- Nov 14, 2023
-
-
Benjamin Franzke authored
See https://github.com/TYPO3/html-sanitizer/releases/tag/v2.1.4 composer req typo3/html-sanitizer:^2.1.4 composer req typo3/html-sanitizer:^2.1.4 \ -d typo3/sysext/core --no-update Resolves: #102169 Releases: main, 12.4, 11.5 Change-Id: I76edb7ff0dc66d3308d5c0875c2db56ca02addd7 Security-Bulletin: TYPO3-CORE-SA-2023-007 Security-References: CVE-2023-47125 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81737 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Benjamin Franzke authored
Given that there are two sites `site-a.com` and `site-b.com` in the same TYPO3 installation, it was possible to reuse a session cookie that was generated for `site-a.com` in `site-b.com`. Since there are scenarios, where this is the expected behavior – when sharing sessions across sub domains, so that an explicit cookieDomain needs to be configured – user sessions signatures are now salted with the desired cookie domain, so that a cookie can only be used on the domain that the cookie was created for. Testing framework will need to be adapted in a subsequent patch, but for the time being – and for compatiblity with possible 3rd party authenticators – legacy tokens will be accepted, but not created by TYPO3 core. Resolves: #100885 Releases: main, 12.4, 11.5 Change-Id: I0d1c314c6e206ac12604ba6f859af78b958651dd Security-Bulletin: TYPO3-CORE-SA-2023-006 Security-References: CVE-2023-47127 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81729 Tested-by:
-
Markus Klein authored
Using the Install Tool in composer mode, the login displays a hint, where the ENABLE_INSTALL_TOOL file must be placed to unlock the Install Tool. This hint does not show the full path anymore. Only the path relative to the project root is shown. Resolves: #102242 Releases: main, 12.4 Change-Id: I1e9cbfe3ef7d4cc6af9635da71d0c7450fe44aa6 Security-Bulletin: TYPO3-CORE-SA-2023-005 Security-References: CVE-2023-47126 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81736 Tested-by:
-
- Nov 13, 2023
-
-
Torben Hansen authored
Properties in extbase `QueryResultPaginator` do not use strict types. This change introduces strict types for the properties in extbase `QueryResultPaginator`. Since the class is defined as final, the change is not considered breaking. Resolves: #102282 Releases: main Signed-off-by:
Torben Hansen <derhansen@gmail.com> Change-Id: I1f9ebeb98caae41a88a300a14b2301497ce86b2f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81607 Tested-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
-
Christian Kuhn authored
We're in the process of establishing a new core CI. This has more power and is better optimized. The resulting runtime changes reveal various flaky acceptance tests. Most have been problematic before already, but not as bad. The patch adds various guards to acceptance tests to reduce flakiness. Resolves: #102363 Releases: main, 12.4, 11.5 Change-Id: Iff2c79411b39fffe659c78a8e889f8a804939bc4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81720 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
Andreas Kienast <a.fernandez@scripting-base.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Sybille Peters authored
TCA fields of type 'slug' can be configured with the property generatorOptions. Particularly, the short form of using a simple array for the fields instead of a nested array is a common source of confusion and the initially introduced changelog had incorrect examples. The changelog is improved as follows - Fix the examples. The examples 2 and 3 showed incorrect results - Use the multidimensional array in the source snippet - Clarify that ['nav_title', 'title'] is the same as [['nav_title'], ['title']], but not the same as [['nav_title', 'title']] Resolves: #89390 Releases: main, 12.4, 11.5 Change-Id: Ib1944c2a1eb9e2a69a0f169f316208cf46f9be84 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81723 Reviewed-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
-
Christian Kuhn authored
In AC tests it appears that popover instances are not available, either because the DOM isn't ready yet, or the element got removed meanwhile, leading to AC test failures. As a safety net, popover instances are now checked for not being `null`, and a warning is logged in the console. Also, the `@typo3/backend/context-help` module now waits for a ready DOM and only takes elements into consideration that existed on initialization time. Resolves: #102368 Releases: main, 12.4 Change-Id: Icffc6f7e144881ded56910d7cb6f75b80f9752e1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81724 Tested-by:
Benjamin Franzke <ben@bnf.dev> Reviewed-by:
-
Patrick Schriner authored
Resolves: #102358 Releases: main, 12.4 Change-Id: I6bab163fea7b186d1da713a764678d9a885122bf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81715 Tested-by:
Garvin Hicking <gh@faktor-e.de> Reviewed-by:
-
- Nov 10, 2023
-
-
Thomas Hohn authored
If a HMAC cannot be `json_decode`d (possibly due to old saved pages or other outdated content), now a proper exception is thrown instead of issuing a PHP warning. Resolves: #97337 Releases: main, 12.4, 11.5 Change-Id: I12f5633a85508bf4099d72e474c24b5a0100498c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78002 Reviewed-by:
-
Benjamin Franzke authored
The bootstrap jQuery interfaces required a global window.jQuery variable to be set. The jquery drop-in is dropped in order to remove this non-optional jQuery dependency. As a side effect the window.jQuery global is removed as well. Note that global jQuery usage has already been deprecated in #86438 and removed in #97243 with the suggestion to use JavaScript modules instead. window.jQuery was basically left in place for bootstrap to operate and therefore only `window.$` was removed back then, while `window.jQuery` stayed for the time being. Resolves: #101820 Related: #97243 Related: #86438 Releases: main Change-Id: I6b46ceb3e3e3e3cf892925c4442255febdfb5a33 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74055 Tested-by:
-
- Nov 09, 2023
-
-
Patrick Schriner authored
Resolves: #102350 Releases: main, 12.4 Change-Id: Ieb5f0b952bb647b02fc3dff183f744b8f8cfd1f4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81711 Tested-by:
-
Achim Fritz authored
The page types section of the Compare User View now displays the correct record type icon, which is already resolved from the record type items definition. Additionally, a fallback is added to prevent a possible undefined array key warning. Resolves: #102338 Releases: main, 12.4 Change-Id: I405b1933d01c1691fdcc10c15b323f92757365ed Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81701 Reviewed-by:
-
- Nov 08, 2023
-
-
Benni Mack authored
This change cleans up GifBuilder class further by adding types to all internal or protected methods. In addition, some cleanups are done: * Renaming of `$OFFSET` to `$offset` * Remove superfluous checks of `is_array()` Resolves: #102347 Releases: main Change-Id: I7888a4240f7702e3177011847f6c63a587c40c2a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81705 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
-
Andreas Kienast authored
Exected commands: npm install --save cropperjs@^1.6.1 npm run build Resolves: #102333 Releases: main, 12.4 Change-Id: I9be75686cb974a8c4288153e414bbbf2cc696859 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81699 Reviewed-by:
-
- Nov 07, 2023
-
-
Xavier Perseguers authored
When $GLOBALS['TYPO3_CONF_VARS']['SYS']['systemLocale'] is empty, a call to setlocale() may lead to a PHP crash. Resolves: #102343 Releases: main, 12.4 Change-Id: Icbb9d0118327c0303ae6d3fc98e1cbecfb704877 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81704 Tested-by:
-
Benjamin Franzke authored
The jquery interface $().carousel() has an implicit dependency on jquery being loaded, whenever bootstrap is loaded. To get rid of jquery, we migrate to the newer vanilla js interface. Resolves: #101821 Related: #101820 Releases: main Change-Id: I0426676fc00fd765bf21095f7dfeb2ed78614839 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80816 Reviewed-by:
-
Andreas Nedbal authored
Resolves: #101872 Releases: main Change-Id: I5b77bb2d7dacd18bb90002f50d710a3b3d5a4b52 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80922 Reviewed-by:
-
Benjamin Franzke authored
With #99503 `cObjGet()` was implemented as a wrapper around the strictly typed cObjGetSeparated method, effectively enforcing the first argument to be an array, while previously non array values were returned as an empty string. Resolves: #102328 Related: #99503 Releases: main, 12.4, 11.5 Change-Id: I7c04307f14da5a93e12672b36de163071dad7359 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81698 Tested-by:
Rafael Kähm <rafael.kaehm@dkd.de> Tested-by:
Jonas Eberle <flightvision@googlemail.com> Reviewed-by:
-
Andreas Kienast authored
When implementing #101912, a few case where FormEngine field validation is triggered with jQuery objects were overseen, triggering deprecation warnings. This patch fixes the remaining occurrences. Resolves: #102325 Related: #101912 Releases: main Change-Id: I22661a60e75d4d88bff652d640bc7a4ea46eca87 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81694 Reviewed-by:
-
Benjamin Franzke authored
Symfony's AsCommand attribute encodes `hidden = true` into a trailing `|` for the name attribute. Drop that for our command list and mark the command as hidden in the command registry. Resolves: #102292 Related: #101567 Releases: main, 12.4 Change-Id: I6415e3f5525764aab336bab20432c032e0665632 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81617 Tested-by:
Chris Müller <typo3@krue.ml> Reviewed-by:
-
- Nov 06, 2023
-
-
Imko Schumacher authored
Special characters (e.g. ") in argument labels of console commands are no longer displayed as HTML entity ("). Resolves: #102317 Releases: main, 12.4 Change-Id: Icd3c19e94002113823117f1666503ae277283d40 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81685 Reviewed-by:
-
Oliver Bartsch authored
Resolves: #102307 Releases: main Change-Id: Ie123eb853c34ad6bc451e29a73788787bffaf862 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81672 Reviewed-by:
-
Torben Hansen authored
Function arguments for `addErrorForProperty()` in Extbase `AbstractValidator` do use PHP native types, so several typecasts in the function are not required any more. Resolves: #102321 Releases: main, 12.4 Signed-off-by:
-
Fabio Norbutat authored
This change use the correct variable to assign view variables in one example in WidgetImplementation.rst. Releases: main, 12.4 Resolves: #102318 Change-Id: I601d2589ec3a44ab77d8548d507b20969d4e11b2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81688 Tested-by:
-
Fabio Norbutat authored
Invalid char encoding has slipped into an yaml example snippet for ext:dashboard. This change use the correct quoting to fix this. Releases: main, 12.4, 11.5 Resolves: #102319 Change-Id: I3dd2fd7a1aec51ad3f1ace7c6b914371e9e12342 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81689 Tested-by:
-
Chris Müller authored
Resolves: #102284 Resolves: https://github.com/TYPO3-Documentation/Changelog-To-Doc/issues/297 Related: #99308 Releases: main, 12.4 Change-Id: Ia6035bce975eab7978348f4a027e8e1af21c30b2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81608 Tested-by:
Lina Wolf <112@linawolf.de> Tested-by:
-
Andreas Kienast authored
This commit updates `phpstan/phpstan` to the latest version and fixes one issue within `RedisSessionBackend` where the Redis API claims to return a `\Redis` object when calling `->del()`. This indicates a usage of multi mode, where the delete state cannot get determined. Also, multi mode is not supported by our session backend, therefore we handle this case as "not successful" now. Executed command: composer require --dev phpstan/phpstan:^1.10.41 -W Resolves: #102320 Releases: main, 12.4 Change-Id: I6f4edb746c6e23d92d5147cc7c711d8da0309f0f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81690 Tested-by: -
Jonas Eberle authored
This adds a line break between concatenated "inline" JavaScripts in order to keep JavaScript without trailing ';' valid. Resolves: #99503 Releases: main, 12.4, 11.5 Change-Id: Icf902679c715687c5be2e5f572526608ce31f882 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77320 Reviewed-by:
-
Andreas Kienast authored
Resolves: #102305 Releases: main Change-Id: I3ce5dec038c93e8d0b8aa690396ece0adca875e9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81647 Tested-by:
-
Andreas Kienast authored
The FormEngine feature that shows the amount of remaining characters that fit in a field has been extracted from the `@typo3/backend/form-engine` god module into a separate Lit element. Also, the `badge-*` classes are migrated to `text-*` to have a lot less "bulky" UI. Resolves: #102273 Releases: main Change-Id: I2f87d656ded8f31d9569762d3d68d2f46d861b69 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81596 Tested-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
-
- Nov 05, 2023
-
-
Justus Moroni authored
Resolves: #102192 Releases: main, 12.4, 11.5 Change-Id: I0cc48e27d32b6d6164d9d580121968610a9333b9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81446 Tested-by:
-
- Nov 04, 2023
-
-
Josef Glatz authored
This patch fixes some typos and adds a missing quotation mark in the code example. Resolves: #102316 Releases: main, 12.4 Change-Id: I4f234b028a6cb8ca7b6b151366cf575dfc86a90e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81681 Tested-by:
-
Benjamin Franzke authored
@lit/task graduated from a 2-year @lit-labs phase, to an officially supported helper library for lit elements. We want to start using it as it embraces a tri-state model for async operations: * pending * complete * error …which is important in order to always handle error cases instead of silently ignoring them. Also existing or currently running requests are aborted and/or ignored when a newer state has already been activated. The icon-library deduplication caching strategy is refactored into a reusable helper instance that is a bit more generic and allows to abort (ref counted across duplicate requests) async operations. Commands executed: npm install --save @lit/task npm run build Resolves: #102308 Releases: main, 12.4 Change-Id: If068145a8bc87ae386af38aa6a63e4f19062345f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81598 Reviewed-by:
-
Benjamin Franzke authored
Use JavaScript object destructuring to "remove" all options from the configuration object, that are consumed by our CKEditor5 wrapper. Also cleanup RTE resource and config handling to not write unused options into the configuration array and to avoid resolving legacy (CKEditor4) resource paths which are dropped anyway. As a drive-by, dots are now substituted with '_' in RTE field IDs to avoid the following hassle: Dots are interpreted as CSS classes when the ID value is used in combination with a number sign (#) to create a CSS selector for the respective field ID. That means the selector will not match. The class selector additionally becomes invalid once there is a digit after the dot, as CSS classes need to start with strings. (Example: EXT:styleguide in_flex » tab » rte.2). Resolves: #100784 Resolves: #101437 Releases: main, 12.4 Change-Id: I076b838c03588ad6eb8ad075a9df58501f146376 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81406 Tested-by:
-
- Nov 03, 2023
-
-
Andreas Kienast authored
This commit updates bootstrap to version 5.3.2. Executed commands: npm install --save bootstrap@^5.3.2 npm run build Resolves: #102311 Releases: main, 12.4 Change-Id: I9aac1214c6f6024a61a317fe5b7576e8c03f7fd0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81676 Reviewed-by:Jasmina Ließmann <minapokhalo+typo3@gmail.com> Reviewed-by:
-
Oliver Bartsch authored
Since #94977, the record icon's markup is rendered in JavaScript, using the icon-element component. To display a possible overlay icon, the corresponding identifier is now also forwarded and passed to the element. Resolves: #102167 Relates: #94977 Releases: main, 12.4 Change-Id: I648112b8bd66efcd9935c0b32c987c1e7477ab90 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81673 Tested-by:
-
Andreas Kienast authored
EXT:styleguide is not fully compatible to dark mode environments. For the time being, light mode is enforce in examples until further groundwork is done. Resolves: #102310 Releases: main Change-Id: I098929883fbab6969e7bdd3d4af8c9fd487f8556 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81675 Tested-by:
-
Benjamin Franzke authored
The extension key setting was accidentally dropped in one of the monorepo merge preparation changes: https://github.com/TYPO3-CMS/styleguide/pull/475 Also reformat to use tabs as in other composer.json files. Resolves: #102309 Releases: main Change-Id: I97f6864551b524b27e770a5a046a77744fedf5e3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81674 Reviewed-by:
-
Andreas Kienast authored
This patch removes jQuery from the `@typo3/backend/module-menu` module. Collapsing/expanding of the module groups is now done by Bootstrap's `Collapse` module. The usage of `$.Deferred()` has been removed without replacement, this looks like a weird hack required back then. Resolves: #102304 Releases: main Change-Id: I0e1f9468e4487a1ef17b12b913d6a4f978c42dc6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81643 Reviewed-by:
-
- Nov 02, 2023
-
-
Achim Fritz authored
To prevents sql errors when inherit from SuggestWizardDefaultReceiver and adding a JOIN statement, the fields are now prefixed with the table name. Resolves: #102298 Releases: main, 12.4, 11.5 Change-Id: I608bd30df1b878aec8dbf611e70049c1be88778a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81637 Reviewed-by:
Guido Schmechel <guido.schmechel@brandung.de>
-
