- Jan 08, 2023
-
-
Chris Müller authored
This eases the usage for administrators running a legacy installation. Resolves: #99486 Releases: main, 11.5 Change-Id: Ibf61df760cbc80543c03f499ed40d24c68af35d2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77225 Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
-
- Jan 06, 2023
-
-
Helmut Hummel authored
Accessing a not available configuration via TypoScript can be intentional (e.g. by using it in an if check). Therefore the log entry severity should rather be downgraded to a notice. Releases: 10.4, 11.5, main Resolves: #99465 Change-Id: I26ed4e96290ce6839c32cc60a7cbcf7fa24d0f2b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77220 Tested-by:
Helmut Hummel <typo3@helhum.io> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
-
Helmut Hummel authored
When this task is executed on CLI (scheduler), the global request variable is not available, thus a null check must be added before checking the instance of the value. Releases: 10.4, 11.5, main Resolves: #99464 Change-Id: Ie9c1b8e4fbc187d6ade569b1b152ce799a09a1f0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77221 Tested-by:
Oliver Klee <typo3-coding@oliverklee.de>
-
Torben Hansen authored
Update copyright year to 2023 Resolves: #99473 Releases: main, 11.5, 10.4 Signed-off-by:
Torben Hansen <derhansen@gmail.com> Change-Id: I9fc04e75b812622c5aec89138dd7daa8ccfcd90a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77223 Reviewed-by:
-
Sybille Peters authored
The pageId is already passed to the functon ItemProcessingService::getProcessingItems(). This is now used instead of retrieving the uid / pid from the row array. The previous behaviour could result in an exception with PHP 8.1 since the uid in the row might not be initialized if a new page is created. If a field with itemProcFunc existed for a field in the pages table. The page id which was passed to the function already handled the case of empty uid by passing the uid of the parent page. Resolves: #99295 Releases: main, 11.5 Change-Id: I9c72189c6f80e0a45cb9abfcc80541b091c126b8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77277 Tested-by:
-
Helmut Hummel authored
The setContentType method on TyposcripFrontendController was introduced to allow Extbase plugins to change the content-type header of the server http response. However this currently only works, when the Extbase plugin action is uncached. Once a plugin, that is rendered on a page ist cached in page cache, the content type of subsequent requests is always "text/html", because the value of the contentType property is not stored in cache. Storing this value into cache allows creating e.g. Json APIs as Extbase Plugins, that can be fully cached without adding hacks like modifying config.additionalHeaders Resolves: #99373 Releases: main, 11.5 Change-Id: Ibf00c9438d8763ef9d32c6ad7d00a44d3137ba13 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77269 Tested-by:
-
Daniel Siepmann authored
Requesting an none existing entry resulted in an PHP Warning in newer PHP 8.x versions. Resolves: #97554 Releases: main, 11.5 Change-Id: Ie0096b8e2fe6593aa577279d2ef843151d1af8b8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77271 Reviewed-by:
-
- Jan 05, 2023
-
-
Oliver Bartsch authored
The search box in the file browser is now displayed again, even if no files are in the folder. This is necessary because the search works recursively. Actually, the search box was only displayed for an active search with an empty result list, due to another bug. FileSearchResultInterface is never "empty" since it's an object. This is now fixed as well. Additionally, the flash message is improved, in case no files are available for a search term. Resolves: #99447 Releases: main, 11.5 Change-Id: I970b19c7779075711f97987e80aad3f376cd5f40 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77268 Reviewed-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
-
Oliver Bartsch authored
Resolves: #99468 Releases: main, 11.5 Change-Id: Ib22901dce1662a0216eb4e2a55061131055fbcf1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77219 Tested-by:
-
alexander.vogt authored
Due to the introduction of the "language" TCA type, the column processing of TCA language fields in TcaSelectItems->addData was skipped and therefore the array conversion through the "processDatabaseFieldValue" method was no longer applied. The placeholder processing in TcaInputPlaceholders however expected the tables language field to be an array. This is now fixed. Resolves: #99446 Releases: main, 11.5 Change-Id: I20f456ba7066c19d2eded00079e58c4c64521eeb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77265 Tested-by:
-
- Jan 03, 2023
-
-
Christian Kuhn authored
