- Jul 12, 2018
-
-
Ralf Zimmermann authored
The form editor save and preview actions now check the submitted form definition against configured possibilities within the form editor setup. Releases: master, 8.7 Resolves: #85044 Security-Commit: f4a1a09378ed286f3744d6a72f09bfa11a6ba87e Security-Bulletin: TYPO3-CORE-SA-2018-003 Change-Id: I38f965b7a324e6386257ffdfd33eb69aa617c2ea Reviewed-on: https://review.typo3.org/57555 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Susanne Moog authored
Before this change, form definitions have been persisted in regular `.yaml` files. In order to make the meaning and purpose of those files more explicit, the new file ending `.form.yaml` is introduced. Invocations of the file abstraction layer API for those form files have to be allowed explicitly by granting commands individually using `FilePersistenceSlot::allowInvocation`. New form definitions are created with the new file ending per default. An upgrade wizard renames existing form definitions that are stored in according storage folders (`allowedFileMounts`). In addition references in FlexForm of content elements are adjusted to the new file names as well - in case a form definition has been referenced before. The file list user interface disabled according direct actions for `.form.yaml` files or redirects those to the according form module. Using just `.yaml` instead of `.form.yaml` from site packages is deprecated. Using just `.yaml` instead of `.form.yaml` from file storages is not allowed anymore. Resolves: #84910 Releases: master, 8.7 Security-Commit: e4680db22c680b489545679f118f3242c2929708 Security-Bulletin: TYPO3-CORE-SA-2018-003 Change-Id: I196327d968cbd53bcc623d050d5b3b8742937996 Reviewed-on: https://review.typo3.org/57554 Reviewed-by:
-
Oliver Hader authored
Resolves: #85385 Releases: master, 8.7, 7.6 Security-Commit: f4d645d131fabc98cbbdcefcffb951040d2dd246 Security-Bulletin: TYPO3-CORE-SA-2018-002 Change-Id: If9a312440040da2193512565350fa2342d503278 Reviewed-on: https://review.typo3.org/57553 Reviewed-by:
-
Christian Kuhn authored
SoftReferenceIndex throws exceptions on phar streams LegacyLinkNotationConverter throws exceptions on phar streams Resolves: #85385 Releases: master, 8.7, 7.6 Security-Commit: 4fde9d6a2333435af9033f55e9a5e2d428f6ea0d Security-Bulletin: TYPO3-CORE-SA-2018-002 Change-Id: I09284269d7d9763c92f8d2aa2e82e37e9dc7f0de Reviewed-on: https://review.typo3.org/57552 Reviewed-by:
-
Oliver Hader authored
This custom stream wrapper for the phar:// protocol overrides PHP's native handling. In case Phar bundles shall be loaded from a valid directory, the custom wrapper falls back to the native PHP wrapper in order to invoke Phar-related actions. In case the location is not trustworthy, an according exception is thrown. The custom stream wrapper is registered in the beginning of TYPO3's bootstrap class. Truested locations are those in typo3conf/ext/* - anything else is denied and not considered as trustworthy. Releases: master, 8.7, 7.6 Resolves: #85385 Security-Commit: efa085d9a5aebfac6b92309ea53c455b95a81fcc Security-Bulletin: TYPO3-CORE-SA-2018-002 Change-Id: I97a661e0c82728c6cb44e4b067646dfb69403d89 Reviewed-on: https://review.typo3.org/57551 Reviewed-by:
-
Oliver Hader authored
Using password hashing methods that are related by class inheritance can lead to authentication bypass by just knowing a valid username. Resolves: #84703 Releases: master, 8.7, 7.6 Security-Commit: 2951c4fc0529ec0fd6047786edd3b7189428e574 Security-Bulletin: TYPO3-CORE-SA-2018-001 Change-Id: Ib8d2e8b696c9e7b15f9b479f07aa64f9dce41fe3 Reviewed-on: https://review.typo3.org/57550 Reviewed-by:
-
- Jun 11, 2018
-
-
Oliver Hader authored
Change-Id: I4adf71f27e40df89bc77825e6771d5b249cf1ffd Reviewed-on: https://review.typo3.org/57186 Reviewed-by:
-
Frank Naegler authored
