- Feb 10, 2023
-
-
Benni Mack authored
With the introduction of the Locale API in 12.2 and its inclusion in SiteLanguage->getLocale(), the property "hreflang" can be completely removed from the Site Configuration, as the Locale API can convert the hreflang property properly into a format like "de-AT" directly. This format is described as IETF RFC 5646 language tag standard: https://www.rfc-editor.org/rfc/rfc5646.html Resolves: #99908 Releases: main Change-Id: Ie712a89b41e5f00d1c592fc3cc978f58712ef0c4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77807 Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
-
Oliver Hader authored
Resolves: #99910 Releases: main Change-Id: Ic0ec59b4a646ad4ecc04e8081afe743b5b3cbfcd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77813 Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
- Feb 09, 2023
-
-
Benni Mack authored
Due to the introduction of the unified Locale class, the SiteLanguage now resolves the two-letter-iso code from the locale if it wasn't set before. It is thus removed from the GUI when editing or creating site languages, and also automatically populated as fallback, however it is recommended to fill the locale properly and the method is deprecated. Resolves: #99905 Releases: main Change-Id: Ib98a119b97ae81c96e50fda9835adc36ac41eb37 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77597 Tested-by:
-
Thomas Hohn authored
Handle faulty HTML tags that can cause a PHP warning. This is done by adding a isset() guard. Resolves: #99896 Releases: main, 11.5 Change-Id: I69c03fa55d7ad3d3f355bf76c43b3fff6e0a1f85 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77799 Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Thomas Hohn authored
Handle faulty HTML tags missing an ending ' or ". This is done by adding a missing Null coalescing operator. Resolves: #99892 Releases: main, 11.5 Change-Id: I8a514f365699ab15fc0004141597e7e32d7ccb8c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77797 Reviewed-by:
-
Jasmina Ließmann authored
The heading in the dropdown content now matches the label already shown as button to open the dropdown in small viewports. With #99742 a heading was introduced to structure the messages listed below. With this change this heading will be removed again. In addition, the standard link markup is now also used in the introductory text. The badge contains the amount of error messages. Badge position is now aligned horizontally in the middle of the row in small viewports. Resolves: #99853 Related: #99742 Related: #99538 Releases: main Change-Id: Iea5a88c6b088ce810fc073a886251e8bfd1c880b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77721 Tested-by:
-
Benjamin Kott authored
To avoid layout shifts when dragging elements in the page layout module, we are now creating a clone that consumes the original space when dragging the element. Resolves: #99903 Releases: main Change-Id: If09463e3b79c9377351a02f0af9ea29c9ad512a5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77804 Reviewed-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com>
-
Benjamin Kott authored
This patch aligns the appearance of the record list with panels in the backend. - Align checkboxes for multi record selection properly - Streamline recordlist header actions - Streamline first and last child edge padding - Make typo3-backend-new-content-element-wizard-button component immitate button behaviour - Make typo3-recordlist-record-download-button component immitate button behaviour - Correct action spacing in page module Resolves: #99865 Releases: main Change-Id: I7cf439cf9aac1fabf54f76cb7f1cb496e4584620 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77751 Reviewed-by:
-
Christian Kuhn authored
The ext:lowlevel "System > Configuration" table views are now client-side collapsible and search aware, without reload. This is similar to what has been established with "Active TypoScript" and "Active PageTsConfig" already. Change-Id: I7c9f275505881a939b244a470c00e639b35fa30a Resolves: #99899 Related: #99747 Related: #99782 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77794 Reviewed-by:
-
Jochen Roth authored
Hidden task groups are not shown in the dropdown when editing a task. When a task was saved the selected (hidden) group is lost. This has been fixed by extending the query to include hidden groups. Resolves: #99855 Releases: main, 11.5 Change-Id: I8bd94fd3dfad4d0c19e08e8f91904ec2c2f32367 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77724 Reviewed-by:
Josef Glatz <typo3@josefglatz.at> Tested-by:
-
Benjamin Kott authored
With this patch, we are starting to declutter the record list. The search box and Clipboard toggles are now available in the "View" settings of the record list view. This change follows the pattern we already introduced in the file list. For the search box, the level selector is now always visible. Resolves: #99895 Releases: main Change-Id: I55cd65f3eda491d44199d9886610c4d6135acc38 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77793 Tested-by:
-
Benni Mack authored
This change removes the default configuration of "typo3Language" in the site language configuration. This served the language key used for rendering translated labels from XLF files. The option is removed from the UI, and if the "typo3Language" is not set in the language configuration, the language is resolved from the locale. In addition, certain values regarding system locales in POSIX format (values such as "C" or "POSIX") are now handled in the Locale class as well. Resolves: #99882 Releases: main Change-Id: Ifeeec5d54984426c792ab59b1af44a01d0cdae5d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77726 Reviewed-by:
-
Franz Holzinger authored
use TYPO3\CMS\Core\Http\ApplicationType; Releases: main, 11.5 Resolves: #99888 Change-Id: Ifd2e9bcb46fb08efba5579e2b2ed45605f31157d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77791 Reviewed-by:
-
Alexander Grein authored
The recursive function pagesToFlatArray make use of the page tree repository on two places, which always instantiates the same object. To improve the performance this patch instantiates the page tree only once and stores it in a protected property. Moreover, it adds another protected property editPageAndDefaultLanguageAccess, which holds the general allowance of a backend user to modify pages and access to the default language. This information is needed in the pagesToFlatArray as well and was requested over and over again. Finally, the array_merge construction inside fetchDataAction and filterDataAction was changed to a more performant solution, by merging it after the loop. Overall, this reduces the request time of a page tree ajax call (data and filter) for around 10%. Resolves: #99852 Releases: main, 11.5 Change-Id: I75e8fca96c3eebec72a00e328c634338191d31c1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77750 Tested-by:
-
Georg Ringer authored
An empty end date of a scheduler task is valid and must be allowed. Resolves: #99175 Resolves: #99878 Releases: main Change-Id: I7dd1fd515a400e83c7eb71894c973817d0bb6261 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/76805 Tested-by:
-
Benjamin Kott authored
Add visible fallback to avoid unnessesary layout shift until component is fully loaded. Resolves: #99890 Releases: main Change-Id: Ie3d49a420e5d7bc45cfef611616836482fd3b0b0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77795 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
- Feb 08, 2023
-
-
Benjamin Kott authored
The editable page component now looks and feels like a regular h1 element, and keeps this appereance when edit mode is triggered. The new edit mode blends in and avoids layout shifts as much as possible. Resolves: #99879 Releases: main Change-Id: Ie21ed58a822731a70342247fc13c1a45a00f2504 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77786 Tested-by:
-
Stefan Bürk authored
Use null coalescing operator to guard against undefined array key "templateName" accesss in `\TYPO3\CMS\Form\Controller\FormEditorController`. Resolves: #99870 Releases: main, 11.5 Change-Id: I3ebc40e6caab8c2f5bb32563848e836171c44f7b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77776 Reviewed-by:
-
Oliver Klee authored
Used commands: > composer req doctrine/dbal:^3.6.0 > composer req doctrine/dbal:^3.6.0 --no-update -d typo3/sysext/core/ > composer req doctrine/dbal:^3.6.0 --no-update -d typo3/sysext/install/ > composer req doctrine/dbal:^3.6.0 --no-update -d typo3/sysext/redirects/ > ./Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #99875 Releases: main Change-Id: I8105e999a1f0766170da44125f0f21e32ac91e82 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77783 Tested-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
-
Benjamin Kott authored
Ensure toolbar dropdowns are fully visible if space is available. Resolves: #99862 Releases: main Change-Id: I05272f6a02fa5fd3e808753d47c46cfdb66663b6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77736 Tested-by:
-
Benjamin Kott authored
Enable record icons for better orientation and correct display of tree lines. Moving the additional edit button to the end of the table because has the same functionality as clicking the item. The form styling was adjusted and does not look out of place anymore. Resolves: #99871 Releases: main Change-Id: Id26f83b85728c8407b5107582fcd6e2ddbc78f22 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77774 Tested-by:
-
- Feb 07, 2023
-
-
Benjamin Kott authored
Executed commands: npm install @typo3/icons@^3.5.0 npm run build Version 3.5.0 onwards the icons for add and remove have been renamed to plus and minus. While an alias exists to ensure that integrations keep working, we are using the new identifiers in core from now on. Element selection icons are now available and used. Resovles: #99869 Releases: main Change-Id: Ied8dbc17e4fe10d24849af4973ab96dadc16ef17 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77773 Tested-by:
-
linawolf authored
Merge right after releasing TYPO3 v12.2 Resolves: #99814 Releases: main Change-Id: I973fe516bc72f177c2d7d70bc82ecbe8a1ada104 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77689 Tested-by:
-
Benni Mack authored
Change-Id: Ie632b791d59866eddbe3e22f654fb261b7e02f6b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77747 Tested-by:
-
Benni Mack authored
Change-Id: I716386d2d91ecd2f463e4500b592498cade9dea2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77746 Reviewed-by:
-
Oliver Hader authored
This reverts commit d38764ff. Reason for revert: Release script pushed to wrong branch Change-Id: I17778c7f3e0fd7f56a8e22725b7ff02ee0149064 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77754 Tested-by:
-
Oliver Hader authored
Change-Id: I93476c966ba30ade007c8f5ada514ef3c286fad1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77740 Reviewed-by:
-
Benjamin Franzke authored
As already started in #88304 (but only for NormalizedParams) and later reverted in #89312 (because of cgi-bin problems), PATH_INFO is no longer considered as a preferable SCRIPT_NAME alternative. All known server configurations set SCRIPT_NAME these days to a proper value when cgi.fix_pathinfo is set. The fallback to PATH_INFO has been introduced with the initial revision of TYPO3 and isn't needed at all nowadays, it's actually wrong, as a REQUEST_URI like /index.php/foo/bar would incorrectly be interpreted as $scriptName == "/foo/bar", which let's all calculations on $scriptName fail and even leads to XSS where values derived from $scriptName are printed without being escaped. Also any ORIG_SCRIPT_NAME evaluation is dropped, as this variable contains the SCRIPT_NAME that was set by the webserver configuration before PHP applied cgi.fix_pathinfo. Using ORIG_SCRIPT_NAME effectively meant bypassing PHP's pathinfo fix. It usually contains the cgi-wrapper paths, which is why PATH_INFO was used to overrule wrong ORIG_SCRIPT_NAME values. GeneralUtility::getIndpEnv('PATH_INFO') is adapted to trust the servers PATH_INFO information, now that we no longer allow servers to send SCRIPT_NAME as PATH_INFO (we enforce cgi.fix_pathinfo=1 for CGI installations). The normalized SCRIPT_NAME is now adapted to be encoded as a URL path by default, as all TYPO3 usages expect this to be an URL path. Note that $_SERVER['SCRIPT_NAME'] refers to the servers file system path, not the URL encoded value. This SCRIPT_NAME sanitization actually enables: a) TYPO3 to be run in a subfolder that contains characters that need URL encoding e.g. `/test:site/` – url encoded that'd be `/test3Asite/`. b) prevention of XSS in case third party extensions missed to escape any URL that is derived from SCRIPT_NAME (while making sure that properly escaped output is not double escaped) Resolves: #99651 Related: #88304 Related: #89312 Releases: main, 11.5, 10.4 Change-Id: Ief95253d764665db5182a15ce8ffd02ea02ee61e Security-Bulletin: TYPO3-CORE-SA-2023-001 Security-References: CVE-2023-24814 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77739 Tested-by: -
Benjamin Franzke authored
Make clear that the early-bail out for empty pageArguments is done to prevent setting `disableCaches` to `true`. Also makes that that the $pageNotFoundOnCacheHashError condition is really tied to pageArguments being non-empty. Prevents us from refactoring that code and missing this bit. Resolves: #99860 Related: #99859 Releases: main, 11.5, 10.4 Change-Id: I98ffa3dffe76a37970784979a2c4f2a9a64aa5bf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77735 Tested-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
-
linawolf authored
Resolves: #99780 Releases: main Change-Id: I5e40fb8b6470c929001da06a8d1a7a7dbcaec0db Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77688 Reviewed-by:
Lina Wolf <112@linawolf.de> Tested-by:
-
Oliver Hader authored
If $GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['enforceValidation'] is enabled and the HTTP request only contains the `?id` query parameter, caching for the page is disabled - which should be avoided. Resolves: #99859 Releases: main, 11.5, 10.4 Change-Id: I14a81f5a2ec3ecabedd1abf0756a3ee32e7af4e4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77728 Reviewed-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
-
- Feb 06, 2023
-
-
Christian Kuhn authored
A broken boolean toggle introduced with #99282 prevents page cache hits in FE under various conditions. Resolves: #99857 Related: #99282 Releases: main Change-Id: I49066f10bb27c872ebfa9ebce52d76f9cd46f05c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77727 Tested-by:
Jochen <rothjochen@gmail.com> Reviewed-by:
Christoph Lehmann <christoph.lehmann@networkteam.com>
-
Christian Kuhn authored
This reverts commit b8151562. Reason for revert: Adding stdWrap to TS top-level 'config' object gives headaches with fully-cached page access. ContentObjectRenderer is not available in this context, so COR->stdWrap() fails. Change-Id: I895ea267da31845660dd07b6f8cfe50d0c5cef69 Resolves: #99858 Related: #99340 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77583 Tested-by:
-
Annett Jähnichen authored
To provide a streamlined look&feel of record tables in the record list, their table header's background color now matches those of panels, e.g. the "Clipboard" at the very bottom. For the same reason, a box-shadow is applied. To achieve a better visual separation, the table margin is increased. Resolves: #99727 Releases: main Change-Id: I7a64a6c2e3373f956a506630741628b20729b7a4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77611 Tested-by:
-
Christian Kuhn authored
With the first rewrite of the install tool in 2013, Check.php came with a class comment the class shouldn't have *any* dependencies at all. It of course didn't take long until this was violated. Ten years later, the comment is totally outdated and adapted with the patch a bit to be less awkward. Resolves: #99848 Releases: main Change-Id: I8d1fd5358c5dbacaa063494cb3d2702aa2bb3142 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77715 Reviewed-by:
-
Christian Kuhn authored
The comment in ext:install/Resources/Private/Php/install.php has been established with the very first rewrite of the install tool in 2013. After a series of further rewrites and adaptions it is nowadays pretty much completely outdated and fits no good purpose anymore. Let's get rid of it. Resolves: #99850 Releases: main Change-Id: Id778b6f4cfaa23c725d2b61ef8e9b43c86a2db23 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77716 Tested-by:
-
Markus Klein authored
Extbase does not ask the database anymore for relations, where the uid in the database field is zero. This prevents SQL queries with where-parts like `uid IN (0)`. Since this is done when reconstituting models from the database, depending on the amount of relations of a model, the number of saved queries is huge. Resolves: #99505 Releases: main, 11.5 Change-Id: If3b6c2756674eeb43a66b59a13e44011c9845cd5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77316 Reviewed-by:
Stephan Großberndt <stephan.grossberndt@typo3.org> Reviewed-by:
Stefan Froemken <froemken@gmail.com> Tested-by:
-
Benni Mack authored
When no cHash is given but GET parameters are handed in which _would_ require cHash parameters, these are now properly evaluated during the frontend request. As this has a security impact, a new option called $GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['enforceValidation'] is introduced, which then skips the "requireCacheHashPresenceParameters" option. The latter is an include list, but cache Hash calculation should rather be based on the exclude list such as "excludedParameters" and "cachedParametersWhiteList". If the new option is set, but some properties such as tx_solr[q] should be allowed, then this needs to be added to the excludedList ("excludedParameters") by extension authors. A new test "SlugSiteWithoutRequiredCHashRequestTest" is added which works with a disabled feature flag compared to "SlugSiteRequestTest" which has the feature flag enabled. Resolves: #95297 Releases: main, 11.5, 10.4 Change-Id: Ib72c6a34602e77d8c2044ad2e826c0474ebd2326 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77206 Reviewed-by: -
Max Kellermann authored
Various libraries incorporated by TYPO3 use the "token_get_all" function, crashing PHP execution if the "tokenizer" extension is not loaded. The system environment pre-check now checks the presence of the PHP extension. Also, Composer now requires the presence of the `ext-tokenizer` module. Releases: main Resolves: #99842 Change-Id: I57cb6244d8eb3d8364eae5d23430370e60fd9658 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77711 Reviewed-by:
-
Jochen Roth authored
Additional warning about password set via cli has been added. Also the logic was changed to always prompt for password (db password and admin user password) if not set via variable/option. Resolves: #99836 Releases: main Change-Id: Ic47e100ecb328ac62b58296bc00feff9a84213aa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77707 Reviewed-by:
-