Some bug fixes reduce list of false positives. > composer req --dev phpstan/phpstan:^1.9.5 > composer req --dev phpstan/phpstan-phpunit:^1.3.3 > ./Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #99448 Releases: main, 11.5 Change-Id: Ibc7cc259d6fd5520365ccb25652a21f4488e9597 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77246 Tested-by:
-
- Dec 29, 2022
-
-
Jochen Roth authored
Currently, mariadb is only supported up to v10.6. This has been changed up to v10.10 and jobs have been added to the ci pipeline. And on top v15 of postgres has been added for testing purposes only. Resolves: #99362 Releases: main, 11.5 Change-Id: I0202de4d3138b747b01e6cf0c32dc16b4ad398eb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77238 Tested-by:
-
- Dec 22, 2022
-
-
Georg Ringer authored
An unnecessary quote has been added with #91016 and should be removed again. Resolves: #99402 Releases: main, 11.5, 10.4 Change-Id: I42fdda31a1110efc540cc72fd0398db5bc03675f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77216 Tested-by:
-
Nikita Hovratov authored
Resolves: #99407 Related: #98122 Releases: main, 11.5 Change-Id: Ie5a8e894e65669e9faa3d30f908040006a0345d7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77215 Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
-
André Buchmann authored
The showForgotPasswordLink setting was renamed to showForgotPassword during the refactoring to fluid templates. It is now also renamed in the TypoScript setup. The TypoScript constant name is not changed to keep compatibility. Resolves: #98122 Releases: main, 11.5 Change-Id: I1b47da42fb17504e52bca4705c8444253d6b1f76 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77213 Reviewed-by:
-
- Dec 21, 2022
-
-
Eric Bode authored
To update the Indexed Search TypoScript documentation the following tasks have been completed: * Use of `.. confval::` block * All available settings are named * Some description texts have been optimized * Code examples were created * Indentation was done with 4 spaces * Heading types were corrected * Default values were entered separately outside the body text * Missing references were corrected Releases: main, 11.5 Resolves: #99353 Resolves: #99379 Change-Id: Ice6c38607fed68347dc38617c7dea8634f073483 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77214 Tested-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
-
- Dec 20, 2022
-
-
Oliver Klee authored
The new version finds some more potential problems. > composer req --dev phpstan/phpstan:^1.9.4 > composer req --dev phpstan/phpstan-phpunit:^1.3.2 > ./Build/Scripts/runTests.sh -s phpstanGenerateBaseline Change-Id: Iae41030660fc24f8e5d83546cb9e22835517a719 Resolves: #99389 Releases: main, 11.5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77212 Tested-by:
-
- Dec 19, 2022
-
-
Oliver Bartsch authored
Resolves: #99380 Releases: main, 11.5 Change-Id: I44a4a805b4848700e30ed7127a6da62c1f4cfdde Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77138 Tested-by:
-
- Dec 16, 2022
-
-
Oliver Bartsch authored
The extension repository status check in the reports module is now skipped in composer mode. Resolves: #99385 Releases: main, 11.5 Change-Id: Ia3c049e1df5000045249a5308601bf2f75bf6ec9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77137 Tested-by:
-
Andreas Fernandez authored
The "History" button in EditDocumentController now uses existing locallang labels instead of a hardcoded string. Resolves: #99386 Releases: main, 11.5 Change-Id: I6853ce66a0ffbb23e6ed6fca42085a7b824519e4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77136 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
-
- Dec 15, 2022
-
-
Oliver Hader authored
Change-Id: Ic9acc8a7130f9e848b6809af395ffdd4e130b33a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77167 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Oliver Hader authored
Change-Id: Ic870e4d6af389ad9bfefe445cec780d60364230d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77166 Reviewed-by:
-
Benjamin Franzke authored
$normalizedParams->getRequestDir() returns '/' for frontend requests and `/typo3/` for backend requests. This results in problems when the backend UriBuilder relies on getRequestDir() to provide the `/typo3/` suffix for backend URL generation. UriBuilder is now changed to base absolute URLs on getSiteUrl(), which is defined to return equal values for backend and frontend requests, the typo3 suffix is added manually. Note that v12 introduced similar behavior with #99234, where UriBuilder was adapted to use BackendEntryPointResolver, which rebases the backend URL calculation on the site path as well. Also note that the ABSOLUTE_URL mode in backend UriBuilder isn't actually used by the TYPO3 frontend, but some extensions started to execute system reports in frontend context, which exposed this bug with the introduction of #99347. Releases: 11.5, 10.4 Resolves: #99368 Related: #99347 Related: #99234 Change-Id: Ifaaeb4725c0243d34603dc86b2c89d12d9c06bdd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77159 Reviewed-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
