- Mar 03, 2024
-
-
linawolf authored
* Introduce a guides.xml, the presence of this file triggers the new rendering. * Replace sphinx-only syntax * remove superfluous genindex, it is not supported anymore * Remove old Settings.cfg, was only used for Sphinx Attention: Backports need manual changes to the guides.xml. Resolves: #103238 Releases: main, 12.4, 11.5 Change-Id: I5d9239a9217d8d6c2faa08cef58436971ee83113 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83103 Tested-by:
Lina Wolf <112@linawolf.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Chris Müller <typo3@krue.ml> Reviewed-by:
-
- Feb 28, 2024
-
-
Markus Klein authored
In relation mode "manyToMany" it is okay to have a limit of one. Code-wise the FlexForm code is slightly simplified as there is no support for the "manytoMany" case. Resolves: #103188 Releases: main, 12.4, 11.5 Change-Id: Ib2bbafadefc39f603a9ec4fda20aebcee85cdd7a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83112 Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
-
- Feb 23, 2024
-
-
Benjamin Franzke authored
Using timestamps as array keys in form yaml configuration can result in sparse [1] JavaScript arrays which contain "empty slots". Example yaml configuration: templateRootPaths: 1708504268: 'EXT:example/Resources/Private/Emails/Templates' This value is properly serialized into an object by PHP json_encode (as it does not contain sequential integer keys starting at 0), but the FormEditor data model produces arrays from numerical keys during clone operations of such data sets and basically creates sparse arrays like: > const example = [] > example[1708504268] = 'EXT:example/Resources/Private/Emails/Templates' > console.log(example) [ <1708504268 empty items>, 'EXT:forms_extended/Resources/Private/Emails/Templates' ] Some array-looping operations like Array.reduce() will loop through all empty slots [1] and therefore preduce a lot of processing load (1708504269 loops for the example above) that ultimately cause freezes. The array to object copy operation is now replaced by a modern spread operation that is defined to skip empty slots. [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Indexed_collections#sparse_arrays Releases: main, 12.4, 11.5 Resolves: #103168 Change-Id: I10b586ff5c5b0fb3698bfbbe28b2f93d932b71a2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83079 Reviewed-by:Benjamin Franzke <ben@bnf.dev> Tested-by:
-
- Feb 22, 2024
-
-
Torben Hansen authored
With #103046, `encryptionKey` has been removed from `DefaultConfiguration.php`. This leads to PHP array key warnings in unit tests. The patch sets it for various tests. Resolves: #103148 Related: #103046 Releases: main, 12.4, 11.5 Change-Id: Ife279449c2db569c8d63a0cc19009f1a3ca278d5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83075 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Stefan Bürk authored
The command dispatch for `-s phpstanGenerateBaseline` is modified to a simple command dispatch instead of the bash expansion - which is not needed in this case. Resolves: #103106 Releases: main, 12.4, 11.5 Change-Id: I771945f2a0751cbf4d350ffe0e8e8f2d78a04d86 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83093 Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
-
- Feb 21, 2024
-
-
Georg Ringer authored
Return early in the template module on root page if a sys_template record is retrieved from a page which itself is deleted. Resolves: #103164 Releases: 11.5 Change-Id: Iabbf57d67559998819ad92829384b9d8b7ad1533 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83049 Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Ioulia Kondratovitch <ik@plan2.net> Reviewed-by:
-
sschreiberten authored
Resolves: #103170 Releases: main, 12.4, 11.5 Change-Id: Ic7f63f6c55b832af27e9e30a0711ba042df42aa3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82988 Tested-by:
-
- Feb 20, 2024
-
-
Benni Mack authored
Change-Id: Icbc9a048e82113dce433a1059ed0f53727b44e28 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83039 Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
Benni Mack authored
Change-Id: Ic9729e15cf60d56f5fc1ecb63dfd0a9545b92104 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83038 Reviewed-by:
-
- Feb 19, 2024
-
-
Andreas Kienast authored
Resolves: #103142 Releases: main, 12.4, 11.5 Change-Id: I31e5af71aa0e1a9104f8c154a6f0e34f29c90a77 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82984 Tested-by:
Andreas Kienast <a.fernandez@scripting-base.de> Reviewed-by:
-
- Feb 17, 2024
-
-
Stefan Bürk authored
