- Dec 14, 2018
-
-
Sybille Peters authored
In order to get a rendered list of changes since the release of 9.5.0 an additional index file is needed for the 9.5.x changes. Resolves: #87135 Releases: master Change-Id: I14713eace6493220852aea55ae431b1c4182ee80 Reviewed-on: https://review.typo3.org/59124 Reviewed-by:
Stephan Großberndt <stephan.grossberndt@typo3.org> Tested-by:
TYPO3com <no-reply@typo3.com> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
-
Andreas Fernandez authored
The positioning of the collapse/expand arrows is changed to fix the break in trees with very deep nesting. Resolves: #86790 Releases: master, 8.7 Change-Id: Ie1a916da8220468c6fbb4034c1668675f379f588 Reviewed-on: https://review.typo3.org/59136 Tested-by:
Benjamin Kott <benjamin.kott@outlook.com> Tested-by:
-
- Dec 13, 2018
-
-
Oliver Hader authored
Due to recent security releases and fixes against cross-site scripting in central modal window component, templates are separated in order to distinguish between (secure) HTML and attribute or text nodes. Resolves: #87146 Releases: master, 8.7 Change-Id: I1264cbe9005e54d1fe30eaba23efbbad07937cb1 Reviewed-on: https://review.typo3.org/59135 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Georg Ringer authored
Allows to call the OnlineMedia modal box again. This change also adapts the buttons within a Modal to be text-only. Resolves: #87144 Releases: master, 8.7 Change-Id: Id08356aad3eb319c59af1411a14131715c8159d0 Reviewed-on: https://review.typo3.org/59120 Reviewed-by:
Riccardo De Contardi <erredeco@gmail.com> Tested-by:
-
Stefan Neufeind authored
Resolves: #87145 Releases: master Change-Id: Ie3abd71840ca8fbd48150ae2b4f34efc5273ce63 Reviewed-on: https://review.typo3.org/59121 Tested-by:
Markus Klein <markus.klein@typo3.org> Reviewed-by:
-
Alexander Schnitzler authored
Unfortunately https://review.typo3.org/58951/ did not actually solve issues #86028 and #86491 for good. There are two issues concerning the former approach: 1) The expiration time of all created caches was 0, which resulted in a permanent creation and deletion of cache entries. This behaviour cannot be called caching. 2) Number 1) increases the chance for race conditions where several parallel requests tried to create the same cache entry. To fix this, the check for an existing cache entry will be reverted to behave like before the regression, i.e. cache entries with an expiration timestamp of 0 are considered valid again. Also, new caches are created within a transaction, which prevents duplicate key errors. Releases: master, 8.7 Resolves: #87139 Change-Id: If9470f6e0f875c0ec4fe3c092c9bd0dfc059de2d Reviewed-on: https://review.typo3.org/59127 Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
-
Benni Mack authored
This reverts commit c23b1e19 as now frontend rendering is different from 8.7.19 and 8.7.20. Change-Id: Ia640ed3eda1619b0a34b5cd6afd07a665e372792 Resolves: #86819 Reverts: #83795 Releases: master, 8.7 Reviewed-on: https://review.typo3.org/59137 Reviewed-by:
-
Mathias Brodala authored
Resolves: #87149 Releases: master, 8.7 Change-Id: I8cf2cfab94634276a67fd3d0dd36215c12ae5490 Reviewed-on: https://review.typo3.org/59132 Tested-by:
Riny van Tiggelen <info@online-gamer.nl> Reviewed-by:
Ralf Merz <mail@merzilla.de> Tested-by:
Mathias Brodala <mbrodala@pagemachine.de> Tested-by:
-
- Dec 12, 2018
-
-
Christian Kuhn authored
Resolves: #87136 Releases: master, 8.7 Change-Id: Idbac64bf44b8f79ccd8a169f4abade462873e17d Reviewed-on: https://review.typo3.org/59125 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Benni Mack authored
In Extbase, it is possible to configure a custom namespace for plugin arguments: plugin.tx_bennimack.view.pluginNamespace = bmack This is now also respected in the Extbase Plugin Enhancer by omitting "extension" and "plugin" properties and just using the "namespace" property. Resolves: #87005 Releases: master Change-Id: I19c6338ec0d103837a5c5217ad7ba6643b6b6c54 Reviewed-on: https://review.typo3.org/58952 Tested-by:
Jonas Eberle <flightvision@googlemail.com> Tested-by:
Aimeos <aimeos@aimeos.org> Tested-by:
-
Georg Ringer authored
To avoid exceptions by the Doctrine annotations parser, the @ character is removed from the doc comment. Resolves: #87115 Releases: master Change-Id: I779374e2b9894272087153860de525fa0ce02712 Reviewed-on: https://review.typo3.org/59074 Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
Guido Schmechel authored
Add textfield filter for select fields from type "selectMultipleSideBySide" for system tables. Affected system tables: be_groups, be_users Resolves: #87112 Releases: master, 8.7 Change-Id: Iba8b837a9fc5f2ec64be7e5ad313b454c4373feb Reviewed-on: https://review.typo3.org/59070 Tested-by:
Josef Glatz <josef.glatz@typo3.org> Tested-by:
Joerg Kummer <typo3@enobe.de> Tested-by:
Peter Kraume <peter.kraume@gmx.de> Tested-by:
Michael Oehlhof <typo3@oehlhof.de> Tested-by:
Tomas Norre Mikkelsen <tomasnorre@gmail.com> Reviewed-by:
-
- Dec 11, 2018
-
-
Oliver Hader authored
Change-Id: If92f54c5a28edba2dc330ca8e32e5dcfda817f6f Reviewed-on: https://review.typo3.org/59116 Tested-by:
-
Oliver Hader authored
Change-Id: Ib5214342439fd510cfd599d9880b1612ff9b4cc1 Reviewed-on: https://review.typo3.org/59115 Reviewed-by:
-
Oliver Hader authored
Resolves: #87123 Releases: master, 8.7, 7.6 Change-Id: Idceecb174682261b967ea284e12e1836bb7e7bea Reviewed-on: https://review.typo3.org/59107 Tested-by:
-
Oliver Hader authored
Using large media files (*.youtube, *.vimeo in the TYPO3 core) might lead to denial of service scenarios. In order to avoid that, media files are limited to have a content size of 2048 bytes as a maximum. Usually these files contain just the remote identifier - thus, ~20 bytes should have been sufficient already. Resolves: #85381 Releases: master, 8.7, 7.6 Security-Commit: 36c64c45461dee1c4018b7c72a989952d1e2dd45 Security-Bulletin: TYPO3-CORE-SA-2018-011 Change-Id: Ib54cd9ab822ee33a44170822cc0a3c4da4132c95 Reviewed-on: https://review.typo3.org/59105 Reviewed-by:
-
Benni Mack authored
When installing TYPO3, the current version is shown without any kind of authentication provided (no FIRST_INSTALL). This information disclosure is solved. Resolves: #86254 Releases: master, 8.7, 7.6 Security-Commit: a69d09ab4eabd0474f0191f5daf525d91ebaa32f Security-Bulletin: TYPO3-CORE-SA-2018-010 Change-Id: Ib8359937716dce4839d76b054b0d0d549bd4aa0c Reviewed-on: https://review.typo3.org/59104 Reviewed-by:
-
Andreas Wolf authored
Resolves: #86955 Releases: master, 8.7, 7.6 Security-Commit: d251175e031aaa9943f93f5e5297f5490b99e513 Security-Bulletin: TYPO3-CORE-SA-2018-009 Change-Id: Ia50cac61ee2d649e98cba2102162c1360487bb20 Reviewed-on: https://review.typo3.org/59103 Reviewed-by:
-
Benni Mack authored
Two occurrences allow to render data of the currently logged in frontend user that is not sanitized and thus allow XSS attacks by frontend users. 1. EXT:fe_login adds ###FEUSER_{fieldname}### for each field that exists in the fe_users DB table, which CAN be processed by TypoScript but is insecure by default. 2. config.USERNAME_substToken = <!--###USERNAME###--> sets the username dynamically, which is then insecure. Adding htmlspecialchars as a default configuration solves this problem. Resolves: #87053 Releases: master, 8.7, 7.6 Security-Commit: 1cc57f4aa7dfb5b1e3e4db581c57aacd69dd4d9d Security-Bulletin: TYPO3-CORE-SA-2018-008 Change-Id: I72a1a4ea60f23c81016b87cbbd1ba63161c52df0 Reviewed-on: https://review.typo3.org/59102 Reviewed-by: -
Frank Naegler authored
Resolves: #84190 Releases: master, 8.7, 7.6 Security-Commit: 0aaf266ae75d04efc6a943f9414448d5c2787309 Security-Bulletin: TYPO3-CORE-SA-2018-007 Change-Id: Ic5beb5217326d8f3d72445d4bf9cc7ace705a5a0 Reviewed-on: https://review.typo3.org/59101 Reviewed-by:
-
Susanne Moog authored
Resolves: #83184 Releases: master, 8.7, 7.6 Security-Commit: c51313ed68970cd6d2f2172a0e3d74454cf05812 Security-Bulletin: TYPO3-CORE-SA-2018-006 Change-Id: Id982d4fc28e7817eeb88eb63f52dc3380365f3b1 Reviewed-on: https://review.typo3.org/59100 Reviewed-by:
-
Benni Mack authored
CKEditor 4.11 was released including a XSS fix where an attacker could add invalid HTML markup by switching to the Source mode of CKEditor and back. Used commands: cd Build/ yarn add ckeditor#4.11.1 --dev grunt build Resolves: #84800 Releases: master, 8.7 Security-Commit: 4a44c536a4f80b1fbf4599070761368e7919980c Security-Bulletin: TYPO3-CORE-SA-2018-005 Change-Id: I50412f24393c306a989dac448d7c0ee66a6760fb Reviewed-on: https://review.typo3.org/59099 Reviewed-by:
-
Richard Haeser authored
The PageTitleProviderManager will now check if the page cache object is an instance of FrontendInterface before getting the value from cache. Resolves: #87116 Releases: master Change-Id: I14838b41a7cba653d5f4e6c875c647f547673644 Reviewed-on: https://review.typo3.org/59082 Tested-by:
Susanne Moog <susanne.moog@typo3.org> Tested-by:
-
- Dec 10, 2018
-
-
Richard Haeser authored
Add current query string to the generated canonicalized URL to make the hreflang and canonical work with additional parameters as well. Parameters that are excluded from cache hash generation and not included in $GLOBALS['TYPO3_CONF_VARS']['FE']['additionalCanonicalizedUrlParameters'], are excluded from the canonicalized URL. Resolves: #86577 Resolves: #86866 Resolves: #86865 Releases: master Change-Id: Ib574e2f6c7aa869b4ffa798c7122a60f4cf13f13 Reviewed-on: https://review.typo3.org/58611 Tested-by:
-
Tim Karliczek authored
Add fields, which modify page icon rendering, to default field list of rootline page requests. Ensures more detailed rendering of page status icons in FLUID using ViewHelper core:iconForRecord Resolves: #87076 Releases: master Change-Id: I11adbaa627c77ceaaa23ca28229510cb19936ad3 Reviewed-on: https://review.typo3.org/59030 Reviewed-by:
Mona Muzaffar <mona.muzaffar@gmx.de> Reviewed-by:
-
Georg Ringer authored
The styling of the debug output is "namespaced" with `.exception-page` to avoid influencing other CSS definitions. Resolves: #86879 Releases: master Change-Id: I5561b7995826abfd5e1ea53b2b31b30b19c2f208 Reviewed-on: https://review.typo3.org/58870 Reviewed-by:
Markus Poerschke <markus@poerschke.nrw> Tested-by:
-
Oliver Bartsch authored
Use multibyte handling to properly process all Unicode characters for the spam protection email address handling. Resolves: #87071 Releases: master Change-Id: I9fec60c000a202ae34927ec4917e29e2d0e64a5c Reviewed-on: https://review.typo3.org/59033 Tested-by:
Wittkiel Gruppe <ts@wittkiel-gruppe.com> Reviewed-by:
-
- Dec 08, 2018
-
-
Peter Kraume authored
Show getUrl() error message when fetching content of error page. Resolves: #87073 Releases: master Change-Id: I9b2d548fc1d9a4bd07ea56c7d5776447c0c596d2 Reviewed-on: https://review.typo3.org/59026 Reviewed-by:
-
Alexander Stehlik authored
The reports module now ignores upgrade wizards that do not have any necessary upgrades (shouldRenderWizard property is false). This makes the behavior fully consistent with the install tool because there the wizards that should not be rendered are not displayed either. Resolves: #86632 Releases: master Change-Id: I87caf45023a0ca4eca71418e029bc8ed7091c0e4 Reviewed-on: https://review.typo3.org/59048 Tested-by:
Stefan Neufeind <typo3.neufeind@speedpartner.de> Reviewed-by:
-
Anja Leichsenring authored
Fix a nightly test setup for a wrong composer dependency in "main" stage. Disable the phpunit randomizer in "composer update max" stage for now since young phpunit collides with our current randomizer call. Change-Id: I4a5d9cd3eea1686969fe0185433a2384aad87a90 Resolves: #87106 Releases: master Reviewed-on: https://review.typo3.org/59060 Tested-by:
-
Christian Kuhn authored
Intercept has been adapted, the variable to label handing can be simplified a bit. Resolves: #87109 Releases: master, 8.7, 7.6 Change-Id: I27255ef9f5eb515c89f5d89e7061fc473e2abec1 Reviewed-on: https://review.typo3.org/59063 Tested-by:
-
Achim Fritz authored
Resolving the path here breaks the localization Override in the LocalizationFactory Class Resolves: #86683 Releases: master Change-Id: Ib7037bcfba0dd02cf46c1b31f98d7808e7974b3c Reviewed-on: https://review.typo3.org/59024 Reviewed-by:
Daniel Goerz <daniel.goerz@posteo.de> Tested-by:
Helmut Hummel <typo3@helhum.io> Tested-by:
-
- Dec 07, 2018
-
-
Thorben Nissen authored
Change `CObjectViewHelper::getContentObjectRenderer` to return a new instance of `ContentObjectRenderer` instead of returning a reference to `TSFE->cObj`. Change unit test and add prepared instance of `ContentObjectRenderer` to `GeneralUtility` via `addInstance` method. Resolves: #86979 Releases: master Change-Id: Ibdb8fd1d974a525f3583929a743447a8650ca1ab Reviewed-on: https://review.typo3.org/58661 Tested-by:
-
Nikita Hovratov authored
Due to the fact that the translation keys for the page cache info were double negated (noCache_no = yes) they ended up being mixed up. This patch just swaps the labels. In v10 the keys can be renamed to prevent confusion. Resolves: #87039 Releases: master Change-Id: I34f4d3aa2c0d659eee5c99c8df092260bcef7f5b Reviewed-on: https://review.typo3.org/58980 Reviewed-by:
Mathias Schreiber <mathias.schreiber@typo3.com> Reviewed-by:
Jan Helke <typo3@helke.de> Tested-by:
-
Georg Ringer authored
Make the full configuration of a SiteLanguage available. This is required to get access to an extended site language configuration. To be in sync to the Site object, the property attributes is renamed to configuration. Resolves: #87027 Releases: master Change-Id: I8962c5f7cafb38398bf9ded77058af38828e7182 Reviewed-on: https://review.typo3.org/59025 Tested-by:
-
Wolfgang Klinger authored
The RequestWrapper::getParsedBody method must return an array, otherwise the a condition like [request.getParsedBody()['foo'] == 1] results in a silent exception if the body is empty. ConditionMatcher::normalizeExpression is now using an advanced regex to handle multiple [] parts correctly. Resolves: #86915 Releases: master Change-Id: Ia3f951d1a3994d545025691e35521ca05b97a39a Reviewed-on: https://review.typo3.org/58935 Tested-by:
Raphael Graf <r@undefined.ch> Reviewed-by:
-
Joerg Boesche authored
Resolves: #87097 Releases: master Change-Id: I1a6415c5b43e478ac90bb5f2db4437fb498fc568 Reviewed-on: https://review.typo3.org/59051 Tested-by:
Frank Naegler <frank.naegler@typo3.org> Tested-by:
Richard Haeser <richard@maxserv.com> Tested-by:
Florian Peters <fpeters1392@googlemail.com> Tested-by:
-
Andreas Fernandez authored
A `selectMultipleSideBySide` field is now marked as "changed" when either the order of items has changed or when an item has been removed. Resolves: #87082 Releases: master, 8.7 Change-Id: I9f50576270db667751c14e3513d1a7cd31c1135e Reviewed-on: https://review.typo3.org/59056 Reviewed-by:
-
Andreas Fernandez authored
The latest used tab must be set to active only when the DOM has been loaded. Resolves: #84027 Releases: master Change-Id: I52c8c190c5e58f1793335470427fc18203e4c561 Reviewed-on: https://review.typo3.org/59055 Reviewed-by:
-
Romain Canon authored
In parallel to TYPO3, in order to require the package `doctrine/orm:^2.6.0` (and further), the package `doctrine/instantiator` must be required at least with version `1.1.0`. Used composer command: `composer req doctrine/instantiator:^1.0` Resolves: #86965 Releases: master Change-Id: I473caa015bc1d6431654cbb889148cd396e7412b Reviewed-on: https://review.typo3.org/58924 Reviewed-by:
Wouter Wolters <typo3@wouterwolters.nl> Tested-by:
Georg Großberger <garfieldius67@gmail.com> Tested-by:
-
