- Oct 01, 2022
-
-
Chris Müller authored
ViewHelpers f:link.page and f:uri.page in non-Extbase context don't handle "additionalParams" correctly since #98484, leading to a PHP warning. Handle that argument correctly and add some tests. Resolves: #98486 Related: #98474 Releases: main Change-Id: Ife768faaab346893e34dc90dac432db9925a18b4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75926 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
-
Benjamin Franzke authored
With the upgrade to codemirror v6 in #96575 it was forgotten to remove the RequireJS configuration that is no longer needed, as codemirror v6 is loaded via ES6 modules and importmap configuration. Releases: main Resolves: #98491 Related: #96575 Change-Id: I6fc849ea1ad8bc4f493447f492140617ea6445af Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75929 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Benni Mack authored
The example tasks "sleep" and "test" have been removed. They were introduced in 2009 when EXT:scheduler was added to TYPO3 Core. Kudos to Georg Ringer who brought this up in https://review.typo3.org/c/Packages/TYPO3.CMS/+/74053 Resolves: #98489 Related: #98453 Related: #11555 Releases: main Change-Id: I4d9ea99a2a886252dccf86183e72d1d4fd008cc4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75927 Tested-by:
Chris Müller <typo3@krue.ml> Tested-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
-
- Sep 30, 2022
-
-
Christian Kuhn authored
The patch makes table "sys_template" no longer obey workspaces: The workspace related fields are gone and the overlay calls removed. An upgrade wizard sets all existing workspace overlay rows to deleted. There are quite a few reasons to do this: * Workspaces is about content: pages, tt_content and attached inline relations are content. All that is typically editable by editors. But TypoScript templates are system configuration: Templates and the Template module are admin-only, editors can't and shouldn't fiddle here. When content depends on a sys_template change, editors can't publish this in one go. Having sys_template table workspace aware is a conceptual flaw from this point of view since it creates a hard dependency to admin actions when publishing content. * Preparing sys_template changes in a workspace is not a good development workflow: More and more TypoScript is delivered by file includes under VCS to be easily manageable and deployable. Spreading TypoScript using sys_template records in the page tree is becoming old fashioned and contracts this good practice. * Workspace aware sys_template record usages are an seldom edge case: Most situations can be handled by preparing TypoScript in live already. Typical use cases are additional CSS files, which can be prepared in live by admins already using different selectors or TypoScript conditions and similar. * The workspace implementation of sys_template records was at least partially broken: Neither the Backend Template module nor the frontend worked with it flawlessly, especially when multiple sys_template records on one page were handled. * Removing workspace awareness for sys_template records reduces complexity and gives us a do-able path to improve performance on a query level in further v12 core development, especially in Frontend full-cached page scenarios and for instances not using workspaces at all. Change-Id: Id5fdd5c8f9c91ae134bea7506f0b31bf47b28fee Resolves: #98480 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75918 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
-
Andreas Fernandez authored
With #98455, the package devbridge-autocomplete was removed, but a patch file was forgotten, leading to a warning during installation of npm packages. This patch removes the left over patch file. Resolves: #98482 Related: #98455 Releases: main Change-Id: I3c18424e667e9f441572ffe543c8854d55570972 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75923 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
-
Benni Mack authored
This change updates rollup and installs some further devDependencies we need for optimizations in CKEditor5. Used command: cd Build/ npm install --save-dev \ rollup@^2.79.1 \ @rollup/plugin-node-resolve \ rollup-plugin-postcss \ rollup-plugin-svg \ rollup-plugin-terser grunt build Resolves: #98478 Releases: main Change-Id: Id682568fdd7d8ed8fdeefb056bb4d2c8dcb023f9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75920 Reviewed-by: -
Georg Ringer authored
Create database fields for TCA type `slug` columns automatically if they have not already been defined. Resolves: #97173 Releases: main Change-Id: Ib3cb0914e3b174fa00cacca9d4f238c90f2c16dd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75865 Tested-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
Torben Hansen <derhansen@gmail.com> Tested-by:
-
Torben Hansen authored