-
Oliver Hader authored
ServerResponseCheck triggers a HTTP host header check which is expected to fail. The more generic TransferException is used to catch any other failed request, not only those with 4xx or 5xx HTTP status codes. Besides that, TLS certificates shall not be verified, and HTTP location redirects not be followed. Resolves: #99368 Releases: main, 12.1, 11.5, 10.4 Change-Id: Id40457d4408c74d9229d4e6dcdedc0b69ffe9667 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77153 Reviewed-by:
-
- Dec 14, 2022
-
-
Andreas Nedbal authored
Bootstrap removed panel classes in version 4 and the backend mostly has appropriate styles for the card component now, so old panel usages can be migrated. Resolves: #99223 Releases: main, 11.5 Change-Id: I4801e84fff23374ae1416a4b8b41520953d57017 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77157 Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
-
Oliver Hader authored
The security fix for TYPO3-CORE-SA-2022-013 enforced the `pid` HTTP parameter to be signed via HMAC during the frontend user authentication process. To provide better backward compatibility for those individual scenarios, the new `security.frontend.enforceLoginSigning` feature flag has been introduced, which is enabled per default, but can be disabled individually. Resolves: #99366 Releases: 11.5, 10.4 Change-Id: Ib633d7d3166a2f58caebc0a258699549b5cf2fa4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77155 Reviewed-by:
-
Oliver Klee authored
PHPStan 1.9.3 finds another potential problem and brings some performance improvements. Run commands: > composer req --dev phpstan/phpstan:^1.9.3 > composer req --dev phpstan/phpstan-phpunit:^1.3.1 > ./Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #99356 Releases: main, 11.5 Change-Id: I9d1429949379cc35518fad6750d6d063827623ed Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77124 Reviewed-by:
-
- Dec 13, 2022
-
-
Andreas Fernandez authored
The icon set used for the flags in TYPO3 accidentally used the flag of Andorra for Zimbabwe. Unfortunately, it's not tracable anymore where those flags came from, therefor, the flag of Zimbabwe is copied from https://github.com/lipis/flag-icons and has been converted to PNG. The flags of https://github.com/lipis/flag-icons may be used in the long run as a maintained replacement. Resolves: #99344 Releases: main, 11.5 Change-Id: I68e0e3b99254f35cce8c84a668a04765ea7b8159 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77133 Tested-by:
-
Oliver Bartsch authored
The title of the "edit column" button in the page module is now using the correct locallang key instead of an undefined variable. Resolves: #99339 Releases: main, 11.5 Change-Id: Ic3a44174da62d25de06e1673dd5748dedf4aff0a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77132 Tested-by:
-
Oliver Hader authored
Change-Id: I46e19a332d7067961066da9d1fa91ad546bc3d11 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77108 Reviewed-by:
-
Oliver Hader authored
Change-Id: I2d0ca5bacc7de24d933e2d05a7edae59e6e229a3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77107 Tested-by:
-
Oliver Hader authored
see https://github.com/TYPO3/html-sanitizer/releases/tag/v2.1.1 composer req typo3/html-sanitizer:^2.1.1 composer req typo3/html-sanitizer:^2.1.1 \ -d typo3/sysext/core --no-update Resolves: #99351 Releases: main, 11.5, 10.4 Change-Id: I25a17ce13a8f90cdd07a7cc51e515dff3b6bb03b Security-Bulletin: TYPO3-CORE-SA-2022-017 Security-References: CVE-2022-23499 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77094 Tested-by:
-
Oliver Hader authored
Introducing Yaml placeholders in backend user interface can lead to information disclosure and denial-of-service senarios. This change disallows adding new placeholders and throws an exception - existing placeholders are kept. Resolves: #89401 Releases: main, 11.5, 10.4 Change-Id: I69e24de07b5327507e1bf8de990f84402078f7d4 Security-Bulletin: TYPO3-CORE-SA-2022-016 Security-References: CVE-2022-23504 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77093 Tested-by:
-
waldhacker authored
Only evaluate TypoScript-like instructions like ``` submitButtonLabel = TEXT submitButtonLabel.value = Bar ``` defined within `plugin.tx_form.settings.formDefinitionOverrides` and `plugin.tx_form.settings.yamlSettingsOverrides` and **not** within form definition yaml files or the form setup yaml files. This is achieved by not searching the entire form definition or form setup for TypoScript instructions, but only the actual TypoScript. Resolves: #98403 Releases: main, 11.5, 10.4 Change-Id: I7b066f109d6061715c2240b01ed15185c58fa9f5 Security-Bulletin: TYPO3-CORE-SA-2022-015 Security-References: CVE-2022-23503 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77092 Reviewed-by:
-
Torben Hansen authored
The password reset process for TYPO3 backend and frontend users does not destroy possible existing user sessions after the password has been changed. With this patch, all existing user sessions are destroyed when the password is changed in the password reset process. Resolves: #98462 Releases: main, 11.5, 10.4 Change-Id: I6744bfcf7cae56b4e525f2e0f9a44d06cf14396c Security-Bulletin: TYPO3-CORE-SA-2022-014 Security-References: CVE-2022-23502 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77091 Tested-by:
-
Oliver Hader authored
This change ensures that individual storage page ids are valid by signing corresponding values with an HMAC. Resolves: #98010 Releases: main, 11.5, 10.4 Change-Id: I34d474ab23adca6bbcf20c108bb60acf6998bc6f Security-Bulletin: TYPO3-CORE-SA-2022-013 Security-References: CVE-2022-23501 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77090 Reviewed-by:
-
Benni Mack authored
TYPO3 now uses a lock strategy to avoid having to many request waiting for the generation of the error page (which cannot be generated via the external HTTP request, as there might be not enough workers / PHP processes available during a DoS attack). If a lock is in place, it directly returns a generic error response instead of waiting for the lock or that the error page is retrieved/rendered. Additionally, if the external error page could not be retrieved (HTTP status code other than 200), it will also create a generic response and cache that instead. This avoids keeping requesting for the errounous external HTTP page. This could happen when using external HTTP requests (Guzzle) to resolve an error page (via PageContentErrorHandler) for 404 sites. Only TYPO3 installations using the feature "subrequestPageErrors" via $TYPO3_CONF_VARS[SYS][features][subrequestPageErrors] = true are not affected as the error page is generated during the same PHP process, avoiding to create another external process. Resolves: #98384 Releases: 11.5, 10.4 Change-Id: Iae1cae882707a519b2cef85112525ea213a72eef Security-Bulletin: TYPO3-CORE-SA-2022-012 Security-References: CVE-2022-23500 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77089 Tested-by:
-
Oliver Hader authored
In case the web server scenario is not properly configured to deny HTTP host header injection, and the trustedHostsPattern is not explicit enough, a corresponding check in the reports module will issue an error message like * HTTP_HOST contained unexpected "a0a3aa2f59.random.example.org" * SERVER_NAME contained unexpected "a0a3aa2f59.random.example.org" Using the configuration directive `UseCanonicalName On` for Apache web server environments mitigates the risk. Resolves: #99347 Releases: main, 11.5, 10.4 Change-Id: Iaafd136fd817a0722f482d1d0e6b198382e40e3d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77025 Tested-by:
-
Benjamin Franzke authored
There are different versions of pdfinfo available and used by different providers/distributions. a) Debian/Fedora use pdfinfo (>v20) from the poppler-utils package. Also hosters like Hetzner use this version. This variant defaults to UTF-8 output for metadata: https://linux.die.net/man/1/pdfinfo > -enc encoding-name Sets the encoding to use for text output. This defaults to "UTF-8". pdfinfo -v pdfinfo version 21.08.0 Copyright 2005-2021 The Poppler Developers - http://poppler.freedesktop.org Copyright 1996-2011 Glyph & Cog, LLC b) Older servers and hosters with legacy software (Mittwald, Domainfactory) use pdfinfo v3. This one defaults to Latin1 output: https://www.xpdfreader.com/pdfinfo-man.html > −enc encoding-name > Sets the encoding to use for text output. […] > This defaults to "Latin1" pdfinfo -v pdfinfo version 3.02 Copyright 1996-2007 Glyph & Cog, LLC Both versions support an -enc UTF-8 option, which is nowused to circumvent the differences between these tools, instead of implying Latin1 output (as done in #80085) which breaks variant a) by interpreting valid UTF-8 as ISO-8859-1 and thus applying a double encoding. Resolves: #99352 Related: #80085 Releases: main, 11.5, 10.4 Change-Id: Ib8f7ae742c5edc73036afcb7d2608cd01f4176fd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77081 Reviewed-by:
-
Stephan Großberndt authored
Releases: main, 11.5, 10.4 Resolves: #99348 Change-Id: I43d305b0f02bd6049f32e65c95184a2d5bfa4fe5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77052 Tested-by:
-
