- May 20, 2019
-
-
Benni Mack authored
A few places still use t3ver_state instead of the available constants in VersionState. To increase the semantics of the used code, the constants are used instead. Resolves: #88395 Releases: master, 9.5 Change-Id: I3c2927c2d4c8814d581f06f84de8f4c85d6226a1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60780 Tested-by:
TYPO3com <noreply@typo3.com> Tested-by:
Susanne Moog <look@susi.dev> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
- May 16, 2019
-
-
Benni Mack authored
Due to some heavy history on the caching framework, all Database caches start with "cf_cache_", which is optimized so they are only called e.g. "cache_pagesection" in the database tables. In addition, the prefix "cache_" (in e.g. "cache_core") is unnecessary, and also there due to legacy reasons, reading $this->getCache('cache_runtime') seems very illogical. The following caches have been renamed: - cache_core => core - cache_hash => hash - cache_pages => pages - cache_pagesection => pagesection - cache_runtime => runtime - cache_rootline => rootline - cache_imagesizes => imagesizes Old identifiers can still be called within PHP, but the caching framework throws a deprecation message on setting up such a cache. A silent upgrade wizard will update one's LocalConfiguration to use the new naming scheme. The result is a cleaner, more readable and more streamlined code base (we have caches like "extbase" or "assets" where there is no prefix) and database structure. The patch is breaking due to the change in the database tables. Resolves: #88366 Releases: master Change-Id: I13dcdb0d1bf78f0899615e850856de081b715358 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/59661 Tested-by:Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
-
- May 15, 2019
-
-
Benni Mack authored
This change removes the compatibility layer of Site Handling, called "PseudoSite" handling. Any TypoScript-related Language properties are removed. - config.sys_language_uid - config.sys_language_mode - config.sys_language_overlay - config.locale_all - config.language - config.typolinkEnableLinksAcrossDomains - typolink.useCacheHash The hook $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_tstemplate.php']['linkData-PostProc'] is removed. In addition, all tests related to PseudoSite and linking without SiteHandling are removed, linking to pages without a site will not be linked anymore. Adding `useCacheHash` to typolink triggers a "this does not do anything anymore" deprecation message. Further related removals (old "pageNotFound" handling and "useCacheHash" in all viewhelpers), are removed separately. Resolves: #88363 Releases: master Change-Id: I14f2f854e69c98df7fab8b14f92f1ec2440a15a0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/59366 Tested-by:
-
Nicole Cordes authored
This patch provides the current set database value in a hidden field as early as the whole select tree JavaScript is provided. This prevents data loss if the current record is saved before the select tree was loaded. Resolves: #86954 Releases: master, 9.5, 8.7 Change-Id: I467b2a52d34b806713cd201a8a2a4f9bb8e92c71 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60415 Tested-by:
Frank Naegler <frank.naegler@typo3.org> Reviewed-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Reviewed-by:
-
Benni Mack authored
The database field "t3ver_id" which is managed by TYPO3 to store the number of the version for a specific version is not in use anymore, as this was related to the non-workspace managed versioning concept. This linear versioning concept was removed, so the database field is not needed anymore. It is recommended for all extensions with TYPO3 v10.0+ compat only to remove this field. Resolves: #88143 Releases: master Change-Id: I283e8e2ba2d755dcc8b2054e2439f9fef5462511 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60459 Tested-by:
Achim Fritz <af@achimfritz.de> Reviewed-by:
-
Oliver Hader authored
https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.2 * #34: Normalize resolved Windows path to Unix-style * #42: Avoid analysing non-phar files on alias resolving * #40: Add Windows tests using AppVeyor * #33: Add alternative mime-type resolving (without ext-fileinfo) composer require typo3/phar-stream-wrapper:^3.1.2 Resolves: #88354 Releases: master, 9.5, 8.7 Change-Id: I4560881006a6f9c48761161f0b96b78f02c0659d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60754 Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