When the forgot password function is used, TYPO3 looks up the affected frontend user record by either the email address or the username. If a user record is found, the email address of that record is used to set the password forgot hash. This may lead to the situation, that the password forgot hash is set to multiple frontend user records containing the same email address (e.g. in different storage PIDs). With this change, the calculated password forgot hash is now saved based on the frontend users uid. Additionally, the sendRecoveryEmail function in RecoveryService has been streamlined and simplified. The superfluous and wrong lookup of the frontend user by the email address in RecoveryService has been removed and the function signature of sendRecoveryEmail has been changed to support an array of given userdata and a pre-calculated password forgot hash. Resolves: #95132 Related: #97784 Releases: main Change-Id: I32c3256ef88649e5bc0b4fa660eb780cc01e6389 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75274 Tested-by:
Markus Klein <markus.klein@typo3.org> Reviewed-by:
-
- Sep 29, 2022
-
-
Christian Kuhn authored
The StandaloneView has a very unfortunate flaw in __construct(): It creates an Extbase Request by default without asking and adds it to RenderingContext. The patch removes this default initialization. StandaloneView is typically *not* used within Extbase context: Extbase by default uses TemplateView. As such, creating an Extbase Request in StandaloneView by default is bad, since it switches context to Extbase when it shouldn't. This can make ViewHelpers behave differently and in general adds trouble and cross dependencies. As a side effect, some ViewHelpers will now actively refuse to work in non-extabse context and throw exceptions. Most notably, f:form and f:form.* throw exceptions when used in a FLUIDTEMPLATE content object. We *might* be able to relax this during further v12 development, though. It is possible we later add a factory to the Fluid views in general that takes care of setting a request to the view. This however needs some streamlining in Fluid standalone library first and requires some further decisions. Change-Id: I1cf7b8a7baf5280d67f887c55b7b6493942c136a Resolves: #98377 Related: #96473 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75779 Tested-by:
-
Christian Kuhn authored
Field 'pid' in TCA tables should not allow negative integer values anymore since "pid -1" values have been removed from workspaces in v10. The patch changes the field to an unsigned int. Change-Id: I876ffe78cef160979fae42a77a59972f26414ddf Resolves: #98475 Related: #89555 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75915 Tested-by:
-
Daniel Siepmann authored
Resolves: #98421 Releases: main, 11.5 Change-Id: I069ae69d4d396883393f76b1c9cf1b1cacaa0f9d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75852 Tested-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
Markus Klein authored
Avoid PHP warning if pageRow is empty, i.e. no 'editlock' can be checked. Releases: main, 11.5 Resolves: #98459 Change-Id: I49d5d98484612921c02746bcf75c9dfc2bef526c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75884 Tested-by:
-
Andreas Fernandez authored
This patch migrates the auto-suggest feature used in FormEngine to a custom implementation incorporating web components. A user may navigate through the result list with the keyboard's arrow keys and select an item with the "Enter" key. In the same run, the JavaScript library `devbridge-autocomplete` is removed as it is not used anymore within TYPO3, along with its associated CSS definitions. As the web component approach allows us more flexibility and to maintain a consistent look & feel of the backend, some properties were removed from the suggest wizard's items. Resolves: #98455 Releases: main Change-Id: I7abc40bfe9161a7a246ac451bd046034dcc8d9bd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75881 Tested-by:
Frank Nägler <frank.naegler@typo3.com> Tested-by:
-
Chris Müller authored
Resolves: #98465 Related: #98426 Releases: main Change-Id: I3d963f20b2b6212a36a6912f439aa19e1fc71383 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75888 Tested-by:
-
Chris Müller authored
Resolves: #98466 Releases: main Change-Id: Idccac90e9915e078b0097f2c7af5ec708b5a0e1c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75889 Tested-by:
-
Benni Mack authored
This change uses the core UriBuilder and LinkFactory (FE) for creating links in f:link.page and f:uri.page to avoid booting up Extbase when using f:link.page in non-Extbase Fluid context. Resolves: #98474 Releases: main Change-Id: Iec0e09af01dae0bb11bf62cee5f03be50e25352d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75808 Tested-by:
-
Andreas Fernandez authored
The UX team discusses internally whether the existing shortcut to open the live search (Shift+Shift) introduced in #98348 is counter-intuitive for regular editors or not. Common sense seems to be Ctrl/Cmd+K to open the search in several applications and websites (Discord, Slack, and even in Chrome), so the keyboard shortcut should be changed. If any modal is already open, the new keystroke is not caught and any default browser behavior is kept. Resolves: #98467 Related: #98348 Releases: main Change-Id: I6e4a08030f88ebee1cc0e6f944786e1defb30ea4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75890 Tested-by:
Stefan Froemken <froemken@gmail.com> Tested-by:
Annett Jähnichen <mcmietz@web.de> Tested-by:
-
Oliver Hader authored
Added tests for malformed JWT-like literals. Resolves: #98473 Related: #97305 Releases: main Change-Id: Ida62075c4bf9480d208ee1ca77b010c0559b025f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75913 Tested-by:
-
Andreas Fernandez authored