New core-testing-* images have been build and published in the TYPO3 testing-infrastructure repository and pulled to the core ci gitlab runner instances. [1] This change modifies `Build/Scripts/runTests.sh` to set new image version to ensure the usage for all changes based on this change. For information what changed in the image see the patches in the testing-infrastrucure repository linked below. * core-testing-php82 => 1.11 * core-testing-php83 => 1.12 [1] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/072687df3a90e808143b3eded59176ee593e8112 Resolves: #103143 Releases: main, 13.0, 12.4, 11.5 Change-Id: Ia0ec77beb11e3f24614a0f5b531799494c1af988 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82982 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
-
- Feb 15, 2024
-
-
Andreas Kienast authored
The method `FileLinkHandler->getSelectedFolder()` may return either an instance of `Folder` or a blunt `false`, where the latter case was not properly handled. This issue is now fixed. Resolves: #103116 Resolves: #103122 Releases: 11.5 Change-Id: I245517ee884b6320d6bc4e2abb5a8a16f485fc69 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82999 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
- Feb 13, 2024
-
-
Benjamin Franzke authored
The RST and some templates adaptions have been missed in the 11.5 backport of #102799. Resolves: #103109 Related: #102799 Releases: 11.5 Change-Id: Ib3279436003417415cc286873f7959d618f6e02a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82969 Reviewed-by:
-
Oliver Hader authored
Change-Id: I6aa8b241cbb0e433928b252a613fb4ecc5f0e7bb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82964 Tested-by:
-
Oliver Hader authored
Change-Id: I38cbdb269558b2e823a16ba7b8f4abb3895466e8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82963 Reviewed-by:
-
Oliver Hader authored
Write access to table `sys_file` is denied per default, unless data is being imported. In addition, write access to related FAL entities `sys_file_reference` and `sys_file_metadata` is denied in case a file on legacy storage (uid=0) is used or corresponding user does not have permissions to access a particular file. Resolves: #93969 Releases: main, 13.0, 12.4, 11.5 Change-Id: Ic8ac7132d732bd117aa63f6a33545ceb1d1f421d Security-Bulletin: TYPO3-CORE-SA-2024-006 Security-References: CVE-2024-25121 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82944 Reviewed-by:
-
Benjamin Franzke authored
Resolves: #93571 Releases: main, 13.0, 12.4, 11.5 Change-Id: I9622bfa47ef9637cecaff4a790f742445f598682 Security-Bulletin: TYPO3-CORE-SA-2024-005 Security-References: CVE-2024-25120 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82943 Tested-by:
-
Benjamin Franzke authored
The encryptionKey is a secret that must never be sent within any request, therefore it is now dropped from the editing interface in "Configure Installation-Wide Options". Resolves: #103046 Releases: main, 13.0, 12.4, 11.5 Change-Id: I260a8a2e9af29908543dfe48ac3658d8c45cc440 Security-Bulletin: TYPO3-CORE-SA-2024-004 Security-References: CVE-2024-25119 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82942 Reviewed-by:
-
Oliver Hader authored
Backend form fields of TCA `type=password` should never expose the persisted value - especially, in case the value is explicitly configured not to be hashed (having TCA `hashed=false`). Resolves: #101965 Releases: main, 13.0, 12.4, 11.5 Change-Id: Ie05a708185c621b8a2120ad7851ac4caf180893f Security-Bulletin: TYPO3-CORE-SA-2024-003 Security-References: CVE-2024-25118 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82941 Tested-by:
-
Benjamin Franzke authored
Resolves: #102799 Releases: main, 13.0, 12.4, 11.5 Change-Id: I673b6fbac853b0a977a5e5833a683c6952a55458 Security-Bulletin: TYPO3-CORE-SA-2024-002 Security-References: CVE-2024-22188 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82940 Tested-by:
-
Oliver Hader authored
The File Abstraction Layer Local Driver did not verify whether a given absolute file path is allowed, and made it possible to access files outside of the project path, and to by-pass the setting in $GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath']. In case lockRootPath is not set, any local file path must be at least located in the base directory of the current project. The lockRootPath setting now supports array values as well. The trailing slash is enforced automatically. Example: * instead of 'lockRootPath=/var/spe' previously matching the paths '/var/specs/' and '/var/specials/, * now both paths need to be declared explicitly, since 'lockRootPath=/var/spe' is evaluated as '/var/spe/' Resolves: #102800 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6561df562c5dbaff1f77d33db24d5f1c6358b198 Security-Bulletin: TYPO3-CORE-SA-2024-001 Security-References: CVE-2023-30451 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82939 Reviewed-by:
-
- Feb 12, 2024
-
-
Oliver Hader authored
Executed command: composer update composer/composer see https://github.com/advisories/GHSA-7c6p-848j-wh5h Resolves: #103102 Releases: main, 13.0, 12.4, 11.5 Change-Id: Ib3a0baa5c94f0a19b36b8440a30f47f25eab6e65 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82902 Tested-by:
