL v4 compatibility) * doctrine/lexer (v2 + v3 instead of v1) * egulias/email-validator (4.0) using lexer Core `TYPO3\CMS\Core\Database\Schema\Parser\Parser` has got proper native types and return types to match deprecated array access on tokens returned by raised `doctrine/lexer` - which is used internal. That solved some phpstan ignore patterns as side-change. Used commands: * composer req "doctrine/annotations:^1.13.3 || ^2.0" "doctrine/event-manager:^2.0" "doctrine/lexer:^2.0 || ^3.0" "egulias/email-validator:^4.0" -W * composer req "doctrine/annotations:^1.13.3 || ^2.0" "doctrine/event-manager:^2.0" "doctrine/lexer:^2.0 || ^3.0" "egulias/email-validator:^4.0" -W -d typo3/sysext/core --no-update * Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #99832 Releases: main Change-Id: I8acc42933014f5d6711f2a6442499d7070a68a0b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77704 Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Jochen <rothjochen@gmail.com> Reviewed-by:
Jochen <rothjochen@gmail.com> Tested-by:
Stefan Bürk <stefan@buerk.tech>
-
- Feb 04, 2023
-
-
Benni Mack authored
This change introduces the combination of the newly added Locale class and SiteLanguage, allowing to work more with the objects than with strings as before. We're also adding an internal "POSIX" formatted logic to the Locale object, so the setLocale() calls can still work as before. This patch basically provides a bridge between the previously used POSIX format ("de_AT.utf-8") and the BCP-47 definition of language tags which is the base for the Locale class. However, both formats can now be used (in site configuration), and are properly formatted in setLocale() or in HTTP response headers in Frontend, which was a limitation before. Resolves: #99812 Releases: main Change-Id: Iee62e537f7dd334d614e4922cb7a0dd7222c379d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77685 Tested-by:
Jochen <rothjochen@gmail.com> Reviewed-by:
Jochen <rothjochen@gmail.com> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
core-ci <typo3@b13.com>
-
Georg Ringer authored
Provide a filter method to create a list of countries with given included and excluded countries. Resolves: #99732 Related: #99618 Releases: main Change-Id: I904b9243ddcdc6b0e455096481ed4321900f5ff4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77619 Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
Benni Mack authored
This change updates the main TYPO3 code base vendor/ directory to lock to latest packages from our main dependencies, ready for the next v12.x release, so the "non-composer mode" has various updated dependencies shipped. Used commands: composer update "symfony/*" "doctrine/*" "psr/*" "firebase/php-jwt" "bacon/bacon-qr-code" -W Resolves: #99831 Releases: main, 11.5 Change-Id: If208b89062dab7dac98b140fe6e16a545bf9226f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77702 Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Torben Hansen authored
This patch removes all usages of `$GLOBALS['TYPO3_REQUEST']` in ext:felogin classes, by passing the extbase request object to methods requiring access to request parameters. As a result, the class `ServerRequestHandler` has been removed, which was a wrapper class for `$GLOBALS['TYPO3_REQUEST']`. Besides the removal of `$GLOBALS['TYPO3_REQUEST']`, the following cleanup and modernisation tasks have been made: - Use constructor property promotion - Use constructor dependency injection - Marked `LoginController` as `@internal` - Corrected some comments in tests and method doc headers - Simplify mock creation in some tests Resolves: #99777 Releases: main Signed-off-by:
Torben Hansen <derhansen@gmail.com> Change-Id: I94034fdcc83fc78c34173b119d829279f8260de8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77652 Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Christian Kuhn authored
The entire bootstrap tooltips plugin and Backend handling is problemetic. The patch removes usages throughout the Backend to rely solely on native browser title attributes on hover for now. Reasons: * Usage within the Backend is very inconsistent: Some modules use 'bs-toggle="tooltip"', some do, but then don't initialze JS accordingly, many don't take care at all. * The placement of tooltips is inconsistent: Some modules rely on auto placement, some don't take care, some get it right. * The plugin is fiddly: There are various hacks to for instance toggle-off on scroll, or toggle-off when a modal is overlayed to not stay on-top-of modals, these sort of things. Browser title hovers always get this right. * Usages are buggy: The page tree sometimes still fails to remove tooltips, which then tend to stay until browser reload. The list module shows both a browser hover plus the tooltip at the same time on icons, ext:form shows funny placement in preview-mode. There are more modules that get details wrong than those that work flawlessly. * Tooltips that add a lot of valuable information are problematic from an accessibility point of view. It's better to refactor UI to not rely on them too much. By avoiding bootstrap tooltips for now, we encourage to think more about properly accessible solutions instead of putting things into a "nice" overlay. With the patch, various places now fall back to the title attribute, which is also problematic, see [1] for more information. The core will continue to improve the situation with further patches and will document better best practices. * Tooltips with a lot of additional information are a no-go on touch devices. * The plugin is slow with many elements. This is easily reproducible with the "List" module, which is noticeable quicker when relying on title tags alone on weaker clients. [1] https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/title#accessibility_concerns Resolves: #99811 Resolves: #99428 Resolves: #99089 Resolves: #98061 Resolves: #97047 Resolves: #93022 Related: #89872 Releases: main Change-Id: I3cb8f0ca5e65a2c4b74d023935e1bef26c592ffd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77664 Tested-by:
Michael Telgkamp <michael.telgkamp@mindscreen.de> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com> Reviewed-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Christian Kuhn authored
Since #99782, we're always rendering the entire TypoScript tree. With bigger trees like a loaded bootstrap_package, these can be thousands of nodes. One bummer is the f:be.link VH call for each node. The patch suppresses this with a pretty straight hack, improving server side by about 40%. Another optimization (accessing object members) requires a change in Typo3Fluid, which needs to be prepared and released on this side first. Resolves: #99820 Related: #99782 Releases: main Change-Id: I688d1038a5e4f23c5f2172d64d7508cdda3e3ff2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77695 Reviewed-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com> Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com>
-
Nikita Hovratov authored
Since the recent release of PHPUnit 9.6 some new deprecations were added which signal breaking changes for version 10. As deprecations are causing our tests to fail, they need to be addressed immediately. Method `expectErrorMessage` replaced with `expectExceptionMessage`. Method `getMockClass` replaced with `createMock` and a subsequent get_class call. Also update phpunit/phpunit to latest version: > composer update phpunit/phpunit > composer bump phpunit/phpunit Resolves: #99817 Releases: main, 11.5 Change-Id: I6d01ccca398a8ff5db735a35b19061b711c843cc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77692 Tested-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Stefan Bürk <stefan@buerk.tech>
-
Christian Kuhn authored
Resolves: #99818 Related: #97816 Releases: main Change-Id: Ibc3e5dd98d75d1c1cb4de6e8fad1f7b662d3de75 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77694 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Kevin Appelt authored
Move widget registration to Services.php to allow checking for the existence of WidgetRegistry to only add the widget if EXT:dashboard is available. Resolves: #99813 Releases: main Change-Id: I3157784944cdf16ae091a8ad90da59894c94104b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77686 Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Nikita Hovratov <nikita.h@live.de>
-
- Feb 03, 2023
-
-
Jasmina Ließmann authored
This followup optimizes the code introduced by a previous patch set. Newly introduced CSS classes are thereby partially removed again. Resolves: #99809 Related: #99742 Releases: main Change-Id: Ife2b6e1704837fbee2481d18c7191625a60a7979 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77683 Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
core-ci <typo3@b13.com>
-
Christian Kuhn authored
Resolves: #99793 Releases: main Change-Id: I35e3216c3c84dae41fe5980d9ad6558a1eaaa6b1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77667 Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com>
-
Markus Klein authored
The ObjectStorage internals return strings as keys for the elements, when iterating over the storage. Users expect JSON arrays (not objects) when rendering an ObjectStorage through a JsonView. The `toArray` method takes care of this key conversion. Resolves: #66581 Releases: main Change-Id: Ice2487f6e85e3949d9ee59174b6175c46b1ae8e1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77361 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com>
-
Jochen Roth authored
A new command has been intruduced named "./bin/typo3 backend:user:create" which allows to create a backend user via CLI using environment variables, cli options or a guided walk-through (questions/answers) Resolves: #99341 Releases: main Change-Id: I0daf86283da35b1884a6f3a743d6f953d7f184dc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77020 Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com>
-
Kevin Appelt authored
This SEO widget lists pages with missing description ordered by the last changed date. Resolves: #99552 Releases: main Change-Id: I41d6895a0630946b554a1ecc42adf5c7eb031fa6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77396 Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Nikita Hovratov <nikita.h@live.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Andreas Fernandez authored
It is now possible drag items (files or folders) from the filelist iframe into the tree. Resolves: #99733 Releases: main Change-Id: I573fc5a290a14abe79a8211ecf1751a59c1e4c38 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77522 Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
core-ci <typo3@b13.com>
-
Jasmina Ließmann authored
To improve readability, the system status text and value of the application context are displayed in default font color. The link to the system log is now also displayed in the default link color. Resolves: #99742 Related: #99538 Releases: main Change-Id: I293d5c74a7dc5bf26ff53673c9ac55767e686332 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77660 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Stefan Bürk <stefan@buerk.tech>
-
Nikita Hovratov authored
So far TCA migrations for FlexForm were only called in FormEngine context. In order for DataHandler to always receive migrated TCA, the migration method is now moved from TcaFlexPrepare to FlexFormTools. This also fixes TCA type="file" fields inside FlexForm. TcaFlexPrepare used the TcaPreparation functionality, which would override the TCA foreign_match_fields with "dummyField" instead if the FlexForm sub key. In addition, a typo in a parameter name is fixed as a drive-by change. Resolves: #99756 Releases: main Change-Id: I07fadeddc26fa93a6fd7aebc6f0c57eac9bfe0a4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77643 Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-