Add a new security section within .htaccess to help users secure their
TYPO3 install:

- Restrict access to deleted files in Recycler directories
- Restrict access to TypoScript files in default templates directories
- Restrict access to Private extension directories

Resolves: #28368
Change-Id: I94c09f50616af55cfdd9577097251692b2111ae7
Reviewed-on: http://review.typo3.org/3462
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer

Parts of Core are marked as deprecated and should be removed in
TYPO3 4.6. This patch does this clean-up.

Change-Id: Ib33c649d1b1f31ebbfb0fe6e825bb81b47b185a1
Resolves: #27983
Releases: 4.6
Reviewed-on: http://review.typo3.org/3351
Reviewed-by: Markus Klein
Reviewed-by: Philipp Gampe
Reviewed-by: Georg Ringer
Reviewed-by: Steffen Gebert
Tested-by: Steffen Gebert
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers

After fix of compatibility constructor, the real constructor
(__construct) is missing. This leads to a recursive call on
itself and thus crashes.

Change-Id: Ic788b8dfb9ae42a4ad7c1b9a122f31de1df98741
Fixes: #28354
Releases: 4.6
Reviewed-on: http://review.typo3.org/3445
Reviewed-by: Georg Ringer
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers

The t3lib_extMgm::getExtensionVersion function includes
the ext_emconf.php file of an extension each time it is called.

The version is cached using the CF runtime cache.

Change-Id: I05502a035a597b5b2b09e60d4027db47d8e2ac71
Resolves: #28233
Releases: 4.6
Reviewed-on: http://review.typo3.org/3353
Reviewed-by: Georg Ringer
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Steffen Ritter
Tested-by: Steffen Ritter

Some of the FlashMessages have such a big space requirement that users
have to wait, until they disappear to continue working in the backend.

This patch makes the ExtJS FlashMessages disappear, if the user clicks
on close icon in the message header.

Change-Id: I270dc0b6b4cfef945aa5802abcf586671db63e8b
Resolves: #27747
Releases: 4.6
Reviewed-on: http://review.typo3.org/2956
Reviewed-by: Steffen Gebert
Tested-by: Steffen Gebert
Reviewed-by: Kay Strobach
Tested-by: Kay Strobach
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Steffen Ritter
Tested-by: Steffen Ritter

The default sorting was missing in TCA for the fe_users table. Not the table is ordered by the username field by default, but the backend user is able to override this via the GUI.

Change-Id: I565be72644d65beaa9f694269ccd3b6d5c077700
Resolves: #25604
Reviewed-on: http://review.typo3.org/3433
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer
Reviewed-by: Chris Zepernick
Reviewed-by: Steffen Ritter
Tested-by: Steffen Ritter

While tslib_fe::getLL() checks the existance of a translated label with
isset(), language::getLLL() does this with a strict string comparison.
This is evaluated as TRUE, if the subkey is not set at all, which is an
unexpected behavior.

Thus check, whether the label was translated into the current language
using isset().

Change-Id: I421d541d9aeaa2403052d212c7adba819a4e116f
Resolves: #28264
Releases: 4.6
Reviewed-on: http://review.typo3.org/3380
Reviewed-by: Xavier Perseguers
Reviewed-by: Stanislas Rolland
Tested-by: Stanislas Rolland
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer
Reviewed-by: Steffen Gebert
Tested-by: Steffen Gebert

Change-Id: Ia786457dbc4c850c67f7293be38b2591786f1553
Resolves: #28323
Releases: 4.6
Reviewed-on: http://review.typo3.org/3422
Reviewed-by: Fabrizio Branca
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Stefan Neufeind
Reviewed-by: Steffen Ritter
Tested-by: Steffen Ritter

Because of type TEXT the database already allows for more
than 5 items. So this patch raises the level in TCA as well.

Change-Id: I7acb4d9bfc38b6d5cef0fabe82560586f0c4eea3
Resolves: #28317
Releases: 4.6
Reviewed-on: http://review.typo3.org/3417
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer
Reviewed-by: Chris Zepernick
Reviewed-by: Steffen Ritter
Tested-by: Steffen Ritter

Add support for user-supplied parameters when using a userFunc
within a TCA field.

Change-Id: Ic808c7bc067f232d881631b790e41112fe53c44c
Resolves: #28314
Reviewed-on: http://review.typo3.org/3432
Reviewed-by: Steffen Ritter
Tested-by: Steffen Ritter
Reviewed-by: Dominique Feyer
Tested-by: Dominique Feyer
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers

Removing a class on a link in the link dialogue works in Firefox and IE7 but not in IE8, due to IE8's new conformance to standard name for class attribute.

