- Apr 12, 2016
-
-
Morton Jonuschat authored
The Doctrine DBAL library is added as a composer dependency as a foundation to replace the current DatabaseConnection class, EXT:dbal and EXT:adodb. Doctrine DBAL is encapsulated within a ConnectionPool class that manages the connections to all defined database connections. The main parts of the patch consist of the connection management, convenience methods for simple SQL queries, a QueryBuilder to build complex queries in a database platform independent way and a QueryRestriction Builder that aims to replace deleteClause and BEenableFields in the backend context as well as enableFields in frontend context. Documentation and an example implementation of using the API will follow in separate patches. Releases: master Resolves: #75454 Change-Id: I47837d9e77331132807bbb7fb956c359031b4f16 Reviewed-on: https://review.typo3.org/47111 Reviewed-by:
Frank Naegler <frank.naegler@typo3.org> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Helmut Hummel authored
In case a backend or frontend user is stored in the database with an empty string as password (not possible through backend UI), it is possible to authenticate this user using an empty password with the standard TYPO3 username/password authentication services. By definition this should be prohibited. Resolves: #75055 Releases: master, 7.6, 6.2 Security-Bulletins: TYPO3-CORE-SA-2016-009, 010, 011, 012 Change-Id: I4ca1b7d80c04de86d6ff1ef6e99a4a57b97ed948 Reviewed-on: https://review.typo3.org/47611 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Nicole Cordes authored
To view a preview of a workspace page a backend user is simulated. Currently the user who created the preview link is taken into account. This patch creates a limited backend user to be able to process the web request. Resolves: #28175 Releases: master, 7.6, 6.2 Security-Commit: f0445be5322b4c0e4b1c0900542aca4e00a39f46 Security-Bulletins: TYPO3-CORE-SA-2016-009, 010, 011, 012 Change-Id: I80dd9168b22bf62b2a2ed4a264240d07f056cc73 Reviewed-on: https://review.typo3.org/47610 Reviewed-by:
-
Nicole Cordes authored
In Javascript context the title attribute of a selected option is passed as unescapd HTML argument to the function. Creating a new option tag without title validation results in a XSS possibility. This patch removes hardcoded attribute setting and uses jQuery function which take care of proper escaping. Resolves: #75164 Releases: master, 7.6, 6.2 Security-Commit: c6ec139a9ad69db67c17b1f3688b07e65f8898cc Security-Bulletins: TYPO3-CORE-SA-2016-009, 010, 011, 012 Change-Id: Ie664fdaf71f4f28f66b0e7cde42da1d6284b1f02 Reviewed-on: https://review.typo3.org/47609 Reviewed-by:
-
Frank Naegler authored
This patch fix a XSS vulnerability in TCA type inline. Resolves: #73460 Releases: master, 7.6 Security-Commit: 8f178b4a68cbb50a55e0864b3f3c9989aa415ab3 Security-Bulletins: TYPO3-CORE-SA-2016-009, 010, 011, 012 Change-Id: I7a39d3d6717b3edb02f6a7ee82675279d7ebf940 Reviewed-on: https://review.typo3.org/47608 Reviewed-by:
-
Andreas Fernandez authored
Since the XEE security fix (I26701fc2ffb5aed7ccbd96c168aef571d012091e), the XML files in the Extension Manager may are not loaded anymore, depending on the machine. Change the way how the files are loaded to fix the issue. Change-Id: I2a3dffd089ed427b965bcbae8aa596c26a81770b Resolves: #75022 Releases: master, 7.6, 6.2 Reviewed-on: https://review.typo3.org/47196 Reviewed-by:
Daniel Maier <dani-maier@gmx.de> Reviewed-by:
Mathias Schreiber <mathias.schreiber@wmdb.de> Tested-by:
Stephan Großberndt <stephan@grossberndt.de> Reviewed-by:
Susanne Moog <typo3@susannemoog.de> Reviewed-by:
-
Georg Ringer authored
Change width of the textarea to edit file's content in the file list module if EXT:t3editor is not installed. Resolves: #75495 Releases: master, 7.6 Change-Id: I5b05f753cae8a11a7889a6391521fcfd7c0aef51 Reviewed-on: https://review.typo3.org/47586 Reviewed-by:
Andreas Fernandez <typo3@scripting-base.de> Reviewed-by:
Wouter Wolters <typo3@wouterwolters.nl> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Michael Oehlhof <typo3@oehlhof.de> Tested-by:
-
- Apr 11, 2016
-
-
Frank Naegler authored
Move description field into own tab and display description column as callout. Resolves: #75515 Releases: master Change-Id: I552b814d1ea06b02a2b34653bca09769c656fa48 Reviewed-on: https://review.typo3.org/47565 Reviewed-by:
-
Frank Naegler authored
A new renderType was added to render the backend layout wizard inline in FormEngine. Resolves: #75497 Releases: master Change-Id: If26ff91e2c35a692f27b4fd55debbc69027d754a Reviewed-on: https://review.typo3.org/47563 Tested-by:
-
Jan Helke authored
As decided during the last RL Product Team meeting in Dusseldorf, the upgrade wizards from the install tool should stay for two generations of LTS versions. This reverts commit 021237d5. Releases: master Resolves: #75485 Related: #72367 Change-Id: I2f9d52a5bf0ffeca6843780354e349a5151ddb07 Reviewed-on: https://review.typo3.org/47556 Reviewed-by:
-
Benjamin Kott authored
Releases: master, 7.6 Resolves: #74324 Change-Id: I3432881a896accf94d5a0a101dbcbecbe6027320 Reviewed-on: https://review.typo3.org/47566 Reviewed-by:
Sascha Egerer <sascha@sascha-egerer.de> Tested-by:
-
Christian Kuhn authored
Fixes a circular dependency if local core dev version is not a release branch. Change-Id: Iff1e08bdf5345a3de133c879f87f7b922c0e5b0e Releases: master Resolves: #75516 Reviewed-on: https://review.typo3.org/47568 Reviewed-by:
-
Christian Kuhn authored
Adds styleguide as require-dev composer dependency and call the data generator for acceptance tests. Change-Id: I917b732face3c9d194ef88bada18e3195562a6dc Resolves: #75481 Releases: master Reviewed-on: https://review.typo3.org/47541 Reviewed-by:
-
Nicole Cordes authored
Currently the CropViewHelper is not able to return HTML as the output is always escaped. This patch corrects escaping for children and output. Resolves: #75459 Related: #75133 Releases: master Change-Id: I5b9aae67f4550b2923424ae2690084f8849c12a9 Reviewed-on: https://review.typo3.org/47547 Reviewed-by:
Helmut Hummel <helmut.hummel@typo3.org> Tested-by:
Stefan Neufeind <typo3.neufeind@speedpartner.de>
-
Sascha Egerer authored
The composer package for selenium standalone is deprecated and must be updated to support the current Firefox version. Change-Id: I1c0e5a2c010b5f154b44ee80253cbe4e43f4279a Resolves: #75492 Releases: master Reviewed-on: https://review.typo3.org/47560 Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Gianluigi Martino authored
Ensure that access settings are shown after clicking on visibility settings in language view (Clickmenu) Change-Id: If674e4328086edcc83386539851a42b6b95a1c84 Resolves: #75476 Releases: master, 7.6 Reviewed-on: https://review.typo3.org/47552 Reviewed-by:
Riccardo De Contardi <erredeco@gmail.com> Reviewed-by:
-
- Apr 10, 2016
-
-
Benjamin Kott authored
Releases: master Resolves: #75491 Change-Id: Ie1daec9744b89d9082d8bd3820fe023b3e540991 Reviewed-on: https://review.typo3.org/47559 Reviewed-by:
-
Frank Naegler authored