Markus Klein <markus.klein@typo3.org> Reviewed-by:
-
- Feb 11, 2024
-
-
Oliver Bartsch authored
The query for fetching extension versions is extended to also find "outdated" extension versions (review_state = -2). Note: For now, this does not change anything in the EM, since the remote XML does not use the -2 state currently, due to the wrong constraint. This can however now be properly fixed in XML. Resolves: #93082 Releases: main, 12.4, 11.5 Change-Id: I522a2c166c6d1af6e8b2a14de51d63a15c4211d2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82848 Tested-by:
-
- Feb 10, 2024
-
-
Oliver Hader authored
Resolves: #103097 Releases: 12.4, 11.5 Change-Id: I9280a8489cd0b301a1d9c66efc8428bad206cb8c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82891 Tested-by:
-
Stefan Bürk authored
New core-testing-* images have been build and published in the TYPO3 testing-infrastructure repository and pulled to the core ci gitlab runner instances. [1][2] This change modifies `Build/Scripts/runTests.sh` to set new image version to ensure the usage for all changes based on this change. For information what changed in the image see the patches in the testing-infrastrucure repository linked below. * core-testing-php74 => 2.7 * core-testing-php80 => 2.7 * core-testing-php81 => 2.11 * core-testing-php82 => 1.10 * core-testing-php83 => 1.11 [1] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/e6719d303eacf2f377e308c800b474b735145d61 [2] https://github.com/advisories/GHSA-7c6p-848j-wh5h Resolves: #103096 Releases: main, 13.0, 12.4, 11.5 Change-Id: If9c5ae00334acc4fa5a1417dcbf9f77d31dff62d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82887 Reviewed-by:
-
- Feb 09, 2024
-
-
Yann authored
An editor can trigger a TypeError exception leading to a 503 error message `trim() expects parameter 1 to be string, null given` in the backend page module by creating `menu_categorized_content` objects with `selected_categories` and then turning them into `menu_section` objects. This change mitigates the type error by using a null-coalesce fallback passing an invalid type to the `trim()` method in `StandardContentPreviewRenderer::generateListForMenuContentTypes()`. Resolves: #103052 Releases: main, 12.4, 11.5 Change-Id: I4c0ecbd20c7cdfee22fa324f6b80391be47a1b88 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82793 Tested-by:
-
Thomas Hohn authored
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: https://github.com/Roave/SecurityAdvisories/issues/127#issuecomment-1933647035 [1] https://getcomposer.org/doc/04-schema.md#replace [2] https://github.com/advisories/GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82873 Tested-by:
-
- Feb 08, 2024
-
-
Oliver Bartsch authored
When copy a file corresponding metadata are now also copied, preserving existing properties like "file" or "uid". Resolves: #70934 Releases: main, 12.4, 11.5 Change-Id: Ifbc15b1ad2f1baaba48edbc5299d3b89e2755a53 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82837 Tested-by:
-
- Feb 07, 2024
-
-
Simon Schaufelberger authored
A new test case is added to cover the case when a TCA definition exists without `ctrl`. The test case has been added to the test extension `blog_example` which is not part of the public extension. Resolves: #103025 Releases: main, 12.4, 11.5 Change-Id: Iccd4428ad544fd6a94ed48ec97264b2945463d04 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82792 Tested-by:
-
Stefan Bürk authored
This change adds a composer command dispatcher to `Build/Scripts/runTests.sh` to allow the execution of any composer command without the hassle to have a proper composer installed on the host system. This also helps for onboarding new contributors not having a proper php and composer ecosystem installed on the host system. For example, to raise dependencies following can now be used: > Build/Scripts/runTests.sh -s composer -- require --dev \ typo3/testing-framework:dev-main Other examples: > Build/Scripts/runTests.sh -s composer -- dumpautoload > Build/Scripts/runTests.sh -s composer -- info | grep "symfony" Resolves: #103045 Releases: main, 12.4, 11.5 Change-Id: I65fa14e2c8d0d1a1204b3bed701d8c3458b6e3bb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82839 Tested-by:
-
- Feb 05, 2024
-
-
Stefan Bürk authored
This change adds further MySQL Server versions to the `Build/Scripts/runTests.sh` to allow executing local functional and acceptance tests with these version. Added versions: - MySQL 8.1 - MySQL 8.2 - MySQL 8.3 Resolves: #103030 Releases: main, 12.4, 11.5 Change-Id: I578ed524560ae1907ab8a79df7694470f9aa234a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82785 Tested-by:
-
- Feb 03, 2024
-
-
Benni Mack authored
This change now checks for a records' sys_language_uid field before doing overlays, and is only doing overlays when the incoming record has a "sys_language_uid" -1 and was properly overlaid. Resolves: #100931 Resolves: #101229 Resolves: #101718 Releases: main, 12.4, 11.5 Change-Id: I73acaf02de950312d1728936a92b6603ff62eb77 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79775 Reviewed-by:
-
- Feb 02, 2024
-
-
Stefan Bürk authored
The `Build/Scripts/runTests.sh` supports `podman` and `docker` as container cli binary since quite a while now, albeit docker has been kept as default if not specified using `-b`. This change removes the hard default and will now use `podman` as default. In case `podman` is not available `docker` is used. As a side-effect, the binary for CI is no longer enforced the hard way. PostgreSQL 16 is added as database version. Resolves: #103018 Releases: main, 12.4, 11.5 Change-Id: Iedcd7cbcd2380adb6781bd8b4f075da86e25c03b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82767 Tested-by:
-
- Jan 31, 2024
-
-
Stefan Bürk authored
The first argument after processing defined options has been stored into the variable `TEST_FILE`. This value was passed to PHPUnit based commands as last argument, defining the test case to execute (or a subset). Removing this workaround and directly passing remaining options to the command makes special arguments like `-e` obsolete and unblocks more generic command passing. This change removes this variable and passes all remaining arguments after option processing directly to the PHPUnit command and paves the way for future command improvements. Note: This makes the `-e` option basically obsolete, but is kept for now to minimize muscle memory issues. Using it will display a `deprecation` notice at the end of the script - so it gets recognized. Resolves: #102769 Releases: main, 12.4, 11.5 Change-Id: I9a85206330a7e1b58d81dc5a2c97a13831af29a1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82729 Reviewed-by: -
Sascha Nowak authored
When fetching a lot of records from database the memory is nearly doubled in the fetchAll function. It seems php keeps references or creates an array copy that could not be garbage collected. Enforcing a manuell gc_collect_cycles does not help either. Resolves: #102986 Releases: main, 12.4, 11.5 Change-Id: I2da5f1e0126aa1dc867c8fb3074be4a11491f8f3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82724 Reviewed-by:
-
- Jan 30, 2024
-
-
Oliver Bartsch authored
There might be no comma in front of an extension scanner tag. This should not lead to an error as it's unrelated for this check and will already be catched by the "validateLastLine" check. Resolves: #102987 Releases: main, 12.4, 11.5 Change-Id: Icda7cbb1b01ced39ee80311e15bccdfd9318b953 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82718 Tested-by:
-
- Jan 29, 2024
-
-
Andreas Kienast authored
The `is:pageBrowsing` ViewHelper now receives the `freeIndexUid` argument. Resolves: #102950 Releases: 12.4, 11.5 Change-Id: Ia8c6dd2bf5a61676cf9db85ef2623cf76d7dffb9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82699 Tested-by:
-
- Jan 25, 2024
-
-
Peter Kraume authored
The method resolveResourcePaths() is superfluous because the PageRenderer resolves path with EXT: later with getStreamlinedFileName() anyway. Furthermore this patch resolves open_basedir errors. As a plus, the form.css gets a version numbered filename now which mitigates caching issues. Resolves: #98545 Releases: main, 12.4, 11.5 Change-Id: Ie93b6aa817889281c8f96fd272884f03cab3857e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82617 Tested-by:
-
- Jan 22, 2024
-
-
Stefan Bürk authored
New core-testing-* images has been build and published in the TYPO3 testing-infrastructure repository and pulled to the core ci gitlab runner instances. [1][2] This change modifies `Build/Scripts/runTests.sh` to set new image version to ensure the usage for all changes based on this change. For information what changed in the image see the patches in the testing-infrastrucure repository linked below - at least for the phpXY images. * core-testing-php74 => 2.6 * core-testing-php80 => 2.6 * core-testing-php81 => 2.10 * core-testing-php82 => 1.9 * core-testing-php83 => 1.10 * core-testing-js => 1.4 * core-testing-js-chrome => 1.4 [1] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/2fb328622d88d47afd3e8abc9bf6ff32f7ef3db6 [2] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/e1ec0954b823acbab3f37100f8b6d0a03c31f0d8 Resolves: #102886 Releases: main, 12.4, 11.5 Change-Id: I3830a5f53b18e2170c9f973a66007dc3868d99dd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82554 Tested-by:
-
- Jan 16, 2024
-
-
Oliver Hader authored
Change-Id: I20b54295db619fbfebf1d0958b057e495d2334bc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82465 Reviewed-by:
-