Change-Id: I304520071d428be5e6fd613252be74dcaadc8b91
Resolves: #28009
Releases: 4.6, 4.5
Reviewed-on: http://review.typo3.org/3426
Reviewed-by: Stanislas Rolland
Tested-by: Stanislas Rolland

The memory_limit is hardcoded to 256m and
max_execution_time to 600.

There is no reason to hardcode those settings,
sometimes a bit more of both is needed.

Change-Id: I3e690eea1a079ed6cadd548230afc405e005b115
Resolves: #27272
Resolves: #17020
Resolves: #17045
Resolves: #18926
Releases: 4.5, 4.6
Reviewed-on: http://review.typo3.org/2610
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Kay Strobach
Tested-by: Kay Strobach
Reviewed-by: Björn Pedersen
Reviewed-by: Steffen Gebert
Tested-by: Steffen Gebert

As IE6 is not supported anymore, add a warning that the user should
upgrade his browser.

Change-Id: Id7d8411ae38e55dd6fa2747dce2fb85522c7bbc7
Resolves: #20953
Reviewed-on: http://review.typo3.org/3381
Reviewed-by: Stefan Neufeind
Tested-by: Eric Chavaillaz
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers

Task #26505 removed old PHP4 constructors without deprecating
them first as required by TYPO3 core rules.
The change was commited to Git here: https://review.typo3.org/1797

The fix: reintroduce the old constructors and deprecate them.

Change-Id: I2fa86c6d2ddb7ffd79fbd5afbbd29eddb975ec01
Resolves: #28246
Releases: 4.6
Reviewed-on: http://review.typo3.org/3371
Reviewed-by: Stefano Kowalke
Reviewed-by: Kay Strobach
Tested-by: Kay Strobach
Reviewed-by: Stefan Neufeind
Reviewed-by: Jigal van Hemert
Tested-by: Jigal van Hemert

Implement auto-activation of saltedpasswords and rsaauth extension.


Resolves: #28273
Releases: 4.6

Change-Id: If96cbbffec59f436748e331783bc6fc94fb2b87d
Reviewed-on: http://review.typo3.org/3389
Reviewed-by: Jigal van Hemert
Tested-by: Jigal van Hemert
Reviewed-by: Kay Strobach
Tested-by: Kay Strobach
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel

If TYPO3 is configured to not suppress PHP warnings, the unit test
'checkDateWithInvalidDateValues with data set "Not Good"'
of Testsuite tx_scheduler_ModuleTest fails.

As it tries to insert non-numeric values into mkstring(), this warning
is raised.

We can safely suppress the output of PHP warnings for the mktime call,
as afterwards its return value is checked.

Change-Id: I7c6b9f587b574334e0096c800de98cb6ffc2033f
Resolves: #28271
Reviewed-on: http://review.typo3.org/3388
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel

As the whole handling of the ADMCMD_preview is related to
version / workspaces, the according code should go in
these extensions, thus it is removed in the core.

Change-Id: Iee2f4ea42aa28825d991df92eff53c7143d93e83
Resolves: #27931
Releases: 4.6
Reviewed-on: http://review.typo3.org/3080
Reviewed-by: Stefan Neufeind
Reviewed-by: Benjamin Mack
Tested-by: Benjamin Mack

A side-effect of #27936 is that the value 0 of integer fields is not
shown anymore in the List module. This error was also catched by the
failing Unit Test t3lib_befuncTest::getProcessedValueForZeroStringIsZero

Change-Id: I07da5d05c08a9066e8e9c8ad68d3f83ef6f7dbcb
Resolves: #28218
Relates: #27936
Releases: 4.6, 4.5, 4.4, 4.3
Reviewed-on: http://review.typo3.org/3369
Reviewed-by: Susanne Moog
Tested-by: Susanne Moog
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Tolleiv Nietsch
Tested-by: Tolleiv Nietsch
Reviewed-by: Benjamin Mack
Tested-by: Benjamin Mack

By default, the content of table cells is always wrapped in
paragraph tags when rendered in the frontend even if no
paragraphs are entered in the RTE.

This RFC changes this default. Non-wrapped content will not
be wrapped in paragraph inside a table cell.

Change-Id: Ia23d0bbab338d6fb0efc90eb60bdd485a2c2c5f8
Resolves: #25084
Reviewed-on: http://review.typo3.org/3327
Reviewed-by: Susanne Moog
Tested-by: Susanne Moog

stdWrap was supported at select.andWhere already.