This patch adds a button to lock the install tool again, also without login. Resolves: #56640 Releases: master, 7.6 Change-Id: I6a4368376082288955eb20197ab437e893c93ffc Reviewed-on: https://review.typo3.org/47555 Reviewed-by:
Kay Strobach <typo3@kay-strobach.de> Tested-by:
Benjamin Kott <info@bk2k.info> Tested-by:
-
Benjamin Kott authored
Releases: master Resolves: #75483 Change-Id: Ia525a19d87be6a99ca2cc48b8561ebc800e9e34e Reviewed-on: https://review.typo3.org/47554 Reviewed-by:
-
- Apr 08, 2016
-
-
Andreas Fernandez authored
``PageRenderer:: addRequireJsConfiguration`` does now load RequireJS in the backend, as this method is called before ``loadRequireJs()`` otherwise, colliding with how ``loadRequireJs()`` handles RequireJS. This is not done in frontend, as the output could get broken. Resolves: #75353 Releases: master, 7.6 Change-Id: I7a1140036dcbf9ab869b361c40fedc3813a887d3 Reviewed-on: https://review.typo3.org/47478 Reviewed-by:
Markus Sommer <markussom@posteo.de> Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
-
Benni Mack authored
Allow pageTSconfig option to hide all tables at once. Example: mod.web_list { hideTables = * table.pages.hideTable = 0 } Resolves: #27471 Releases: master Change-Id: I9d64b63e09efcafe20ef614c16cf3f523d6d323c Reviewed-on: https://review.typo3.org/47535 Reviewed-by:Daniel Goerz <ervaude@gmail.com> Tested-by:
-
Daniel Goerz authored
Change-Id: I9b33a34ab76b2dd3da0b25763e1b97f845383824 Resolves: #67699 Releases: master, 7.6 Reviewed-on: https://review.typo3.org/47542 Reviewed-by:
Morton Jonuschat <m.jonuschat@mojocode.de> Tested-by:
-
Christian Kuhn authored
This brings a list of bug fixes and better PHP7 compatibility. This is a "hacked" version from vanilla 5.20.3 where some local changes are applied that were not yet fixed upstream, see forge for a diff. Change-Id: I16a3d601bc0b1bf77ab3bd35311a57df6595a1ed Resolves: #75447 Releases: master, 7.6 Reviewed-on: https://review.typo3.org/47537 Reviewed-by:
-
Wouter Wolters authored
Resolves: #75192 Releases: master Change-Id: I9640e0a037074598fd0ac10346825d16fbbd7afe Reviewed-on: https://review.typo3.org/47524 Reviewed-by:
Nicole Cordes <typo3@cordes.co> Tested-by:
-
- Apr 07, 2016
-
-
Susanne Moog authored
Use OS independent temp directory. Change-Id: Idb6f0a0d9f5666ca84ec10d9a342bf29c0571068 Resolves: #75388 Releases: master Reviewed-on: https://review.typo3.org/47536 Reviewed-by:
-
Helmut Hummel authored
Releases: master Resolves: #75133 Change-Id: Ibc215db42f7822798a7e4d34b91aa87b6019981c Reviewed-on: https://review.typo3.org/47532 Reviewed-by:
-
Susanne Moog authored
At the moment a lot of tests are skipped on Windows environments. The main reasons are permissions, symlinks and shell exec commands. As symlinks are now working on Windows (if the user / group is allowed to create them) there is no reason to skip those tests. As you can only create valid symlinks on Windows (the target is checked for existence) the tests needed to be adjusted to take that into account. Additionally some of the other tests don't need to be skipped either, as they mock all system specific calls (e.g. AbstractNodeTests). For the other tests the message on skipping was updated to contain more information as to what causes them to be irrelevant on Windows. Resolves: #75388 Releases: master Change-Id: I86c6d9b0cec34a94d1185f46e2023af811b16107 Reviewed-on: https://review.typo3.org/47502 Reviewed-by:
-
Markus Klein authored
Resolves: #75375 Releases: master Change-Id: I2da5e7234cd0890cea33c470dab2922a3dc36ee8 Reviewed-on: https://review.typo3.org/47492 Reviewed-by:
-
Benni Mack authored
The ExtDirect API cannot convert the Uri object from a string, this is fixed now by casting to a string now. Resolves: #75340 Releases: master Change-Id: I140e9b4ee9af0b024eb5074d7f602156cf50e4a1 Reviewed-on: https://review.typo3.org/47534 Reviewed-by:
-
Markus Klein authored
Any class listed in the LegacyClassesForIde file must not be used by Core anymore. Resolves: #75376 Releases: master Change-Id: If69782eb9227270c511a47ecf229ff31c7892fb6 Reviewed-on: https://review.typo3.org/47493 Reviewed-by:
-
Wouter Wolters authored
modification_date is a string from the database and SplFileInfo mtime is returned as integer. Cast modification_date to an integer too. Resolves: #75421 Releases: master,7.6 Change-Id: I7523f9f722af8cc5f4e137e32bf07e2c3105214d Reviewed-on: https://review.typo3.org/47519 Reviewed-by:
-
Benni Mack authored
The index_rel.first database table of indexed_search is used to store the number of occurrences of words, which could be more in bigger indices. Resolves: #75406 Releases: master, 7.6 Change-Id: I05b0fc1e2f74e2eb09b3af9d643b3145c0d6db6e Reviewed-on: https://review.typo3.org/47507 Reviewed-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
Benni Mack authored
The execution of traditional AJAX requests not registered via routes is already deprecated with #73352, however the registration and usage of the methods to add AJAX endpoints haven't been deprecated yet. The patch takes care of deprecating - BackendUtility->getAjaxUrl() - UriBuilder->buildUriFromAjaxId() Resolves: #75340 Releases: master Change-Id: I6adf7f7c868c87f08400aa548d5deb8febddd857 Reviewed-on: https://review.typo3.org/47466 Reviewed-by: -
Andreas Fernandez authored
The callback of ``Wizard.addSlide()`` has now a third parameter ``identifier`` holding the identifier of the current slide. Resolves: #75386 Releases: master Change-Id: I34dd9f176782fe88a8aaf8d6af09d019261803a9 Reviewed-on: https://review.typo3.org/47501 Reviewed-by:
-
Andreas Fernandez authored
Resolves: #75432 Releases: master Change-Id: I7b45a953b68fd26d3660a2937ba8312e3afb5c21 Reviewed-on: https://review.typo3.org/47525 Reviewed-by:
-
Christian Kuhn authored
A couple of symfony related patch level package updates as well as a minor patch level of typo3/cms-composer-installers Change-Id: I5110c9d889bd17756698eddf2b18bda9b619680c Resolves: #75425 Releases: master Reviewed-on: https://review.typo3.org/47516 Reviewed-by:
-
Christian Kuhn authored
To simplify debugging failed tests, enable the "Recorder" extension of codeception to automatically screen shot each step. For successful tests the screenshots are later removed again, but kept for failed tests. Calling typo3temp/var/tests/records.html presents a list of failed runs (.htaccess must be configured to allow surfing this) and a slideshow is created for each scenario. Change-Id: I18a455e40963e3c70cdf072f2a68decfe648d704 Resolves: #75427 Releases: master Reviewed-on: https://review.typo3.org/47518 Reviewed-by:
-
Andreas Fernandez authored
Resolves: #75433 Releases: master Change-Id: Ic73beb093efc5c0648d2ea6e66286b0a6b439e4e Reviewed-on: https://review.typo3.org/47526 Reviewed-by:
-
Wouter Wolters authored
Resolves: #75430 Releases: master Change-Id: Id1326862f9234c72d1231f8e1108d4ac083a8d1c Reviewed-on: https://review.typo3.org/47521 Reviewed-by:
-
Wouter Wolters authored
Resolves: #75315 Releases: master,7.6 Change-Id: I8721174ed5addd2ec7ff6c27a8e66ec5bdf765c2 Reviewed-on: https://review.typo3.org/47522 Reviewed-by:
-
