- Feb 01, 2019
-
-
Frank Naegler authored
This patch adds a new ViewHelper to render thumbnails deferred in the backend. This increase the performance of the file list. Resolves: #85607 Related: #85605 Releases: master Change-Id: Id97876e889605d7d8d3075ee98a4fc34b002f395 Reviewed-on: https://review.typo3.org/57646 Tested-by:
TYPO3com <noreply@typo3.com> Reviewed-by:
Susanne Moog <susanne.moog@typo3.org> Tested-by:
Andreas Wolf <andreas.wolf@typo3.org> Tested-by:
-
Josef Glatz authored
Reduce information disclosure of the used TYPO3 version by adding a dynamic 4-digit year in the TYPO3_copyright_year constant. That makes it more difficult to find out the used TYPO3 version just by looking at the frontend source code of a website. Releases: master, 9.5 Resolves: #87543 Change-Id: Ic169548c7111715eecedfce4ced5c8a3564d102a Reviewed-on: https://review.typo3.org/59565 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
Mathias Brodala <mbrodala@pagemachine.de> Reviewed-by:
Richard Haeser <richard@maxserv.com> Tested-by:
Jigal van Hemert <jigal.van.hemert@typo3.org> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Stephan Großberndt <stephan.grossberndt@typo3.org> Reviewed-by:
Fabien Udriot <fabien.udriot@ecodev.ch> Tested-by:
Mona Muzaffar <mona.muzaffar@gmx.de> Tested-by:
André Schließer <andy.schliesser@gmail.com> Tested-by:
-
Ralf Zimmermann authored
Use the real finisher identifiers as they are configured in the form definition instead the finisher implementation class name. This requires a change of the public AbstractFinisher implementation which implements the FinisherInterface. The interface is not changed, as this would be a breaking change. Therefore, the existence of the new method is checked. If it does not exist in a finisher implementation, a fallback to the previous behavior happens. Releases: master, 9.5 Resolves: #87615 Change-Id: I962502f0601845a5f9793751e87c97b3b902caa1 Reviewed-on: https://review.typo3.org/59606 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Gerrit Mohrmann authored
Fixes missing output in ifAuthenticatedViewHelper after cache clearing and erroneous replication of field properties to subsequent fields. composer command used: composer update typo3fluid/fluid Resolves: #86930 Resolves: #86890 Resolves: #87430 Resolves: #86910 Resolves: #87586 Releases: master, 9.5 Change-Id: I8d1abd0aa08d7d7399ec23675dcf07d08dbdd2f2 Reviewed-on: https://review.typo3.org/59554 Tested-by:
Jonas Eberle <flightvision@googlemail.com> Tested-by:
-
Alexander Schnitzler authored
This patch introduces a new Method class to have an easier and more stable api to get information about class methods from ClassSchema objects. The reflection data fetched and stored by/in the ClassSchema objects is no longer publicly available as an array. Instead, Method objects are returned for the following calls: - getMethod - getMethods - getInjectMethods Also it removes the following method: - getConstructorArguments The following constants are marked as private: - ClassSchema::MODELTYPE_ENTITY - ClassSchema::MODELTYPE_VALUEOBJECT Releases: master Resolves: #87427 Change-Id: I38e8a7287896e9303fad1fa8f8f9182895365adc Reviewed-on: https://review.typo3.org/59422 Reviewed-by:
-
Frank Naegler authored
Resolves: #87607 Related: #87193 Releases: master Change-Id: I5c1ce876cd6ad5edeecefce03d7a1e3619f9d54c Reviewed-on: https://review.typo3.org/59491 Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
-
Anja Leichsenring authored
The ImageService::getImage requires a string as first and a boolean as third parameter. The Image ViewHelpers must respect this requirement. Resolves: #87619 Relates: #87599 Releases: master Change-Id: I0d8f57c2bef62dcc6b4d6e6684bbbb1593bff98f Reviewed-on: https://review.typo3.org/59608 Reviewed-by:
Alexander Schnitzler <typo3@alexanderschnitzler.de> Tested-by:
-
Alexander Schnitzler authored
- Use strict type mode - Use type hints whereever possible Releases: master Resolves: #87599 Change-Id: I8840b7fad16c4fffb7f50973fb97a498e0f683e4 Reviewed-on: https://review.typo3.org/59594 Reviewed-by:
-
Alexander Schnitzler authored
- Use strict type mode - Use type hints whereever possible Releases: master Resolves: #87597 Change-Id: Ic4cfb5512f49b3e20fa16c782301b8dcb2ba5dec Reviewed-on: https://review.typo3.org/59592 Reviewed-by:
Felix Döring <Felix.Doering@3m5.de> Tested-by:
-
Alexander Schnitzler authored
- Use strict type mode - Use type hints whereever possible Releases: master Resolves: #87601 Change-Id: I087fcb4a87e12ac3d4345a4514dae674b8551460 Reviewed-on: https://review.typo3.org/59596 Reviewed-by:
Rudy Gnodde <rgn@windinternet.nl> Tested-by:
-
Alexander Schnitzler authored
- Use strict type mode - Use type hints whereever possible Releases: master Resolves: #87596 Change-Id: I99fe661ff7ee0c29d34c0fde7c5c2c83f0f39201 Reviewed-on: https://review.typo3.org/59591 Reviewed-by:
-
Alexander Schnitzler authored
The caches of extbase have been consolidated as both of them shared the same caching frontend. Cache identifiers `extbase_reflection` and `extbase_datamapfactory_datamap` do no longer exist. A single cache `extbase` is pre-configured and used for class schemata and data maps instead. Releases: master Resolves: #87558 Change-Id: I4d7ec53cfd1b4900998fa2d01db1d8f2c1730633 Reviewed-on: https://review.typo3.org/59573 Reviewed-by:
-
Georg Ringer authored
Resolves: #87579 Releases: master Change-Id: I04e8d291a030dac0a0df526e46aa40ba27a24b39 Reviewed-on: https://review.typo3.org/59583 Tested-by:
Markus Klein <markus.klein@typo3.org> Reviewed-by:
Josef Glatz <josef.glatz@typo3.org> Tested-by:
-
Benni Mack authored
TYPO3 uses $GLOBALS['LANG'] directly in some places, but since TYPO3 v7, new code started to use a short hand protected method "getLanguageService" in order to get IDE code completion and better analysis of code. This patch replaces all left-over places of $GLOBALS['LANG'] and encapsulates this into a short-hand method to streamline TYPO3 Core's code base. Resolves: #87571 Releases: master Change-Id: Ie15e320713fe65d40552a19e0a517d5739abbb41 Reviewed-on: https://review.typo3.org/59578 Tested-by:
Frank Naegler <frank.naegler@typo3.org> Tested-by:
-
Alexander Schnitzler authored
- Use strict type mode - Use type hints whereever possible Releases: master Resolves: #87595 Change-Id: If59546093176c5a7725725aad8e619de70fd43cd Reviewed-on: https://review.typo3.org/59590 Reviewed-by:
-
Alexander Schnitzler authored
- Use strict type mode - Use type hints whereever possible Releases: master Resolves: #87603 Change-Id: I3430b59e93133d9b19d6520d3fd7cca83c0fdb49 Reviewed-on: https://review.typo3.org/59598 Reviewed-by:
-
Alexander Schnitzler authored
- Use strict type mode - Use type hints whereever possible Releases: master Resolves: #87608 Change-Id: I3fc153c68bb29aa85517965c6d4d8414d25af35b Reviewed-on: https://review.typo3.org/59602 Reviewed-by:
-
Alexander Schnitzler authored
The following methods used controller aliases: - \TYPO3\CMS\Extbase\Utility\ExtensionUtility::configurePlugin - \TYPO3\CMS\Extbase\Utility\ExtensionUtility::registerModule This means, that while configuring plugins or modules, a list of controllers (and their actions) had to be provided, so they could be registered as available controllers for said plugin or module. The controller name used for the registration, was kind of an alias for that controller. It was the class name without the namespace and without the "Controller" suffix. By a certain convention a proper class name could be derived from that alias. All this was necessary back then when TYPO3 didn't have a proper autoloader and when the class location was derived from the class name. These circumstances do not exist any more and since it's only important that a controller class exists, the registration of plugins must now use the fully qualified controller class name as array key. The former syntax \TYPO3\CMS\Extbase\Utility\ExtensionUtility::configurePlugin( 'TYPO3.CMS.IndexedSearch', 'Pi2', ['Search' => 'form,search,noTypoScript'], ['Search' => 'form,search'] ); has to be converted to \TYPO3\CMS\Extbase\Utility\ExtensionUtility::configurePlugin( 'IndexedSearch', 'Pi2', [ \TYPO3\CMS\IndexedSearch\Controller\SearchController::class => 'form,search,noTypoScript' ], [ \TYPO3\CMS\IndexedSearch\Controller\SearchController::class => 'form,search' ] ); Please note, that not only the controller configuration changed. The vendor `TYPO3.CMS` in `TYPO3.CMS.IndexedSearch`, must no longer be set. Instead, the vendor will be evaluated by looking at the controller namespace. Releases: master Resolves: #87550 Change-Id: If47d087836c4345a8180dae3d4e4b8cd384e684c Reviewed-on: https://review.typo3.org/59566 Tested-by:Jörg Bösche <typo3@joergboesche.de> Reviewed-by:
-
- Jan 31, 2019
-
-
Alexander Schnitzler authored
Both properties $namespacesViewObjectNamePattern and $viewFormatToObjectNameMap of class ActionController have been removed without replacement. Both properties provided a functionality to set a custom view object class during runtime. As this contradicts the idea of having a defined state per request by configuring concrete implementations before runtime, these properties needed to vanish. While there is no dependency injection with a proper configuration available, the view object class can still be defined via property $defaultViewObjectName. Releases: master Resolves: #87511 Change-Id: I4b89a9434f71a3cbf38a9ad113ba8233e7f327f9 Reviewed-on: https://review.typo3.org/59514 Tested-by:
Achim Fritz <af@achimfritz.de> Reviewed-by:
-
Oliver Hader authored
Resolves: #87589 Releases: master Change-Id: I69119636e11d116b79fc627a2993a1fa84d7a39c Reviewed-on: https://review.typo3.org/59359 Tested-by:
-
Oliver Hader authored
Resolves: #87590 Releases: master Change-Id: I30af97f075d352792370b363b0b152ead99eacab Reviewed-on: https://review.typo3.org/59360 Tested-by:
-
- Jan 30, 2019
-
-
Benni Mack authored
Due to a bug in checking for $result[t3ver_oid] ?? $result[uid] the uid is never used, but only the t3ver_oid. This value could be empty and then "0" is used. This means, the page record to be edited in FormEngine is treated as "NullSite" = Page without Site Configuration. Resolves: #87572 Releases: master, 9.5 Change-Id: I1c4175f61a9c5df3dd3a392c2f636112cfbdb350 Reviewed-on: https://review.typo3.org/59579 Tested-by:
Daniel Gorges <daniel.gorges@b13.de> Tested-by:
-
Georg Ringer authored
Increase the length of the field from 30 to 255 chars to be in sync with other tables, e.g. sys_file_mounts. 30 is fairly short for bigger sites and lots of storages. As this is an admin only field and not too often used, it is ok to backport that to 9.5 as well. Resolves: #87576 Releases: master, 9.5 Change-Id: I355b6295a9f813e72e1e66e05dd93419fd2aeaeb Reviewed-on: https://review.typo3.org/59581 Reviewed-by:
-
Georg Ringer authored
Since #72332 the url to the delete action is built in the controller and assigned to the view. Resolves: #87578 Releases: master Change-Id: I36ea3374a848c48c981718dfc8dc1899dc9c0164 Reviewed-on: https://review.typo3.org/59582 Reviewed-by:
-
Georg Ringer authored
If a label of a table column is overridden by TsConfig (TCEFORM.<table>.<column>.label), the new value must also be used in the list view: - header of the table rendering - list of "set fields" Resolves: #87484 Releases: master, 9.5 Change-Id: I8eafd1f2878b571edd1e5a30b28b0d5330b9b5d0 Reviewed-on: https://review.typo3.org/59505 Reviewed-by:
Riccardo De Contardi <erredeco@gmail.com> Reviewed-by:
-
- Jan 29, 2019
-
-
Benni Mack authored
The global variable TBE_TEMPLATE is not necessary anymore, and is not available anymore. The change is still ugly, as TBE_TEMPLATE initializes the PageRenderer object with necessary information, which should become built inside PageRenderer for BE. This has been moved to Backend's RequestHandler where this can be abstracted further at a later point. Resolves: #87567 Releases: master Change-Id: If1cb184740f1e99c0aeca5ae19c85899d56f3f9a Reviewed-on: https://review.typo3.org/59492 Tested-by:
-
Georg Ringer authored
Replace custom VH with the one provided by EXT:backend. Resolves: #87507 Releases: master Change-Id: I882d7555654a051e7190d7ffd25ff6e903f16ab1 Reviewed-on: https://review.typo3.org/59511 Tested-by:
-
Georg Ringer authored
Use the general ModuleLinkViewHelper instead of custom VH. Resolves: #87509 Releases: master Change-Id: I7f0d7125d0ee84973bc80599cbc51e44747e2d06 Reviewed-on: https://review.typo3.org/59513 Tested-by:
-
- Jan 28, 2019
-
-
Josef Glatz authored
This patch adds the correct description text for the new content element wizard of CType "menu_sitemap". Resolves: #87556 Releases: master, 9.5 Change-Id: Iec0de6887a9a60215a813e03041e4d58af7b297b Reviewed-on: https://review.typo3.org/59571 Reviewed-by:
-
Benjamin Franzke authored
Remove the old concept of priority-based HTTP request handlers, and use statically configured PSR-15 middlewares instead. Tranform the priority based request handlers into a set of chained middlewares. In case none of the middlewares handles the request a NotFoundRequestHandler returns a 404 response (replacing the previous exception that was thrown in that case). This scheme of using a 404 handler as "last" request handler is not new, it is also used in zend expressive (a PSR-15 framework). The TYPO3 RequestHandlerInterface is marked @internal and was set to be removed in v9, therefore we drop it now and also remove its implementation from the frontend and backend request handlers. Releases: master Resolves: #87516 Change-Id: Ibbd6a0e6c4ff8aa55b4367c9e4c07e279595dbfb Reviewed-on: https://review.typo3.org/59541 Tested-by:
-
Josef Glatz authored
Releases: master Resolves: #87559 Change-Id: I74d7ef26017080e45eb129217613ad7c36cd3881 Reviewed-on: https://review.typo3.org/59574 Reviewed-by:
-
Benni Mack authored
Various deprecated code regarding EXT:form and FormEngine have been removed. * IRRE CustomControls without userFunc is not possible anymore. * TBE_MODULES's configureModuleFunction is removed * EXT:form type "GridContainer" is removed (use GridRow) * EXT:form form configuration files must end with .form.yaml. * EXT:form renderingOptions._isHiddenFormElement and renderingOptions._isReadOnlyFormElement are removed * CLI Command "lang:language:update" is now only available under "language:update" Resolves: #87514 Releases: master Change-Id: Idef84daf51f882df23ef227d1777d24b1076dfaf Reviewed-on: https://review.typo3.org/59503 Tested-by:
-
hasenbalg authored
Improves indexed search documentation, mentioning activation and inclusion of a static template. Releases: master, 9.5 Resolves: #87023 Change-Id: I85e40b768e4020e71a7717d877a6305fb55a00cb Reviewed-on: https://review.typo3.org/58968 Tested-by:
Joerg Kummer <typo3@enobe.de> Reviewed-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Tested-by:
-
- Jan 27, 2019
-
-
Alexander Schnitzler authored
