- Aug 07, 2023
-
-
Thomas Hohn authored
Moved assignment of $destPid = $sortInfo['pid'] after check if $sortInfo is an array, since the method call to getSortNumber can return other values than an array. Resolves: #101606 Releases: main, 12.4, 11.5 Change-Id: I3cfef35b351a0cd1fa8197702cce9e3b05871fcf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80430 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
-
Thomas Hohn authored
Added a null coalescing operator when assigning value to $editUid. Resolves: #101602 Releases: 11.5 Change-Id: Ie19fa72032c57c824322a319deafc441fdb9319e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80427 Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
- Aug 06, 2023
-
-
Rémy DANIEL authored
Linkvalidator extension has a couple of known issues, especially with external link checking. Those issues are now documented, so integrators can acknowledge them and implement counter-measures. Resolves: #101597 Releases: main, 12.4, 11.5 Change-Id: I00dc01243426fc56c21a4bd11815c3009e3dd3ad Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80365 Reviewed-by:
Stefan B�rk <stefan@buerk.tech> Tested-by:
-
- Aug 05, 2023
-
-
Rémy DANIEL authored
If the svg-tree component is embedded in an iframe, and if the iframe src get changed by navigating to another url, pending AjaxRequest will be cancelled by the browser, without letting us the opportunity to properly catch the thrown error. As a workaround, we register an unload event on the iframe's window, and mute notifications to the user. Resolves: #101340 Releases: main, 12.4, 11.5 Change-Id: I8572fde4bf278481a32a459f802af69356ce28a5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80414 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
-
Gordon Brüggemann authored
Resolves: #99725 Releases: main, 12.4, 11.5 Change-Id: I4682cbe57b4908e13c219c5be4b0810c0d348bf1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80413 Tested-by:
-
- Aug 04, 2023
-
-
linawolf authored
The 5th parameter of ExtensionUtility::registerPlugin is thegroup and not `ExtensionUtility::PLUGIN_TYPE_CONTENT_ELEMENT` Fixes the name to the correct function and adds example code. Resolves: #101575 Releases: main, 12.4, 11.5 Change-Id: I05a344ee11aaa8a9b3187a11528e2e506f47756d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80355 Tested-by:
-
Anja Leichsenring authored
Releases: main, 12.4, 11.5 Resolves: #101574 Change-Id: I6617e9c31a20b84269ae708d177b4ebf81ba97d0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80316 Tested-by:
-
Christian Spoo authored
parent::__construct() of MemcachedBackend calls setCompression() which determines compression based on state of $this->usePeclModule. This property needs to be set before parent::__construct() is called. Resolves: #99495 Releases: main, 12.4, 11.5 Change-Id: Ibc6c3a2378c5187748b4394d440232600de193e2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80388 Reviewed-by:
-
Tobias Liebig authored
This test checks lowlevel things like usergroup to be changed by GeneralUtility::fixPermissions(). Various tests in this area have been disabled on Windows already. They are problematic in macOS driven docker as well since macOS heavily messes around with access rights. We give up on this now, and reduce the details test checks of GeneralUtility::fixPermissions() a bit by removing that test. Resolves: #101568 Releases: main, 12.4, 11.5 Change-Id: I36e781302285dc1966633723abdc8f15bf84ef06 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80383 Tested-by:
-
- Aug 03, 2023
-
-
Simon Schaufelberger authored
While the backend already renders preview images of for example YouTube videos in the media module, it doesn't show the preview image anywhere else, for example in the page module and the Media elements within a "Text and Media" content element. This patch shows the generated preview image within the page module and the "Text and Media" content element as well. Resolves: #95454 Releases: main, 12.4, 11.5 Change-Id: I4e404cf41627d5ee9ac165ee46817a456dbecaa8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80372 Tested-by:
-
- Jul 31, 2023
-
-
Christian Kuhn authored
When select fields with db relations allow pages records, the DatabaseBrowser tries to render an icon from the page row. uid of that row may be an int, which needs to be cast to string to be fed to htmlspecialchars(). Resolves: #101513 Related: #100819 Releases: main, 12.4, 11.5 Change-Id: I52ee031cb0eb09f41ae8ecb6d7005f03e65de3bd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80285 Tested-by:
-
Oliver Klee authored
This method promises to return an int, but actually returns a float. Also add a regression test. > ./Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #101499 Releases: main, 12.4, 11.5 Change-Id: I85ca63c9b32717641d5926b16ee25e32eeb69310 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80273 Tested-by:
-
Nikita Hovratov authored
The labels of inline FileReference fields were not concatenated but overwritten, in a loop since #92427. This patch corrects the concatenation and adds line-break divs, otherwise the strings are on a single line. Resolves: #99873 Related: #92427 Releases: main, 12.4, 11.5 Change-Id: I368cd0d2cbf7e9ed7fdd1d003f869cc894d6f13e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80265 Tested-by:
Nikita Hovratov <nikita.h@live.de> Reviewed-by:
-
- Jul 30, 2023
-
-
Christian Kuhn authored
Add some waitFor() to the drag&drop tests and give the filter test a generic wait which hopefully stabelizes this one a bit as well. Resolves: #101494 Releases: main, 12.4, 11.5 Change-Id: I73d4d2415f4e100bed7f1d7e5ead1036d157af93 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80258 Reviewed-by:
-
Christian Kuhn authored
Similar to #101491, the other Application/Frontend acceptance tests get same treatment to wait for the "View webpage" icon being visible, before trying to click it. Resolves: #101492 Related: #101491 Releases: main, 12.4, 11.5 Change-Id: Ie8dd5338a6773baf8850fec0713dcd917699fbfc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80254 Tested-by:
-
Christian Kuhn authored
Fails locally occasionally. The additional explicit waitForElement() before clicking the elemnt stabilized it. Resolves: #101491 Releases: main, 12.4, 11.5 Change-Id: I4072daa0e949d3480f399e99a2f35d8ef889eded Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80251 Tested-by:
-
Torben Hansen authored
Add several type casts to avoid notices. Resolves: #101486 Releases: main, 12.4, 11.5 Signed-off-by:
Torben Hansen <derhansen@gmail.com> Change-Id: I87f02e129d91ae9902ad74f306f11915d12037b0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80246 Tested-by:
-
Christian Kuhn authored
This one was still flaky. Properly waiting for the element should finally fix this, this patch now had a huge number of successful runs locally, while it failed repeatedly without. Resolves: #101487 Related: #101440 Releases: main, 12.4, 11.5 Change-Id: I2cf4b3e878caf430ead27340694a169f98e710e8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80243 Tested-by:
-
- Jul 29, 2023
-
-
Benjamin Franzke authored
Resolves: #101480 Related: #101453 Releases: main, 12.4, 11.5 Change-Id: I62e7166a6ceceb6e8c6c0d0aa5393def72c75346 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80239 Tested-by:
Benjamin Franzke <ben@bnf.dev> Tested-by:
-
- Jul 28, 2023
-
-
Stefan Bürk authored
Resolves: #101478 Releases: main, 12.4, 11.5 Change-Id: I40987e100686771365c30652dba5a13bfd509604 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80206 Reviewed-by:
-
Chris Müller authored
The new feature flag was introduced with the security releases 12.4.4 and 11.5.30: https://typo3.org/security/advisory/typo3-core-sa-2023-003 Resolves: #101462 Related: #100889 Releases: main, 12.4, 11.5 Change-Id: I891706caa51db8a6c9ab2442d311c6be61755849 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80205 Tested-by:
-
Stefan Bürk authored
Resolves: #101394 Releases: main, 12.4, 11.5 Change-Id: I1d0cbb99496108180cf1f06045934bb510abcd3f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80150 Tested-by:
-
- Jul 27, 2023
-
-
Chris Müller authored
Resolves: #101451 Resolves: https://github.com/TYPO3-Documentation/TYPO3CMS-Reference-CoreApi/issues/3244 Related: #90522 Releases: main, 12.4, 11.5 Change-Id: Ib6cd19b35f72138ee4667714d5fe9c8dbd8bbcca Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80145 Reviewed-by:
-
- Jul 26, 2023
-
-
Markus Klein authored