Benni Mack authored
All functional tests that run a frontend subrequest should be tested against Site Handling, as the PseudoSite Handling is about to removed. This patch is actually a precursor to make sure that all tests work with site handling now. The AbstractDataHandlerActionTestCase adds e site configuration on each setUp(). This way, all DataHandler-related tests are running with a Site configuration of three languages. In addition, when "localizing" something, a translated page needs to exist, so most DataHandler related changes add this functionality. For some DataHandler tests, the SiteConfiguration is adapted to define the previous behavior built in TypoScript. One addition in PageResolver is made: If an GET / POST &id query parameter is given, and it is not accessible, it will fail now. Resolves: #88357 Releases: master Change-Id: I3dafec3382d8c6797f32b3acde2763dacd13e0f3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60757 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Daniel Dorndorf authored
A wrong evaluation of the null coalesce assignment (?? is evaluted and && later-on), the if() condition was always true for any previews of records with versioning enabled. The Backend API is used instead. Resolves: #88356 Releases: master, 9.5 Change-Id: I89ba14bd99bbeb17637b64d99a8d6de265a6e7c4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60758 Tested-by:
-
Oliver Hader authored
Given that e.g. public/typo3conf/ext/my_extension is symlinked to packages/my_extension, PharStreamWrapper denies invocation since realpath is resolved. For the specific PharStreamWrapperInterceptor it is okay to avoid realpath resolving. Resolves: #88340 Releases: master, 9.5, 8.7 Change-Id: I46b7100547dd0e40d1d4d76a71047ef977d8ce63 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60739 Tested-by:
Mathias Brodala <mbrodala@pagemachine.de> Tested-by:
tomalo.stuttgart <loeffler@spooner-web.de> Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Rudy Gnodde <rgn@windinternet.nl> Reviewed-by:
Kevin Meckl <kevin.meckl@zdrei.com> Reviewed-by:
Richard Haeser <richard@maxserv.com> Reviewed-by:
-
Anja Leichsenring authored
Resolves: #88335 Releases: master, 9.5 Change-Id: I40569702c9cec50aa9150c666488c7a71c28b47b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60732 Tested-by:
-
- May 13, 2019
-
-
Susanne Moog authored
Resolves: #88334 Releases: master, 9.5 Change-Id: I380c0aa3dd63ab6d1a8587138e0ff33df6941ca4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60731 Tested-by:
Jonas Eberle <flightvision@googlemail.com> Tested-by:
Tomas Norre Mikkelsen <tomasnorre@gmail.com> Reviewed-by:
-
Frank Naegler authored
Resolves: #86804 Releases: master, 9.5, 8.7 Change-Id: I81332dd5d5ede768f4ca90bac9d4d3a611f91d2e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60736 Tested-by:
-
Benjamin Franzke authored
When NormalizedParams was introduced, the code that was refactored from GeneralUtility:getIndpEnv did not take into account that PATH_INFO could be set, but be empty. (which happens with the Debian 9 NGINX default configuration which uses `fastcgi_split_path_info` and set's `fastcgi_param PATH_INFO` even if it's empty). Now, the fallback to PATH_INFO has been introduced with the initial revision of TYPO3 and isn't needed at all nowadays, it's actually wrong, as a REQUEST_URI to /index.php/foo/bar would incorrectly be interpreted as $scriptName == "/foo/bar". This patch additionally replaces PATH_INFO with SCRIPT_NAME in test cases where this variable is actually wrong (we assume test cases have been modeled to match (old) code, instead of reality here): * ProxyPass does not result in PATH_INFO being set, it's SCRIPT_NAME here. * PATH_INFO is not set for regular request to /typo3/index.php Resolves: #88304 Releases: master, 9.5 Change-Id: I501ad3bc10b0988385906a1fe9cb668c5e3696b6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60719 Tested-by:
Benny Schimmer <b.schimmer@saint-elmos.com> Tested-by:
-
- May 12, 2019
-
-
Dennis Grün authored
Resolves: #88315 Releases: master, 9.5 Change-Id: I76f75986b39ff15bd2d57ab94ec290a509381275 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60726 Reviewed-by:
Daniel Haupt <dh@schiffel.it> Reviewed-by:
Josef Glatz <josefglatz@gmail.com> Reviewed-by:
-
- May 10, 2019
-
-
Frank Naegler authored
Resolves: #87924 Releases: master Change-Id: I50332d97fbbfa9b04f1a2d8de761aabe84b3c367 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60260 Tested-by:
-
Guido Schmechel authored
Set the correct status value for the JsonResponse returned in case no database is selected. Additionally, a typo in the key `success` itself is fixed. Resolves: #88066 Releases: master, 9.5 Change-Id: I3153f6cabc878b270fe48983cbdedb8ed918d566 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60466 Reviewed-by:
-
Sybille Peters authored
Resolves: #87647 Releases: master Change-Id: I4f2a9db50481c12f84682ebe0147b962c8d8438d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60345 Tested-by:
Stefan Froemken <froemken@gmail.com> Tested-by:
-
Andreas Fernandez authored
With #87324 parts of the FormEngine have been split into smaller, maintainable parts. However, `SelectCheckboxElement` brings it's own "Revert selection" implementation that has nothing in common with the "Reset selection" field control used for select boxes. The code is now rewritten to handle the revert on its own. Additionally, another inline `onclick` handler was removed. Resolves: #88314 Related: #87324 Releases: master Change-Id: Ifca1b67a960a8caab8145f2a7d5c8301918819fa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60728 Tested-by:
-
Andreas Fernandez authored
This patch aims to reduce the size of the .editorconfig file used by IDEs to get rid of duplicated configuration (indent_style), obsolete configuration (bower.json) and merge related configuration (scss, css). Resolves: #88271 Releases: master Change-Id: I5a34536858b0cea5e4eb5a1f9fc7ca566aa144e0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60653 Tested-by:
-
Andreas Fernandez authored
Resolves: #88226 Related: #88040 Releases: master Change-Id: Ie8726b689362119a3d4d087582b3be2cb2b86e4b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60572 Tested-by:
-
- May 08, 2019
-
-
Benni Mack authored
On old OS with ICU < 4.6, the constant INTL_IDNA_VARIANT_UTS46 is not available, even if php-intl is installed. Therefore, a wrapper is created in HttpUtility to check if the constant is available, then uses INTL_IDNA_VARIANT_UTS46 otherwise the 2003 version of the HttpUtility. Also see the section about INTL_IDNA_VARIANT_UTS46 within https://www.php.net/manual/en/intl.constants.php Resolves: #87953 Releases: master, 9.5 Change-Id: I594c0ffd9afa115de595b0c027bf2474c3abfafb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60710 Reviewed-by:
Sven Juergens <typo3@blue-side.de> Reviewed-by:
Timo Poppinga <timo.poppinga@zdrei.com> Reviewed-by:
-
- May 07, 2019
-
-
Oliver Hader authored
In order to enclose and avoid type guessing done by ImageMagick based on mime-type and internal file content checks, new value object class ImageMagickFile has been introduced as guard for those invocations. Resolves: #87588 Releases: master, 9.5, 8.7 Security-Commit: d4f18684b2b2078b51cc7e93abdb251ea846984a Security-Bulletin: TYPO3-CORE-SA-2019-012 Change-Id: I9a2dd74e8548530d7bc83bd18af2f4f0a8212019 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60705 Tested-by:
-
Frank Naegler authored
On DataHandler update or when updating a users password via EXT:felogin, all existing sessions are destroyed except for the current session. Resolves: #87298 Releases: master, 9.5, 8.7 Security-Commit: df7c0dbcf73be20e5ae9d4cf03b82c8326c9fccc Security-Bulletin: TYPO3-CORE-SA-2019-011 Change-Id: Iff673d2ab774dde0f116c4bc9040d40374492a7a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60704 Tested-by:
-
Helmut Hummel authored
In order to avoid logging sensitive information during authentication using the logging framework, according log level DEBUG is used. Resolves: #88230 Releases: master, 9.5 Security-Commit: 625428b6364308f9f07f331bd176110d01e6c2f2 Security-Bulletin: TYPO3-CORE-SA-2019-010 Change-Id: I3e19afad6937515e0f6e1ab0a1c6d7004d182b79 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60703 Tested-by:
-
Oliver Hader authored