The following classes do no longer use setter injection but constructor injection instead: - TYPO3\CMS\Extbase\Configuration\AbstractConfigurationManager - TYPO3\CMS\Extbase\Configuration\BackendConfigurationManager - TYPO3\CMS\Extbase\Configuration\ConfigurationManager - TYPO3\CMS\Extbase\Configuration\FrontendConfigurationManager Releases: master Resolves: #87448 Change-Id: Ib6df3ab4a286bbe77cdda82d0066495a8dab8b22 Reviewed-on: https://review.typo3.org/59446 Tested-by:
Daniel Goerz <daniel.goerz@posteo.de> Tested-by:
Christian Wolff <chris@wolffc.de> Reviewed-by:
Sebastian Fischer <typo3@evoweb.de> Reviewed-by:
-
- Jan 25, 2019
-
-
Christian Kuhn authored
Functional and acceptance tests need a db up and running. The according container is started as dependency and a loop delays further execution until the database connected to its network port. This sometimes goes wrong, for instance mssql in rare conditions does not come up. This leads to the loop running "forever", consuming the executing bamboo agent and the job never finishs. The patch adds an additional break condition: If db did not connect to the port after a minute, the job now fails. Resolves: #87549 Releases: master, 9.5, 8.7 Change-Id: Idc45f57d9cfd2d390cea6bd5319adaf4158340df Reviewed-on: https://review.typo3.org/59567 Tested-by:
-
Georg Ringer authored
Resolves: #87523 Releases: master Change-Id: I711ddb140e03e87b38ec06a7814e4b488bc9e9c9 Reviewed-on: https://review.typo3.org/59552 Tested-by:
Jan Stockfisch <typo3@jan-stockfisch.de> Reviewed-by:
-
- Jan 22, 2019
-
-
Oliver Hader authored
In order to enhance protection against (possible) executable file extensions phar, shtml, cgi, pl have been added to the according file deny pattern. Releases: master, 9.5, 8.7 Resolves: #87368 Security-Commit: c9f0d00b89768b63df9c77884cf9d19d658fc0fc Security-Bulletin: TYPO3-CORE-SA-2019-008 Change-Id: I92998a2046b6efb7f31961c20f24c81d00957879 Reviewed-on: https://review.typo3.org/59540 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Ralf Zimmermann authored
The ConfirmationFinisher message is now rendered within a fluid template to allow styling of the message. Furthermore, the FormRuntime (and thus all form element values) and the finisherVariableProvider are available in the template. Custom variables can be added globally within the form setup or at form level in the form definition. By using a fluid template and the associated html escaping, the display of the ConfirmationFinisher message is protected against XSS / html injection attacks. Resolves: #84902 Releases: master, 9.5, 8.7 Security-Commit: a38c63f3f03b1ab267666ca06a3abaead57b8265 Security-Bulletin: TYPO3-CORE-SA-2019-007 Change-Id: Ib6cfef88bef09f72b675909f7022120b32c095df Reviewed-on: https://review.typo3.org/59539 Reviewed-by:
-
Benni Mack authored
Fixes an XSS issue in Alert, Carousel, Collapse, Dropdown, Modal, and Tab components. Executed tasks: cd Build yarn add bootstrap-sass@^3.4.0 --dev yarn exec grunt Then copying the contents of Build/node_modules/bootstrap-sass/assets/javascripts/bootstrap.min.js into typo3/sysext/core/Resources/Public/JavaScript/Contrib/bootstrap/bootstrap.js additionally adding the AMD factory wrapper. Resolves: #86580 Releases: master, 9.5, 8.7 Security-Commit: f456e3c185b23c51d08a579ceef1082df473b01b Security-Bulletin: TYPO3-CORE-SA-2019-006 Change-Id: I235a4b5f6865afd9283cd1e692b25d3a572513ba Reviewed-on: https://review.typo3.org/59538 Reviewed-by:
-
Andreas Wolf authored
* HtmlentitiesViewHelper * UrlencodeViewHelper * StripTagsViewHelper Resolves: #85764 Releases: master, 9.5, 8.7 Security-Commit: 37bc147e634d67d521b716f83ca8d925ec57d531 Security-Bulletin: TYPO3-CORE-SA-2019-005 Change-Id: I1d5473b20378217a68e06c792be7f1cf096859fe Reviewed-on: https://review.typo3.org/59537 Reviewed-by:
-