Resolves: #101452 Releases: main, 12.4, 11.5 Change-Id: Idf803dff6b4941380dbdde30f53548d31b6df575 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80142 Tested-by:
-
- Jul 25, 2023
-
-
Benjamin Franzke authored
With #101231 a missing URL encoding in FormEngine was triggered which caused contents like "svg;disallowed=|irre-object-id" to be added to bparams which got transformed into "svg&disallowed" in some setups (ddev, most likely caused by the ddev-router-proxy). This "change" causes the irre object id to be cut off from the bparams in IREE file list element browser, which is why "select" actions on file list elements were silently ignored. Resolves: #101433 Related: #101231 Releases: main, 12.4, 11.5 Change-Id: I89dd53131f9ecb3b199bbcd2d1abf6be87f819da Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80172 Tested-by:
-
Oliver Klee authored
This particularly helps PHPStan in extensions that call those methods detect unnecessary checks for empty strings if `GU::trimExplode` is called with `$removeEmptyValues = true`. Used command: > ./Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #101395 Related: #99147 Releases: main, 12.4, 11.5 Change-Id: I6945cc0698b0777a05cb9327b342aa9aa7dee098 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80138 Reviewed-by:
-
Nikita Hovratov authored
The computed property '_ORIG_uid' is only set for workspace records, which are NOT moved (t3ver_state=4). It is better to check directly for the existence of this key as done in all other occurrences where it is retrieved. The presence already ensures that we are dealing with an overlaid workspace record and that there is need to fetch the original uid. Resolves: #101426 Releases: main, 12.4, 11.5 Change-Id: I7dd1072736b476015d5d44cb82f5e670fdd484a7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80168 Tested-by:
-
Oliver Hader authored
Change-Id: Ic561c16dd8f95af99b9d27f78633193968574118 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80163 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Oliver Hader authored
Change-Id: I41cc21334354b86a347d35eaca63014f433c0e46 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80162 Tested-by:
-
Oliver Hader authored
See https://github.com/w8tcha/CKEditor-WordCount-Plugin/security/advisories/GHSA-q9w4-w667-qqj4 yarn add ckeditor-wordcount-plugin@^1.17.12 Resolves: #101234 Releases: 11.5 Change-Id: I7400bc7405a91e62fb7dc5b3565ee2f9d5b4cc06 Security-Bulletin: TYPO3-CORE-SA-2023-004 Security-References: CVE-2023-37905 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80157 Tested-by:
-
Oliver Hader authored
This change disallows calling an URI with page-id query parameters that are not part of a particular site - for instance the following URL `https://example.org/?id=3000&L=0` has two aspects: * the site `example.org` has the root page-id 1000 * the site `internal.example.org` has the root page-id 3000 The example above allows to call a page-id for an internal site, by using a valid and public entry point. The new feature flag `security.frontend.allowInsecureSiteResolutionByQueryParameters` allows to control this behavior for backward compatibility reasons. Per default `allowInsecureSiteResolutionByQueryParameters` is disabled. Resolves: #100889 Releases: main, 12.4, 11.5 Change-Id: I88d565b5d9bea556b4f754c3069d56124cea98bd Security-Bulletin: TYPO3-CORE-SA-2023-003 Security-References: CVE-2023-38499 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80156 Tested-by:
-
Oliver Hader authored
see https://github.com/TYPO3/html-sanitizer/releases/tag/v2.1.2 composer req typo3/html-sanitizer:^2.1.2 composer req typo3/html-sanitizer:^2.1.2 \ -d typo3/sysext/core --no-update Resolves: #100917 Releases: main, 12.4, 11.5 Change-Id: If6f77217dfefe0a3c15a8a8760206b6cc5ba5687 Security-Bulletin: TYPO3-CORE-SA-2023-002 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80155 Tested-by:
-
- Jul 24, 2023
-
-
Ayke Halder authored
The `redirectMode=refererDomains` configuration allows to process a redirect after a successful login to an evaluated referer value. This patch fixes the evaluation of https urls as referer value. Without this patch only http urls are evaluated correctly. Also do not match hostnames that contain an invalid underscore in name. Additionally the regex matching for the domain was not quoting the configured domain names and thereby matching dots as 'any single character' instead of a dot. Resolves: #100215 Releases: main, 12.4, 11.5 Change-Id: I589638d82627283b5acdeec5da0243e082cc5ebf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80132 Tested-by:
-
Stefan Bürk authored
PHP8.3 emits a warning for content handed over to unserialize() which contains superflous content at the end. The silence operator `@` is now used to suppress the test setup unserialize() to avoid this exact warning as preparation for PHP8.3 introduction. Can be verified before and after by executing: > Build/Scripts/runTests.sh -p 8.3 -s unitDeprecated Resolves: #101409 Releases: main, 12.4, 11.5 Change-Id: I5741cd86e8e0a8afedb49ad01676d0766d5fbfaa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80070 Tested-by:
-
- Jul 21, 2023
-
-
Tizian Schmidlin authored
When updating entries, the `updateFields` will provide `uid`, which works fine in MySQL but might lead to problems when working with stricter DBMS. Such an example of a DBMS not liking the update of an identity field, is SQL Server. Now, I know that SQL Server will not be supported in TYPO3 v12 going onward, but on the off-chance that somebody has another DBMS than MySQL or has DBMS that will break when trying to update an identify field, this bugfix might still be valuable. The bug exists back to TYPO3 10 at least. Releases: main, 12.4, 11.5 Resolves: #100175 Change-Id: Id4dd90579191da0cb770490256087209e749deb4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80068 Tested-by:
-
- Jul 19, 2023
-
-
Benni Mack authored
Resolves: #100853 Releases: main, 12.4, 11.5 Change-Id: I8a1284c2c859cde9d114fecbbe9c5a1e38a35c94 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80092 Tested-by:
-
Oliver Klee authored
The variable `$port` in the changed code is an array element from the return value of `GeneralUtility::trimExplode()` with the `$removeEmptyValues` argument set to `true`. Hence it is ensured to not be an empty string. This change should be backported as it otherwise would block improvements for the type annotations of `GeneralUtility::trimExplode()`. Resolves: #101384 Releases: main, 12.4, 11.5 Change-Id: I74ce433495fc3975c11991d21831db0244eacba0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80088 Tested-by:
-
Georg Ringer authored
Just clear potential the page being edited from indexed_search's index. The previous implementation did also take potential child pages, into account, but not the page itself. Resolves: #100877 Releases: main, 12.4, 11.5 Change-Id: I4c8e0c70e68744f629cb1b1c9f62b5f3028502fd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80090 Tested-by:
-
- Jul 18, 2023
-
-
Nikita Hovratov authored
Since the introduction of customizable page type icons, the fallback icons did no longer work. Only the icon and variations for "contentFromPid" worked. The reason is, that these icons are prefixed with "page" while the other ones are prefixed with the doktype ("1"). This is fixed now by providing an optional argument for the getRecordTypeForPageType method, which takes the type name as parameter. The default is "1". Resolves: #101379 Related: #90042 Releases: main, 12.4, 11.5 Change-Id: Ia4379899642ad477026dd73b1ac0c22b918a1629 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80059 Tested-by: -
Stefan Bürk authored
The main query execution builds a QueryBuilder instance out of different sub information. Additionally, several hooks can be used to influence the created query. On top of this, different type of search queries are possible. This change avoid consuming a lot of placeholder for list based `in()` expressions by using a corresponding QueryBuilder method suitable for the value type. This means that no placeholder are used any longer for list expressions. Note: Max query size may still be exceeded if the lists would getting bigger. This can be adjusted by database server administrators, but will lead to another exception for really large value lists. Resolves: #86859 Releases: main, 12.4, 11.5 Change-Id: Ic0ac51c13cb74a058d71152ad626c484f696b176 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80080 Tested-by:
-