Be careful not to use GPvar with this feature without
securing it (e.g. with stdWrap.intval)

Change-Id: I22c0e2c1c49fdd44ab67b823043a2e07f304e8c8
Resolves: #17881
Reviewed-on: http://review.typo3.org/3337
Reviewed-by: Susanne Moog
Tested-by: Susanne Moog

* List style is missing.
* Get rid of inline styles.
* Render p instead of li if only one message comes up (e.g. if reports module is installed).

Change-Id: Ic24b92c74eb55cb54cc3f76d2207c3b10ab4cbea
Releases: 4.6, 4.5
Fixes: #28181
Reviewed-on: http://review.typo3.org/3314
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer
Reviewed-by: Stefan Neufeind
Reviewed-by: Susanne Moog
Tested-by: Susanne Moog

An empty value in the TYPO3_db constant indicates a not configured installation in 
the front end. The front end then redirects to 1-2-3 installer. 
This broke with change 89732c4a of #27954 because the check for db constant 
is done too late.

Change the order of the checks during database connection and 
check if the TYPO3_db constant has a value first.

Change-Id: I0a7003d876a747e16552fecf6385b0449de5617a
Resolves: #28185
Related: #27954
Reviewed-on: http://review.typo3.org/3316
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
Reviewed-by: Stefan Neufeind
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Susanne Moog
Tested-by: Susanne Moog

The patch enables the core autoloader to find class files that are named
according to the exbase class and file location naming scheme.
This renders ext_autoload.php entries obsolete for class locations
that stick to the extbase scheme even if extbase is not used
for an extension. The autoloaders within fluid and extbase are not
needed anymore.
Additionally, the class-to-file information is cached in the core
autoloader cache in order to reduce the number of file system lookups
for consecutive calls.
The patch is covered by unit tests to verify the complex logic.

Change-Id: I1af68a2d95cfc590eecffe6d06ea4e4eb58e11ec
Resolves: #21144
Related: #28249
Related: #28250
Reviewed-on: http://review.typo3.org/2985
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel

Using '#! /usr/bin/env php' as shebang respects the environment, so
if e.g. /usr/local/bin is in your PATH, this php will be chosen.

Change-Id: Ia5e6c5ed3c3615bec373b3075daf0f43721584ce
Resolves: #24506
Reviewed-on: http://review.typo3.org/3331
Reviewed-by: Andreas Lappe
Tested-by: Andreas Lappe
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Stefan Neufeind
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn

The autoloader cache should be invalidated by the extension manager
if installing new or removing old extension from extension list to
force a recalculation of available classes on next access.

Change-Id: I485dc62aa2d3644136392b7608c77a11cf408332
Resolves: #28219
Related: #28063
Related: #28186
Related: #28187
Reviewed-on: http://review.typo3.org/3339
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers

With #28063 many core cache classes are required directly during bootstrap.
This makes XCLASS impossible since those base classes are not instantiated
with t3lib_div::makeInstance() anymore. t3lib_cache is static and can not be
XCLASSED. The caching framework has a built-in feature to register and use own
implementations. The patch removes all XCLASS definitions of cache classes.

Change-Id: I1e624bb769b899a14491aa3ee1cca9da480ebfb6
Resolves: #28221
Related: #28063
Reviewed-on: http://review.typo3.org/3340
Reviewed-by: Stefan Neufeind
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn

When using a constant string (e.g., "CSS Styled Content") instead of a
localization key (e.g., "LLL:EXT:some_ext/locallang.xml:key"), the constant
string should be returned instead of an empty string.

Change-Id: I409664dc5174d818e875fd03a7e6c6e7fbda9e91
Fixes: #28223
Reviewed-on: http://review.typo3.org/3345
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Dominique Feyer
Tested-by: Dominique Feyer
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers

Currently it's listed inline in the text, make it a definition list.

Change-Id: I18c2df10a0e18dbc167b40465192909cf30278e6
Resolves: #28024
Reviewed-on: http://review.typo3.org/3174
Reviewed-by: Philipp Gampe
Reviewed-by: Stefan Neufeind
Reviewed-by: Xavier Perseguers
Reviewed-by: Benjamin Mack
Tested-by: Benjamin Mack

Extend stdWrap's "case" with "ucfirst" and "lcfirst" keywords to
convert the first letter of a sentence to the corresponding form
using the current Frontend character set.

Change-Id: Ic00989e662724c8a5bdd8c84a6ebdfce79d85319
Resolves: #28018
Reviewed-on: http://review.typo3.org/3171
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Jo Hasenau
Tested-by: Jo Hasenau
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers

Return an empty string to prevent disclosing information unhashed.

