- Dec 19, 2019
-
-
Alexander Schnitzler authored
composer remove --dev rector/rector composer require --dev rector/rector:~0.6 The update of rector brings important bugfixes and enables the installation of the latest version of phpstan/phpstan. Releases: master Resolves: #89918 Change-Id: I406aa56b19e88db23260033023e2c785425aef5e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62599 Tested-by:TYPO3com <noreply@typo3.com> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
-
Anja Leichsenring authored
For testing mssql based jobs, the wait limit for the database to answer gets raised from 60 to 120 seconds to avoid build failures solely caused by the container being up too late. Releases: master, 9.5, 8.7 Resolves: #89986 Change-Id: If88949ed4dd978af1e349b524a40069b606dcb63 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62739 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
Susanne Moog authored
The TimeTracker has been using the wrong order of glue and pieces, the PageLayoutView has used implode with only one parameter. Both occurences have been adjusted. Resolves: #89991 Releases: master, 9.5, 8.7 Change-Id: Id600409548cf89b24832afcb5d0784c24be1d1b6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62745 Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
- Dec 18, 2019
-
-
Anja Leichsenring authored
The usage of implode(array, string) has been marked as deprecated by PHP and triggers PHP Deprecation warnings by using PHP 7.4. Resolves: #89987 Releases: master, 9.5 Change-Id: I4094744bd067203856dc305bb7e1651797d0c959 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62741 Tested-by:
Markus Klösges <mkloesges@gmx.de> Reviewed-by:
-
Georg Ringer authored
Use the final subdomain localize.typo3.org instead of beta-translation.typo3.org. The latter is still available and will be removed at later time. Resolves: #89988 Releases: master Change-Id: Ic7188d9edea0bbd4753b136242d992d195196880 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62742 Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
-
Alexander Schnitzler authored
php bin/rector process Releases: master Resolves: #89807 Change-Id: I667199693dc519d0353d8e10b40d86faf1cf946a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62448 Tested-by:
Jan Stockfisch <typo3@jan-stockfisch.de> Tested-by:
-
Alexander Schnitzler authored
The now introduced functional tests are a replacement for the unit tests which were only possible by mocking the hell out of the RequestBuilder. Releases: master Resolves: #89898 Change-Id: Iccbd768ab0842e29d4954755e8f34f62bdc564f1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62580 Tested-by:
Michael Telgkamp <michael.telgkamp@mindscreen.de> Tested-by:
Daniel Goerz <daniel.goerz@posteo.de> Tested-by:
-
Benni Mack authored
Some tests use "accessibleMock" (= eval() code) where it is completely unnecessary as not even a mock is needed. Resolves: #89974 Releases: master Change-Id: I6d44a251e670ec97787a45b68b40e8f4bef2946f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62547 Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
-
Susanne Moog authored
ExactValueMatching of Closures in Prophecy may result in Comparison Failures causing the test to fail in newer PHPUnit Versions. Instead of an exact match of that closure, a type comparison is enough - as calling the closure is tested via following assertions. Resolves: #89982 Releases: master, 9.5 Change-Id: I23ef94a291a07d02e0c8857a1aeaf14931406af0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62737 Tested-by:
-
- Dec 17, 2019
-
-
Georg Ringer authored
Adopt the excludeForPackaging to include also .htaccess files in extension downloads of extension manager. Resolves: #89876 Releases: master, 9.5, 8.7 Change-Id: If5a00956165bab386a980bc897f5750a3ffc73da Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62582 Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Susanne Moog <look@susi.dev> Reviewed-by:
-
Claus Due authored
This patch: 1. Removes a redundant usage of a "NoSpace" VH and the associated namespace import since there are no other usages. 2. Deletes the VH class since it is not used elsewhere. 3. Removes an always-true and therefore redundant "if" Releases: master Resolves: #89956 Change-Id: I943653e04fa731cdc4bdcbc8d6e32663e3ca30c9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62648 Tested-by:
-
Frank Naegler authored
Resolves: #89005 Releases: master, 9.5, 8.7 Security-Commit: 82656cf8149d04f31b1441a03415b5e9a067c614 Security-Bulletin: TYPO3-CORE-SA-2019-026 Change-Id: If312a53b24d919439fa70f5df96be383876957a6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62720 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Frank Naegler authored
Resolves: #89452 Releases: master, 9.5, 8.7 Security-Commit: d73e50f02afc5459f737282ede6cc70579fe7181 Security-Bulletin: TYPO3-CORE-SA-2019-025 Change-Id: I55afb17f4b1509a3dfc945e28e5d35671f6c28f3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62719 Tested-by:
-
Andreas Fernandez authored
The Extension Manager and Language Pack Manager receive Zip archives as input from foreign sources and extract them on the disk. However, the previous approach is considered insecure as the target directory is not checked per file and directory traversal was possible. This patch adds a new service class that handles the extraction of Zip archives via PHP's internal ZipArchive class, which can handle such cases on its own. Resolves: #88764 Releases: master, 9.5, 8.7 Security-Commit: a02f19c73211a5f1c0286ab44bee27da9b73f026 Security-Bulletin: TYPO3-CORE-SA-2019-024 Change-Id: I701a577f54410344867b868409a38cc44339f976 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62718 Tested-by:
-
Andreas Fernandez authored
FAL currently filters invalid characters from file names stored by its API. However, this sanitization took no effect when the file was placed by e.g. uploads via FTP, which doesn't trigger FAL. This patch adds a missing `htmlspecialchars` call when the file extension is rendered and could not be sanitized before due to mentioned circumstances. Resolves: #88931 Releases: master, 9.5, 8.7 Security-Commit: 296c6a6723826b4ad2babbb1de5b9d23dfd256ea Security-Bulletin: TYPO3-CORE-SA-2019-023 Change-Id: I24cbc623f6390944a608eadf3ebe7a13d294e0ae Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62717 Tested-by:
-
Oliver Hader authored
In order to avoid XSS through typolink, anchor text is encoded correctly to be used in a HTML context. Fallback link texts of links to pages are encoded per default in case lib.parseFunc has not been configured. Resolves: #88635 Releases: master, 9.5, 8.7 Security-Commit: b62f71c4e098156052ff33e775208981c2ef512b Security-Bulletin: TYPO3-CORE-SA-2019-022 Change-Id: I76b0f06ad52a487e1aebc820531c11166ad45117 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62716 Tested-by:
-
Frank Naegler authored
Resolves: #88629 Releases: master, 9.5, 8.7 Security-Commit: df38c239aa9c627fb7b6f1c384d45ff0940d98fa Security-Bulletin: TYPO3-CORE-SA-2019-021 Change-Id: Ib12dc0affe7f15f1869cff57ea09d9999a0d632a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62715 Tested-by:
-
Oliver Hader authored
The ext:felogin recovery process is using a non-typesafe comparison which might be exploited with a probability of 0.000000294% and is storing the recovery token as plain MD5-hash in database. In order to streamline the process non-typesafe comparison is using PHP's hash_equals() method; for keeping backward compatibility just HMAC-SHA1 is applied to the recovery token in database. Since exploitations to this scenario are very unlikely (for a 50% chance an attacker would have to trigger the creation of around 170 million recovery requests) it is not handled with a security workflow - but using the public workflow. Resolves: #89952 Releases: master, 10.2, 9.5, 8.7 Change-Id: Idcb7b7d6eb418124dc17f1707284b6abe8a8b63b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62690 Tested-by:
-
Andreas Fernandez authored
Resolves: #89970 Releases: master Change-Id: I5b7e22c853993e7434c086c22a3898eefbe07899 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62687 Tested-by:
Björn Jacob <bjoern.jacob@tritum.de> Tested-by:
-
- Dec 16, 2019
-
-
Guido Schmechel authored
Due to a faulty query in #85425 it was no longer possible to copy files at the clipboard multi-selection-mode. This must be possible if the user has the permission to copy files, but not to copy folders. Resolves: #89669 Releases: master, 9.5 Change-Id: I1c26696a6c3886dd5669957cdce8ca472b17b577 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62321 Tested-by:
Peter Kraume <peter.kraume@gmx.de> Tested-by:
Henrik Elsner <helsner@dfau.de> Tested-by:
-
Benni Mack authored
When setting config.disablePreviewNotification = 1 in workspaces context, the preview middleware returns "null", although the method signature says it always requires a string return value. Resolves: #89959 Releases: master, 9.5 Change-Id: Icdef1891989db2869c2351adb07e6b4778d25e09 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62651 Tested-by:
Achim Fritz <af@achimfritz.de> Tested-by:
-
Markus Klösges authored
To make the code for splitting all test-jobs into stages of equal size simpler and easier to maintain, a helper class is introduced that supports chunking two lists into equally sized chunks, while ensuring that each chunk only contains a limited number of elements from one of the lists. Using this utility, the number of mssql jobs can easily be limited, while keeping the spec-code easy to follow. Releases: master, 9.5, 8.7 Resolves: #89948 Change-Id: I9e1677e19fb2ea6df7d9e964e8f772ffb7324ec8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62640 Tested-by:
-
Georg Ringer authored
Return 0 instead of null. Resolves: #89936 Releases: master, 9.5 Change-Id: Ic3345975b60fca38537750c9617d68ba9d19cc3e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62621 Tested-by:
-
- Dec 15, 2019
-
-
Jonas Schwabe authored
Releases: master, 9.5 Resolves: #89416 Change-Id: I4565d846bb86077c3e03534416f3047e2f7f0ce6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/61997 Tested-by:
-
Alexander Stehlik authored
This brings back the optgroups in the CType and list_type fields for normal editors. Additionally some tests for checkAuthMode are added. Releases: master, 9.5 Resolves: #89707 Change-Id: Ib3e6dbf3598ad767910161225a31ad2db939b3d6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62342 Tested-by:
-
Claus Due authored
The name "getName" will be reserved in Fluid 3.0 and is ambiguous. This patch renames that method to become "getFieldName" which is less ambiguous and conflict free. Additionally the ViewHelper is changed so it no longer accesses deprecated property AbstractViewHelper-> viewHelperVariableContainer, instead accessing the ViewHelperVariableContainer via $this->renderingContext. Resolves: #89861 Releases: master Change-Id: Iea474625917293afe67326f765c6a77f7fbe9b73 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62541 Tested-by:
Mathias Brodala <mbrodala@pagemachine.de> Reviewed-by:
-
Benni Mack authored
This a pre-patch to clean up the functionality of the SystemEnvironmentBuilder, which was originally introduced as part of the Bootstrap logic in 6.0. However, a few cross-concerns can be cut in TYPO3 v10: - Calling the deprecated GeneralUtility::presetApplicationContext() is not needed anymore, as it can be populated on-demand when the deprecated GeneralUtility::getApplicationContext() method is called via Environment API. This way, the ApplicationContext initialization can be put directly in the Environment API initialization call. - The static "isFunctionDisabled" method with a nasty runtime cache is only used in one place in backend, so does not belong to "building system environment", and is therefore removed. - The now unused "exitWithMessage" protected method is removed, removing a dependency to the HttpUtility class. Resolves: #89943 Releases: master Change-Id: I31156b1a1ded306d99bcf2d51de43bc919a0b3e0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62628 Tested-by:
-
Sybille Peters authored
The linkref functions return the URLs as they are displayed in the BE form. This will return '&' as '&' HTML entity. Linkvalidator should correctly decode the HTML entity. Resolves: #89488 Resolves: #89682 Releases: master, 9.5 Change-Id: I17b421354d45297423437373b92a93dfbe53d2d9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62634 Tested-by:
-
Ron Gebauer authored
An incorrect slash has been removed in multiple extension paths. The slash could lead to exceptions (e.g. within the form framework's `PersistenceManagerException` configuration), as those paths cannot be resolved, Additionally, a proper role has been added to some of those paths. Releases: master, 9.5 Resolves: #89942 Change-Id: I70f5e67d5cc7f58e66507242158e565cd8c70720 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62626 Tested-by:
-
Sybille Peters authored
Content has been migrated to "TYPO3 Explained" Reduce the content to a stub and add link. Resolves: #89949 Releases: master, 9.5, 8.7 Change-Id: I4c69c8a1f74bea223110b9b6a07e035a03183d87 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62641 Tested-by:
-
pfuju authored
As the new additional file processors registration also uses the DependencyOrderingService the value of `before` must be an array instead of a string. Releases: master Resolves: #89931 Change-Id: I8eea65c56f68ae94cddb239ac9e08c18a59ee036 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62610 Tested-by:
Alexander Schnitzler <review.typo3.org@alexanderschnitzler.de> Tested-by:
-
Claus Due authored
The getter/setter methods related to controller name and action name will be removed in Fluid 3.0. An equally valid solution is to specify the template path and filename, which also avoids the lookup logic in Fluid from running and further increases the failsafe operation of this controller. Resolves: #89859 Releases: master Change-Id: I8a3422681bef4b8ada043877ffa3c57eba82d8be Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62539 Tested-by:
-
Benni Mack authored
To increase usability for editors when using External URL links, the "target" field is moved right below the "Target URL" field. In addition the Target URL field has an increased size, to match the others. Resolves: #79317 Releases: master Change-Id: I9aec38780713df006f98be370e4fadd5c61118aa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62633 Tested-by:
Riccardo De Contardi <erredeco@gmail.com> Tested-by:
-
Stefan Neufeind authored
The funtionality was named titleTag before. But the new API is called PageTitle API. Resolves: #89940 Releases: master, 9.5 Change-Id: Idd42c5c5f53d999351c787ac7edb474795132f48 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62625 Tested-by:
Guido Schmechel <guido.schmechel@brandung.de> Tested-by:
-
- Dec 14, 2019
-
-
Anja Leichsenring authored
In order to spread computing load more evenly trough the test plan, stages receive a shuffled mix of all available jobs with a maximum of 25 mssql related functional test jobs. Resolves: #89946 Releases: master, 9.5, 8.7 Change-Id: I368530899c709bd93d455078606f978a2626679c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62635 Tested-by:
-
- Dec 13, 2019
-
-
Benni Mack authored
When working with the "pages.l18n_cfg" bitset flag, there is an option "default translation", which commonly refers to language with sys_language_uid=0. In most other cases, also in various documentation pieces, the naming is "default language" instead of "default translation" which is more correct in this case. All places are now properly named "default language" and no "default translation" is there anymore, making the functionality more consistent. Resolves: #89924 Releases: master, 9.5 Change-Id: Ibe9ad9371615119eff7535cb45d0f25b858d04da Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62602 Tested-by:
-
Oliver Bartsch authored
Cleanup code by removing unused imports in various classes. Also changes the corresponding ExtensionScanner tests because they are counting the line numbers which changed by removing the imports. Resolves: #89926 Releases: master, 9.5 Change-Id: I588a3aa778a342c6c1154bb431cd325497fd4d18 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62604 Tested-by:
-
Benni Mack authored
Due to the INTL/ICU bug, which we have seen on various places, Guzzle, which does not cover our edge cases yet, ran in the same issue as our Core versions earlier in 2019. See https://github.com/guzzle/guzzle/issues/2448 https://github.com/guzzle/guzzle/pull/2454 For the time being, lets mark guzzle as incompatible until Guzzle has solved the issue and released a new version, so we can loosen the conflict constraint. Related: #87953 Resolves: #89904 Releases: master, 9.5, 8.7 Change-Id: If64fb9472d046f020c850cd0551beeaf78796b60 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62606 Tested-by:
-
Andreas Fernandez authored
sqlserver is a special race that welcomes high memory servers as its habitat. However, we are short on resources and need to offer a very small amout of RAM for a living which already acts as server cruelty. While we're on it, it gets a nice bed to put some data on the RAM disk in the hope its job gets done at least quickier. Resolves: #89935 Releases: master, 9.5, 8.7 Change-Id: Ic06f4b7071ed1d16ec9d0cd5a0a57f05dde171f6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62611 Tested-by:
-
- Dec 12, 2019
-
-
Andreas Fernandez authored
The top toolbar items now use our AJAX API instead of $.ajax(). Resolves: #89897 Releases: master Change-Id: I134ea97f2038097d486947f30545304e47a31dff Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62578 Tested-by:
-