Using the second parameter of TBE_EDITOR.rawurlencode cuts the input to 200 characters for any input value. The parameter is rather useless and its usage can be simply removed to allow URLs with more than 200 characters. Resolves: #85226 Releases: master, 8.7 Change-Id: I8391488d6fb21ede9280041dd41e3feb7e19dbd1 Reviewed-on: https://review.typo3.org/57183 Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Mathias Brodala <mbrodala@pagemachine.de> Reviewed-by:
Joerg Boesche <typo3@joergboesche.de> Tested-by:
TYPO3com <no-reply@typo3.com> Reviewed-by:
Susanne Moog <susanne.moog@typo3.org> Tested-by:
-
Frank Naegler authored
Since EXT:frontend does not have CSS files anymore, the postcss config for Grunt is not necessary anymore. Resolves: #85225 Releases: master Change-Id: Ibdecf246c2841e383d745dfdfbf7f3a7181be19b Reviewed-on: https://review.typo3.org/57181 Reviewed-by:
Benjamin Kott <benjamin.kott@outlook.com> Tested-by:
-
Frank Naegler authored
Resolves: #85213 Related: #84993 Releases: master Change-Id: Ib8cd46951cb5032a7554042e2d8a7a052102788b Reviewed-on: https://review.typo3.org/57174 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
-
Benni Mack authored
The EM changes due to the new automatic DB fields addition for TCA-based tables come with a small side-effect, namely that all extensions are now evaluated when doing the SQL create queries. The introduced changes now only do execute "safe" DB updates, but not limited to an extension, but for all installed extensions. Thus, non-safe DB operations are not taken into account for an extension installation/upgrade anymore. The patch reverts the changes to the original behaviour, so that a follow-up patch can introduce the following behaviour: - Install extension - Do _safe_ DB updates for the whole system - Do breaking DB updates for the extensions to be installed/upgraded - Execute ext_tables_*adt.sql files + imports Resolves: #85215 Releases: master Change-Id: Ief1118319eb0afcd586efdff506cf44d00e02fb7 Reviewed-on: https://review.typo3.org/57173 Tested-by:
Nicole Cordes <typo3@cordes.co> Tested-by:
-
Christian Kuhn authored
Resolves: #85190 Related: #85188 Releases: master Change-Id: Ia77e74753fcca2c13b0e32b2dce186723c457775 Reviewed-on: https://review.typo3.org/57153 Tested-by:
Jigal van Hemert <jigal.van.hemert@typo3.org> Reviewed-by:
-
Christian Kuhn authored
typo3/testing-framework since version 3.8.0 can reset singletons created by makeInstance automatically if $this->$resetSingletonInstances is set to true. This version additionally checks for left over singletons in case that property has not been set and lets tests fail in this case. composer require --dev typo3/testing-framework:^3.8 As advantage, a manual backup of singleton instances within tests is not needed anymore. The patch comes with a set of test case adaptions to cope with this new situation. Change-Id: Ib5f278145e385e32d543541872cf5e1f208fad47 Resolves: #85209 Releases: master Reviewed-on: https://review.typo3.org/57169 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
- Jun 10, 2018
-
-
Andreas Fernandez authored
The URLs to the create actions for backend users and backend groups were built in a strange way which required some quirks to be fully functional. This patch removes the unnecessary `explodeUrl2Array()` call, which also renders the `rawurlencode()` obsolete. Resolves: #85211 Releases: master Change-Id: I3b8f5864fc398b9a4f8f2c0de5d72a38cb8a471b Reviewed-on: https://review.typo3.org/57172 Tested-by:
Riccardo De Contardi <erredeco@gmail.com> Tested-by:
-
Benni Mack authored
Due to moving a class name the import statement in ErrorController was wrong. Resolves: #85210 Related: #85101 Releases: master Change-Id: I17cd062868ca3d0686218abd469a72cbdd08018b Reviewed-on: https://review.typo3.org/57171 Tested-by:
-
Anja Leichsenring authored
Resolves: #85202 Releases: master Change-Id: I6f61db1d2c29a3b9d4794e33cbaf2c6e634e14c7 Reviewed-on: https://review.typo3.org/57158 Tested-by:
-
Christian Kuhn authored
Static method variables are even more pita than static class variables, especially if their state is created from db rows or path information: It is nearly impossible to get rid of this state at a later point again, even reflection does not help here. The patch abandons all 'static $foo' method variables from the system, using these strategies: * Remove some entirely which were used as first level cache and only cache-away simple non db related code structures. * Switch some to use cache framework cache_runtime instead which can be evicted easily. * Use class properties in some cases instead. Change-Id: Ic699846a2c6ec661ee1124ace50df1aa04a1954b Resolves: #85206 Releases: master Reviewed-on: https://review.typo3.org/57167 Tested-by:
-
Michael Schams authored
The fully qualified class name of class `TableGarbageCollectionTask` must be used to configure database tables, which should be cleaned up (inactive or deleted records removed from the system). This change replaces `tx_scheduler_TableGarbageCollection` with the correct class name in the documentation: \TYPO3\CMS\Scheduler\Task\TableGarbageCollectionTask::class Releases: master Resolves: #85205 Change-Id: I13434bf6bc13dd987263605d845f8b59b69e0796 Reviewed-on: https://review.typo3.org/57166 Tested-by:
-
- Jun 09, 2018
-
-
Jan Helke authored
Releases: master Resolves: #85092 Change-Id: I29bb5a3d0546d790d9c8d05c52f448ecefbc8564 Reviewed-on: https://review.typo3.org/57063 Tested-by:
-
Frank Naegler authored
The new IpAnonymizationAdditionalFieldProvider introduced the same JavaScript variable which breaks the garbage collection task. The JavaScript initialization has been removed and the field provider simplified. Resolves: #85068 Releases: master, 8.7, 7.6 Change-Id: Ibb307ee37d6fea33a721373bdc50bbbd3fee1453 Reviewed-on: https://review.typo3.org/57136 Tested-by:
-
Anja Leichsenring authored
New folder and includes to render the changelog for the upcomming version. Change-Id: I0440dcfdaf5541da5e8dbe8b8b681a477951fc14 Resolves: #85202 Releases: master Reviewed-on: https://review.typo3.org/57152 Tested-by:
-
Benni Mack authored
The new SEO extension handles opengraph and twitter (seo-relevant), thus do not need to stay in EXT:core, as they are only for sites which need SEO relevant information to be processed. Resolves: #85201 Releases: master Change-Id: Ib0bf503bb939b47747dc32209f78f8e7ce8622c1 Reviewed-on: https://review.typo3.org/57162 Tested-by:
Richard Haeser <richard@maxserv.com> Reviewed-by:
-
Jan Helke authored
Releases: master Resolves: #85088 Change-Id: Ibd443902f6c89e16946d3d8d2cc39a8e2091054e Reviewed-on: https://review.typo3.org/57059 Reviewed-by:
-
Jan Helke authored
Releases: master Resolves: #84722 Change-Id: I0edb98c7713f5c6520cbbc33e3f85ab1b3f4946f Reviewed-on: https://review.typo3.org/56659 Reviewed-by:
-
Susanne Moog authored
The admin panel initialization is done via middleware before the TypoScript is fully initialized, therefor it cannot have dependencies to parsed TypoScript (and it cannot be initialized at a later state because of cross-dependencies with TSFE). Before #85104 the checks did not include TypoScript - that state has been restored and the dependency has been removed. Resolves: #85193 Releases: master Change-Id: Ic576b02a68ddc20f52b4b1647b0e38c51e1b7df8 Reviewed-on: https://review.typo3.org/57147 Tested-by:
-
Alexander Stehlik authored
The tests demonstrate the issue described in the ticket is not present anymore. Resolves: #77338 Releases: master Change-Id: I7002b9754f556f23850fda5026861c742f70bcdc Reviewed-on: https://review.typo3.org/49307 Reviewed-by:
-
Jan Helke authored
Releases: master Resolves: #84724 Change-Id: I92a7ccbc88463d3fb3925185247331acf2977e40 Reviewed-on: https://review.typo3.org/56663 Reviewed-by:
-
Jan Helke authored
Releases: master Resolves: #85094 Change-Id: I7fe8e2dd15fa797eef9b153bf2935187181149ae Reviewed-on: https://review.typo3.org/57065 Tested-by:
-
Jan Helke authored
Releases: master Resolves: #84816 Change-Id: I3f0bb5ab96743762977177cad1e6f125b9f23c73 Reviewed-on: https://review.typo3.org/56759 Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
Jan Helke authored
Releases: master Resolves: #84808 Change-Id: Ia520395c0d4cb3a8efd6529a23a0f65d1fa9247a Reviewed-on: https://review.typo3.org/56751 Tested-by:
-
Jan Helke authored
Releases: master Resolves: #85098 Change-Id: Id2b5c7efbf2672b4731a9bd4b238a0f4be25cd5c Reviewed-on: https://review.typo3.org/57069 Tested-by:
-
Jan Helke authored
Releases: master Resolves: #85095 Change-Id: Iacfffe50c29a47c197c9887610bc0874007f7eec Reviewed-on: https://review.typo3.org/57066 Tested-by:
-
Tymoteusz Motylewski authored
Releases: master Resolves: #84721 Change-Id: I4aca40a0225a84a5af7925b34fc578f28d78b9bc Reviewed-on: https://review.typo3.org/56655 Tested-by:
Steffen Frese <steffenf14@gmail.com> Reviewed-by:
-
Benni Mack authored
Both the MetaTagManagerRegistry and the MetaTagManager are singletons via TYPO3's SingletonInterface, thus, there is no need for having a getInstance() within the API itself, nor in any abstract / generic base classes. Resolves: #85197 Releases: master Change-Id: I9aa925a1646a4482313dd740ecc3ae45780c9432 Reviewed-on: https://review.typo3.org/57157 Reviewed-by:
-
Benni Mack authored
The deprecation log file that was used prior to v9.0, was previously stored in typo3conf/deprecation_* which is still used for extensions still using the old API, is now put into var/log/ where all other log files reside. For installations using the environment concept with "$_ENV['TYPO3_PATH_APP']" - e.g. all installations in composer mode - the file is now created at that place, for installations having everything in the public web root, the file is now in "typo3temp/var/log/deprecation_...log". Resolves: #85198 Releases: master Change-Id: I0fc23d9fec6cfa45241c041f64333deb90d44950 Reviewed-on: https://review.typo3.org/57160 Tested-by:
-
Benni Mack authored
This fixes a functional test in EXT:workspaces, allowing for getting rid of an extra check in the frontend request workflow. Resolves: #85199 Releases: master Change-Id: I642fca3a2873f0fe758164fca3f9261480dbc4da Reviewed-on: https://review.typo3.org/57074 Tested-by:
-
Frank Naegler authored
This patch prevent putting invalid data into localStorage in the rare case that the AJAX call does not provide icon markup. Resolves: #85184 Releases: master Change-Id: Icddd88232bf9ac5f77e08ed7fbac475af8b469eb Reviewed-on: https://review.typo3.org/57146 Tested-by:
-
Benni Mack authored
The new functionality introduced in #85160 adds TCA control database fields dynamically. However, newly created extensions add these fields (except "uid" which is a primary column) at the end after the content-related fields. The patch re-orders the columns to be added to move them to the very beginning. Resolves: #85195 Related: #85160 Releases: master Change-Id: Ibcf77ae3fea41f067dca0f247bef50d00bdd014f Reviewed-on: https://review.typo3.org/57155 Tested-by:
-
Richard Haeser authored
Move the new SEO fields to EXT:seo and prepare the extension for some basic SEO features. Resolves: #85194 Releases: master Change-Id: I6ec087928080e217ce1824b2e9ad5cf0ca0606c8 Reviewed-on: https://review.typo3.org/57148 Tested-by:
-
Christian Kuhn authored
TYPO3\TestingFramework\Core\FileStreamWrapper belongs to the testing-framework package. The unit test case has been moved to it an can be removed from core. Resolves: #85192 Related: #85096 Releases: master Change-Id: I4d83f92275e34fdad3eac2550db4d3895b141f36 Reviewed-on: https://review.typo3.org/57154 Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