The preview mode selector doesn't change its width anymore based on the largest element available as the behavior may become glitchy and hard to replicate once jQuery is gone. As a drive-by fix, the iframes have a white background in case the pages have no dedicated CSS to avoid overlapping the content of the iframes in the "Slider" preview mode. Resolves: #98420 Releases: main Change-Id: I344ee7c99888261b19b97ad98cc31c519d1e1d4b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75850 Tested-by:
-
Oliver Hader authored
A CSRF-like request-token handling has been introduced, to mitigate potential cross-site requests on actions with side-effects. This approach does not require an existing server-side user session, but uses a nonce (number used once) as a "pre-session". The main scope is to ensure a user actually has visited a page, before submitting data to the web server. Introduces package https://packagist.org/packages/firebase/php-jwt > composer req firebase/php-jwt Besides that, AbstractUserAuthentication has been changed to require this introduced request-token, to mitigate Login CSRF attacks. The security enhancement potentially break custom login templates and application handlers - this is why it is introduced and enforced for TYPO3 v12.0. Resolves: #97305 Releases: main Change-Id: I74d9e1890017aae4a00999f549ea04716d68f721 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183 Reviewed-by:
-
Christian Kuhn authored
Property $type is set by a required constructor argument and needs no default. Resolves: #98472 Releases: main Change-Id: I6b366496acce5f7370cf8c31d841ab2cb4d562dd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75912 Tested-by:
-
Christian Kuhn authored
FormProtectionFactory has a static instance cache that potentially leaks state in between tests. The patch adds a couple of purgeInstances() calls to avoid this. Resolves: #98470 Releases: main, 11.5 Change-Id: Ic3e0aa5b6cbd7b7368aab34b74890d3f7ee04c1b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75891 Tested-by:
-
- Sep 28, 2022
-
-
Benjamin Kott authored
During the removal of font-awesome, the global CSS was included in the form-specific CSS. We are now removing it again since it is not necessary since the form-specific CSS is included in addition to the global backend CSS. Related: #97877 Resolves: #98461 Releases: main Change-Id: I502a627f2d2b612cd8c4a8b29c652ff952a94165 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75886 Tested-by:
-
Benjamin Kott authored
The inclusion of the global CSS variables into the SCSS variables were flawed from the very beginning. The include resulted in multiple unwanted occurrences of these variables produced by the current architecture of the SCSS files used in the backend. It has been a known issue and accepted issue from the start, since we did not have a plan yet to handle them. The CSS variables are moved to a dedicated root file that is part of the minimal setup. The minimal setup is meant to be standalone and only included once per page. Resolves: #98460 Releases: main Change-Id: I47a1cca6fb74f039e9e8df9ef6b5076f22922dc4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75885 Tested-by:
-
Benjamin Kott authored
Parent modules are now indicating correctly that a submodule has been selected and active. Resolves: #98458 Releases: main Change-Id: Idf438b4fdddde48d6e4b628f18dc9c10ac9880ec Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75883 Tested-by:
-
Andreas Fernandez authored
jQuery and jQuery UI is now removed from EXT:viewpage. jQuery UI was used to make the preview frame resizable, which is now handled by interact.js, which may be used for further replacements. Executed command: npm install --save interactjs Resolves: #98430 Releases: main Change-Id: I90671e190ae83c6cd2db9d033c00dac47da7c684 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75862 Tested-by: -
Christian Kuhn authored
Extension 'recordlist' is a must-have extension that is part of 'minimal usable system' and always loaded: Especially 'backend' has various cross dependencies to 'recordlist', backend "search" using the list module for detail display is one of the most obvious ones. In general it's bad if the main 'backend' extension has such direct dependency towards another more specific extension: The core development slowly strives to have the tuple 'core-backend-frontend' as main set of crucial extenions, with eventually making 'backend' and 'frontend' optional in some happy future. To solve the unfortunate dependency from 'backend' to 'recordlist', 'recordlist' is now merged into 'backend', reducing the set of extensions required for a 'minimal usable system' by one. > composer update --lock Change-Id: Ie73ccb992b9ad29626478ff9acd6dc9a15b8aa9a Resolves: #98443 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75876 Reviewed-by:
-
Nikita Hovratov authored
In order to further simplify FlexForm definitions, the superfluous array key "TCEforms" is now removed and not evaluated anymore. Its sole purpose was to wrap real TCA definitions. The automatic removal of this key was already done in FormEngine context. This is now always done, when parsing FlexForm definitions with FlexFormTools (parseDataStructureByIdentifier). Resolves: #97126 Releases: main Change-Id: Ib27fd7025e0c21cbd4879454f8dc9dd548256b7c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/73835 Tested-by:
-
Georg Ringer authored
The label in the extension manager must be adopted as t3x is not allowed anymore since #92590. Furthermore, the upload allows only the selection of zip files to make it easier for users. Resolves: #98438 Related: #92590 Releases: main, 11.5 Change-Id: I7e2a616741f3c0355f09fb83cf85763f004bb55a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75870 Tested-by:
Guido Schmechel <guido.schmechel@brandung.de> Reviewed-by:
-
Chris Müller authored
Resolves: #98368 Releases: main Change-Id: Ibdda66047e4b6eb55bca4cdbf217d045033e54b5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75750 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
- Sep 27, 2022
-
-
Achim Fritz authored
this adds a new PSR-14 Event into the LocalizationController allowing extension authors to modify the whole payload in the JsonResponse of the getRecordLocalizeSummary Method Resolves: #98426 Releases: main Change-Id: I7309f665866202f2f5f31228b053a983f6a3423a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75860 Tested-by:
-
Benjamin Kott authored
Prefer loading a single variable font file for normal and italic versions of Source Sans 3 instead of dedicated ones for each font-weight version. Also dropping woff fallbacks since woff2 files are supported for all targeted browsers. The web fonts were moved to a dedicated font file instead of merging it into every parsed file to ensure it's only loaded once. Resolves: #98442 Releases: main Change-Id: I5f596ddf49093d8fd29d1c245eae3f044cfd5f84 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75875 Tested-by:
-
Benjamin Kott authored
The typo3-docheader declarations are not used and can be removed. Resolves: #98446 Releases: main Change-Id: I4b1c77149ae864b19aa565da1b563bc389b79ea3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75877 Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
-
Benni Mack authored
The hook $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['GLOBAL']['recStatInfoHooks'] is removed from Page Module and List Module. The hook was used to modify Icons for a specific record. In list module, the event "ModifyRecordListRecordActionsEvent" can be used. In page module, the Fluid template can be overridden to apply custom renderings. Resolves: #98441 Related: #95105 Releases: main Change-Id: I76c44b030eb46f467a3f3e1be61677920b5bffc1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75874 Tested-by:
-
Christopher Schnell authored
The filemounts from groups are used when a backend user logs in. Resolves: #98440 Releases: main, 11.5 Change-Id: I10b5eeeea003e71d22bf92d91656627140bacfcd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75873 Reviewed-by:
-
- Sep 26, 2022
-
-
Larry Garfield authored
Sets return types for most classes that implement PHP SPL classes. Only "mixed" return types are not set: That would be hard breaking for extensions that support both core v11 and v12, since it is not PHP 7.4 compatible. Those places are marked with an @todo to switch to mixed in v13. Resolves: #98035 Releases: main Change-Id: Icd62a69270a6718c8356108e55a0729779609c53 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75310 Tested-by:
-
Chris Müller authored
Method descriptions are added from the changelog here: https://docs.typo3.org/c/typo3/cms-core/main/en-us/Changelog/12.0/Feature-98304-PSR-14EventForModifyingEditFormUserAccess.html to the source code. This also eases usage for coders who use the code as documentation. Resolves: #98401 Related: #98304 Releases: main Change-Id: I218a386efba863c92af694e8364c8b6400a67804 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75833 Tested-by:
-
Christian Kuhn authored
EXT:workspace User TSconfig options "options.workspaces.swapMode" and "options.workspaces.changeStageMode": * They are at least partially broken since the switch to doctrine/dbal in core v8. This hasn't been reported as bug, we can safely assume they are used very seldom. * They are rather hard to understand and usability wise questionable since more elements than selected in the Backend module magically change workspace state or are published. * The options are at least partially obsolete since the core considers references for important child records internally already - for instance for inline parent-child relations - and changes child state as needed. The patch removes these TSconfig options and their implementation. Change-Id: I0bb1e955a5124302eac8063e0a3c3f2e4441f857 Resolves: #98437 Resolves: #97422 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75861 Tested-by:
-
linawolf authored
Releases: main Resolves: #98433 Change-Id: Iadd221621d10ba960c26ad085288657d05d673e4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75866 Tested-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
-
Oliver Hader authored
Add static library functions that allow using base64url-compliant values (according to https://tools.ietf.org/html/rfc4648#section-5). The difference to classic base64 is, that the result alphabet is adjusted like shown below, padding (`=`) is stripped completely: + position #62: `+` -> `-` (minus) + position #63: `/` -> `_` (underscore) Resolves: #92509 Releases: main, 11.5 Change-Id: I8804824f3a7fb4e08e18ef6dee6826744dbd41bc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66075 Tested-by:
-