Due to a pass-by-reference error pages a user does not have access to were still visible in the page tree. Resolves: #87676 Releases: master, 9.5 Security-Commit: 5d2c69c00554ec64ea020ec803f593ae772fa367 Security-Bulletin: TYPO3-CORE-SA-2019-009 Change-Id: Ic8ba91b596e1589860bc28b746e551ac6bc47588 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60701 Tested-by:
-
Benni Mack authored
Due to some encoding issue, documentation of the new feature for slug TCA hooks is broken. The patch adapts the RST file. Resolves: #88289 Related: #88198 Releases: master, 9.5 Change-Id: I8e9027aba14678d678751246380833fce8a0e07b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60694 Tested-by:
-
Benni Mack authored
Raise Fluid Standalone dependency to the next stable version which fixes an important XSS issue when escaping ternary operators. Used composer command: composer req typo3fluid/fluid:^2.6.1 --prefer-lowest Resolves: #88288 Releases: master, 9.5, 8.7 Security-Bulletin: TYPO3-CORE-SA-2019-013 Change-Id: I04f32d8d01f893bc26ff21aa0c079c85e9db85b9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60693 Reviewed-by:
Claus Due <claus@phpmind.net> Reviewed-by:
-
Oliver Hader authored
The auto suggest feature of MacBook's touch bar shows information of just entered passwords when editing a record containing a password field in backend forms. The behavior only occurs when Safari is used as client and touch bar word completion is activated. Resolves: #88286 Releases: master, 9.5, 8.7 Change-Id: I588a6edcfc34c403dc9f042adbeca2c711512228 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60678 Tested-by:
-
Benni Mack authored
When converting a USER to USER_INT ContentObject the stdWrap is now executed only once instead of multiple times. Resolves: #61441 Releases: master, 9.5 Change-Id: Ia36dfffeb3721acc244a74fc559030e94439d10d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60463 Tested-by:
-
Helmut Hummel authored
Instead of globally selecting all files with matching meta data, we now base each search on the selected folder. To do so, search is now completely based on the persisted files in sys_file (and their corresponding meta data in sys_file_metadata). Additionally we properly evaluate search fields from TCA so that we now search in all fields defined for sys_file and sys_file_metadata table. To achieve that, a new capability "CAPABILITY_HIERARCHICAL_IDENTIFIERS" is introduced, which drivers can set, that build identifiers that reflect the directory structure. For such drivers, the search can be optimized by using like queries on identifiers, instead of recursively traversing folders, which can be an expensive operation especially for drivers handling a remote file system. Resolves: #87610 Releases: master, 9.5 Change-Id: Ia132465437827b2fdb56004eb73348ce4a05b336 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/58985 Reviewed-by:
-
Benni Mack authored
When a page is moved from one site to another site (two pagetrees with different sites), currently a duplicate slug is possible. This should never happen, so the same logic as for "uniqueInPid" is applied when moving records. Resolves: #87884 Releases: master, 9.5 Change-Id: I9a2d5756958e09fa89fbbc384d03c0503b70bf8c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60534 Tested-by:
-
Helmut Hummel authored
This reverts commit 3139b560. "[BUGFIX] Do not cache content with different status code than 200" At the same time we convert a plugin action to uncached, in case a redirect is issued. Resolves: #88178 Releases: 8.7, 9.5, master Change-Id: Icaa8038d1fa4bf1c74dfb505c2b8fc97963ca4be Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60518 Tested-by:
-
- May 06, 2019
-
-
Richard Haeser authored
To make sure rendering of hreflang tags will not change unexpectedly, some functional tests are added. Resolves: #88251 Related: #88140 Releases: master, 9.5 Change-Id: Idd8bc846e4bd57eb5335fe4795dcb233849eb4e8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60635 Tested-by:
-
Oliver Hader authored
Phar Stream Wrapper has been upgraded to version 3.1.1 in order to solve performance and alias resolving issues. The interceptor has been streamlined further. composer require typo3/phar-stream-wrapper:^3.1.1 Resolves: #88277 Releases: master, 9.5, 8.7 Change-Id: Id6b08557ab507ef66e54d1f39992272fe4791405 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60673 Tested-by:
-
Patrick Lenk authored
The for HTMLtableCells in parseFunc_RTE has been removed. Empty cells still contain the non-breaking space. Resolves: #87771 Releases: master Change-Id: Ic95a215f07597954cebffc7aff73dd15dcce986b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/59784 Tested-by:
Guido Schmechel <guido.schmechel@brandung.de> Tested-by:
Tobi Kretschmann <tobi@tobishome.de> Tested-by:
Steffen Frese <steffenf14@gmail.com> Reviewed-by:
-
Christian Kuhn authored
Change-Id: Ic1e1d0f8fd1a128e542e7cada389d681ac41e10f Resolves: #88265 Releases: master, 9.5, 8.7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60648 Tested-by:
-
Benni Mack authored
In order to access resolved route parts by enhancers, the TypoScript RequestWrapper should allow to access the PageArguments object. This way, it is easier to migrate existing conditions like [globalVar = GP:singlepartner > 0] to [request.getPageArguments().get('singlepartner') > 0] Resolves: #88252 Releases: master, 9.5 Change-Id: I6abed5badac342c88d2b40d38ecf1ea632f321d7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60637 Tested-by:Benjamin Franzke <bfr@qbus.de> Reviewed-by:
Helmut Hummel <typo3@helhum.io> Reviewed-by:
-
Andreas Fernandez authored
If `mod.web_layout.disableNewContentElementWizard=1` is set, the "New Content Element" wizard is skipped and EditDocumentController's FormEngine is called directly. In that case, the modal must not get opened as this doesn't work in combination with FormEngine. Resolves: #88075 Releases: master, 9.5 Change-Id: Idada95f426496b49131463ec1d0e8462df163e70 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60627 Tested-by:
Joerg Kummer <typo3@enobe.de> Tested-by:
-
- May 05, 2019
-
-
Benjamin Franzke authored
Instead of offloading the work to wait for the final page content, concurrent requests now wait for the real page content to be rendered (and deliver the content from cache once ready) instead of sending a 503 response code and the famous "Page is being generated" message. The logic to wait for the rendered page (lock and wait) is already there thanks to the page locking, but was deliberately circumvented by the temporary page cache content before to get rid of waiting requests in high-load situations. This approach to simply skip the temporary cache and wait for the renderer to finish has been tested using the skip_page_is_being_generated extension in wild for 3 years (for TYPO3 v6, v7, v8 and v9). Note: In case the increased number of waiting requests has a negative impact on sites with high server load, a additional proxy cache should be considered in front of the server to make sure clients are served a valid response without waiting until new content is ready. The motivation for this change: The 503 status code together with the "Page is being generated message" does not only occur for slow or high traffic sites. It will be displayed even for two concurrent requests, no matter how fast the page rendered or how low the current traffic is. The requests only need to (nearly) arrive at the same time. This can easily be reproduced using two parallel curl requests: for i in {1..2}; do curl -sv https://doma.in/foo |& grep '^< HTTP'& done There would be one "503 Service unavailable" response when /foo has not yet been rendered to the cache before. An explanation for the releaseLock('pagesection') addition in TSFE::getFromCache(): This has been added as the pagesection lock – which is acquired in TemplateService::start() – was implicitly released in setPageCacheContent() before. Now this would block concurrent rendering for pages with $_GET-aware plugins, therefore we release the pagesection lock early, after the pagesection cache has been generated. Releases: master, 9.5, 8.7 Resolves: #87980 Change-Id: I034f410335b3035c5863b26e3e689ca29b5f3f80 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60307 Tested-by: -
Richard Haeser authored
To get a valid Twitter card, you need to specify the type of card by setting the twitter:card metatag. The value of this metatag is now set to summary by default. If this value need to be changed, you can use the MetaTag API and set the twitter:card property with the replace option enabled. Resolves: #88258 Releases: master, 9.5 Change-Id: Iaeaafb2408102c2844623155611cffffa8919d43 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60647 Tested-by:
Riny van Tiggelen <info@online-gamer.nl> Reviewed-by:
-