Change-Id: Id25b85de039797aa7e39225fb0e2b1c75207a505
Resolves: #28120
Reviewed-on: http://review.typo3.org/3324
Reviewed-by: Jo Hasenau
Tested-by: Jo Hasenau
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers

Revision 50cbf264 removed the old tslib_pibase constructor without
deprecating it first as required by TYPO3 core rules. This breaks
every FE plugin, which overrides the old tslib_pibase constructor.
The change was commited to Git here: https://review.typo3.org/1797

The fix: reintroduce the old constructor and deprecate it.

Change-Id: I66653025b9bf9e2d1e4a0dddb6d0913c50c387c2
Resolves: #28208
Releases: 4.6
Reviewed-on: http://review.typo3.org/3325
Reviewed-by: Jigal van Hemert
Tested-by: Jigal van Hemert

The autoloader creates cache files in phpcode_cache since #28063. Those
entries are now tagged with 't3lib_autoloader' to allow selective entry
dropping by tag.

Change-Id: Ib0591493307623b19b26de30a2923de9fb9cb662
Resolves: #28186
Related: #28063
Related: #28187
Reviewed-on: http://review.typo3.org/3318
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer
Reviewed-by: Andreas Wolf
Tested-by: Andreas Wolf

It can be useful to enter values with a slider. This change
renders values of type time, integer, double or custom items.
A demo extension can be found in the issue tracker.

Change-Id: Ib01f6668058385901c10ec0b1ed1bb79cbc951b3
Resolves: #25315
Reviewed-on: http://review.typo3.org/1164
Reviewed-by: Andreas Wolf
Tested-by: Andreas Wolf

The patch moves the initialization of the caching framework to
config_default.php, prior to the autoload registration. In effect the
autoloader can use the phpcode cache to write a full autoload registry
that can be required directly to reduce file access overhead.
As a side effect the cache system is now always enabled for all access
scopes like FE, BE, CLI and so on.

Change-Id: I7c548fbabeb6e60b8bd9c4098803c1171bbdbec5
Resolves: #28063
Reviewed-on: http://review.typo3.org/3254
Reviewed-by: Andreas Wolf
Tested-by: Andreas Wolf

Transform the margins between entries in the module menu into paddings
to avoid that clicks on this margin cause collapsing of the menu
section.

Change-Id: Id2b75826c91f84904b52567a5e31e240288018fd
Resolves: #27634
Releases: 4.6, 4.5
Reviewed-on: http://review.typo3.org/2925
Reviewed-by: Steffen Gebert
Tested-by: Steffen Gebert
Reviewed-by: Kay Strobach
Tested-by: Kay Strobach
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Susanne Moog
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Tested-by: Georg Ringer
Reviewed-by: Georg Ringer
Reviewed-by: Andreas Wolf
Tested-by: Andreas Wolf

Change-Id: I64f262cbd1297fb0bbe284cd585a2b9bbe63a61a
Reviewed-on: http://review.typo3.org/3293
Reviewed-by: TYPO3 v4 Release Team
Tested-by: TYPO3 v4 Release Team

Change-Id: I4a20ba6c610ded135472b2b12b81ac426d259775
Reviewed-on: http://review.typo3.org/3292
Reviewed-by: TYPO3 v4 Release Team
Tested-by: TYPO3 v4 Release Team

Change-Id: Id40808043ee2781645ce113bc61c9cce178487e8
Reviewed-on: http://review.typo3.org/3291
Reviewed-by: TYPO3 v4 Release Team
Tested-by: TYPO3 v4 Release Team

The TYPO3 core currently handles three types of language labels:
* splitlabels (very very old): Based on the constant TYPO3_languages, a
  string is split by |. The only use was the loginLabels but this was
  changed in 4.3, so they only act as fallback right now.
* locallang.php (very old): An array for each language in a .php file.
* locallang.xml (currently used): An XML file with labels.

Change-Id: Idd6905776af755cf54258fe6723ca1226816655d
Resolves: #26519
Reviewed-on: http://review.typo3.org/3058
Reviewed-by: Stefan Neufeind
Reviewed-by: Oliver Hader
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers
Tested-by: Oliver Hader

Change-Id: I66e57ae0459f76f79c9f9ae19bdb2a14820adc74
Releases: 4.6, 4.5
Resolves: #28030
Reviewed-on: http://review.typo3.org/3198
Reviewed-by: Stefan Neufeind
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers