- Dec 18, 2015
-
-
Gerrit Mohrmann authored
This patch corrects fetching the storage uid from the row data for sys_file_collection Resolves: #72276 Releases: master Change-Id: I73ef3e5121249942cb12859081194ba499559559 Reviewed-on: https://review.typo3.org/45325 Reviewed-by:
Wouter Wolters <typo3@wouterwolters.nl> Reviewed-by:
Morton Jonuschat <m.jonuschat@mojocode.de> Tested-by:
Frank Nägler <frank.naegler@typo3.org> Tested-by:
-
Thomas Löffler authored
Media file properties can be used in TypoScript. Change-Id: I48f64851ce03abe7898d184109b2342eeeb441fc Resolves: #72186 Releases: master Reviewed-on: https://review.typo3.org/45223 Reviewed-by:
Jigal van Hemert <jigal.van.hemert@typo3.org> Reviewed-by:
Daniel Goerz <ervaude@gmail.com> Reviewed-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
Markus Klein authored
Additionally add explicit type conversions to all places, which might influence the linktxt for typolink. Resolves: #72132 Releases: master Change-Id: I3774b41c6825d81f0d4510126e806dae2e7eaf50 Reviewed-on: https://review.typo3.org/45316 Reviewed-by:
Andreas Fernandez <typo3@scripting-base.de> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Philipp Gampe <philipp.gampe@typo3.org> Reviewed-by:
Stefan Neufeind <typo3.neufeind@speedpartner.de> Reviewed-by:
Frans Saris <franssaris@gmail.com> Tested-by:
-
- Dec 17, 2015
-
-
Daniel Goerz authored
Change-Id: Iaf83e3f2d0a6a4b0cf795e4a6ef2a127cf0421df Resolves: #72303 Releases: master Reviewed-on: https://review.typo3.org/45341 Reviewed-by:
Michael Oehlhof <typo3@oehlhof.de> Reviewed-by:
-
Wouter Wolters authored
Resolves: #72304 Releases: master Change-Id: I177c641ac18b4270b6ab6ce019054bffd37942fb Reviewed-on: https://review.typo3.org/45342 Reviewed-by:
-
Oliver Hader authored
If pages records in a given scenario are published this causes a severe data-loss for the whole TYPO3 installation since all records are deleted. Actually they are marked as deleted, but that's not less problematic. The scenario for this in a draft workspace is having reordered sub-pages (move-placeholder) and a parent-page that is marked for deletion. On publishing the parent-page, the delete process iterates over all pages on the root-level due to some essential missing checks and an implicit type-cast from null to interger zero (0) on the pages.pid value. The accordant places are validated now. In addition to that the possibility to delete everything implicitly from the root-page is disabled to prevent other programmatic flaws like this. Resolves: #72273 Releases: master, 6.2 Change-Id: I175f220cc0939124e34713fff07685ba902ad385 Reviewed-on: https://review.typo3.org/45321 Reviewed-by:
Alexander Opitz <opitz.alexander@googlemail.com> Tested-by:
-
Melanie Kalka authored
DBAL uses an empty string for the portnumber parameter for mysqli real_connect, which results in a PHP warning, because an integer (or null) is required. Changing the fallback to null resolves this issue and results in a working database connection. Resolves: #72285 Releases: master, 6.2 Change-Id: Ie0e04f3ab04996ab634f99c3d2ab545d4a3b3819 Reviewed-on: https://review.typo3.org/45338 Reviewed-by:
-
Oliver Hader authored
Actions performed in a workspace: * move existing page below sibling on same level (move-placeholder) * create new page on parent page (new-placeholder) * delete the parent page Attention: The test assertions reflect the status quo which is faulty and has to be fixed on a separate bugfix. Resolves: #72291 Releases: master, 6.2 Change-Id: I85e10569c36a4c669a479434a5ce973d3fb9fe5c Reviewed-on: https://review.typo3.org/45329 Reviewed-by:
-
Markus Klein authored
Regression fix. Resolves: #72298 Releases: master Change-Id: I98d70bfaf423d29277607e335abcc286448113f2 Reviewed-on: https://review.typo3.org/45335 Reviewed-by:
Gregor Sievert <gregor@gregorsievert.de> Tested-by:
-
Markus Klein authored
Add a bunch of unittests and streamline the code as well by removing a useless preg_match_all() call. Rename some variables and add comments. Resolves: #72252 Releases: master, 6.2 Change-Id: I2a31a1c2ab6d83528428693213b922f0e1bc6fe5 Reviewed-on: https://review.typo3.org/45319 Reviewed-by:
Tobias Klepp <tobias.klepp@stimme-der-hoffnung.de> Tested-by:
-
Andreas Fernandez authored
Some save buttons do not follow the `_save` naming convention, but have a `form` attribute instead. IE does not support such attribute which breaks the save buttons. Now all buttons with a `form` attribute are added to the save button handling. To prevent side effects, the buttons must be in the module header now. Resolves: #72288 Related: #71598 Releases: master Change-Id: I180725ebd03a7c480ec22058d6ed32a1cc5c5f2b Reviewed-on: https://review.typo3.org/45327 Reviewed-by:
Roman Schürmann <roman.schuermann@wmdb.de> Tested-by:
-
Andreas Fernandez authored
Resolves: #72259 Releases: master Change-Id: Ideaaec0afa3d2553a0b4f6222c61057dd60f76c0 Reviewed-on: https://review.typo3.org/45307 Reviewed-by:
Cedric Ziel <cedric@cedric-ziel.com> Tested-by:
-
Helmut Hummel authored
It is pointless to hide the exception message on CLI in the production context. On CLI there are privileged users only anyway and hiding this information from them leads to wasted hours of debugging. Output the necessary information also in ProductionExceptionHandler Resolves: #72265 Releases: master, 6.2 Change-Id: I778b057fc7e170af2a2fcdb1befb2a4400449ce7 Reviewed-on: https://review.typo3.org/45315 Reviewed-by:
Stephan Großberndt <stephan@grossberndt.de> Reviewed-by:
-
Oliver Hader authored
PHP Warning: Invalid argument supplied for foreach() in typo3/sysext/core/Classes/DataHandling/DataHandler.php line 5285 Resolves: #72289 Releases: master, 6.2 Change-Id: If83dee7261ce3dd6d1fbf3bb81d8f2e53741c4c7 Reviewed-on: https://review.typo3.org/45328 Reviewed-by:
-
- Dec 16, 2015
-
-
Daniel Goerz authored
Change-Id: Ief05c75376ef8b3b2fc8fa8c3ca52e2efbf24198 Resolves: #72256 Releases: master, 6.2 Reviewed-on: https://review.typo3.org/45295 Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Anja Leichsenring authored
Favicon resource link misses the cache buster to make browsers aware of changed resources. Resolves: #72274 Relates: #72165 Releases: master Change-Id: Ie3a32f2c8d48f0026c27175216207438ca11c7da Reviewed-on: https://review.typo3.org/45318 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Joerg Kummer authored
Adapt JS and HTML to solve toggle on load and change task type. Resolves: #72213 Releases: master Change-Id: Idb4c964c42cb8bd408ebd98a528a603f1a0bead1 Reviewed-on: https://review.typo3.org/45239 Reviewed-by:
-
Wouter Wolters authored
When an empty row in a table content element is shown in the frontend, with htmlSpecialChars set to 1, is shown. Use a real space instead. Resolves: #72263 Releases: master,6.2 Change-Id: I60304607caa4fc90451216426f4ed73f01bf75fc Reviewed-on: https://review.typo3.org/45314 Reviewed-by:
-
Andreas Fernandez authored
The spinner displayed in the login button of the backend module is now shown right after triggering the first AJAX call. Previously, it was shown after the RSA public key was fetched. Resolves: #71291 Releases: master Change-Id: I24b74e3812ea69bc74f1372e902785352a90822b Reviewed-on: https://review.typo3.org/45261 Reviewed-by:
Rudy Gnodde <rgn@windinternet.nl> Tested-by:
-
Cedric Ziel authored
Releases: master Resolves: #72237 Change-Id: I4ee1d57c4fad46802115cd530d8a2b312f5d5679 Reviewed-on: https://review.typo3.org/45290 Reviewed-by:
Xavier Perseguers <xavier@typo3.org> Tested-by:
-
Daniel Goerz authored
Additionally trailing slashes are no longer added to folder identifiers. Change-Id: Ieb14a6fd653a5f3ce130650f61d5235342c96b33 Resolves: #72246 Releases: master Reviewed-on: https://review.typo3.org/45294 Reviewed-by:
-
- Dec 15, 2015
-
-
TYPO3 Release Team authored
Change-Id: I5c698ca457b28d0ea214cb44a48e78ce013968e1 Reviewed-on: https://review.typo3.org/45288 Reviewed-by:
TYPO3 Release Team <typo3cms@typo3.org> Tested-by:
-
TYPO3 Release Team authored
Change-Id: Ie4db2833e842ef8d98c61b87177002ee8336aa67 Reviewed-on: https://review.typo3.org/45287 Reviewed-by:
-
Georg Ringer authored
The caption must be escaped. As this is only a textarea, the parsefunc is not needed. Furthermore, the fields "altText" and "titleText" use htmlspecialchars instead of stripHtml. Resolves: #41690 Releases: master, 6.2 Security-Commit: 2cfa39c452a35286deffdac4f0a03314e6f6ee69 Security-Bulletins: TYPO3-CORE-SA-2015-010, 011, 012, 013, 014, 015 Change-Id: I17a43cfa860c058054cd73f6ab751edfa91a02ce Reviewed-on: https://review.typo3.org/45284 Reviewed-by:
-
Georg Ringer authored
The SpellCheckingController needs to quote external parameters. Resolves: #37399 Releases: master, 6.2 Security-Commit: 0c5bb0ef87817710a7276f205b9efd62c9e68924 Security-Bulletins: TYPO3-CORE-SA-2015-010, 011, 012, 013, 014, 015 Change-Id: I4e341ae19cd16734ce228e6ed1250124ee9811f9 Reviewed-on: https://review.typo3.org/45283 Reviewed-by:
-
Georg Ringer authored
Replace parsefunc with htmlSpecialChars for the lines of bullet list Resolves: #71683 Releases: master, 6.2 Security-Commit: d756287c89b3c3f1e53c7e4661bea8e8f2f1d2e6 Security-Bulletins: TYPO3-CORE-SA-2015-010, 011, 012, 013, 014, 015 Change-Id: Idabbe0222398e848a7365446a577f10ae804cd30 Reviewed-on: https://review.typo3.org/45282 Reviewed-by:
-
Georg Ringer authored
Instead of using the lib.parseFunc htmlspecialchars is used for the table cell rendering. Resolves: #25245 Releases: master, 6.2 Security-Commit: 7810e48bcd34b3769b981ad3a77b4057312c73fc Security-Bulletins: TYPO3-CORE-SA-2015-010, 011, 012, 013, 014, 015 Change-Id: I2f4a6c83e5201685c2549f4fd3f0108c39309c2d Reviewed-on: https://review.typo3.org/45281 Reviewed-by:
-
Wouter Wolters authored
Properly escape user input when showing broken links in EXT:linkvalidator Resolves: #68735 Releases: master,6.2 Security-Commit: e990111b86a9ac0f6f1a6c7741d28f8097b38d5c Security-Bulletins: TYPO3-CORE-SA-2015-010, 011, 012, 013, 014, 015 Change-Id: Ibc28e7075c7663e796f6e06d4c2872e9fe345dbb Reviewed-on: https://review.typo3.org/45280 Reviewed-by:
-
Georg Ringer authored
Change default TypoScript to encode messages in felogin with htmlspecialchars. Fix two occurences of _LOCAL_LANG messages where htmlspecialchars was missing. Resolves: #25243 Releases: master, 6.2 Security-Commit: 341a017859b2c3c99b675fb787b1c5a7af8cef6f Security-Bulletins: TYPO3-CORE-SA-2015-010, 011, 012, 013, 014, 015 Change-Id: Icddb2be90bced5ef51439630a5b47bf6bc04f624 Reviewed-on: https://review.typo3.org/45279 Reviewed-by:
-
Wouter Wolters authored
Resolves: #25227 Releases: master, 6.2 Security-Commit: ee77513838267a6dabba8732fa4afe7970ce4ddc Security-Bulletins: TYPO3-CORE-SA-2015-010, 011, 012, 013, 014, 015 Change-Id: If50fbffdfe8e6709e48bcf08da31094688089b01 Reviewed-on: https://review.typo3.org/45278 Reviewed-by:
-
Oliver Hader authored
JavaScript can be submitted for every link field and will be rendered in the frontend passed through typolink. To circumvent that, the URI scheme and prefix "javascript:" will be disallowed. The extension "javascript_handler" allows however to bring back that insecure behavior since some installations might rely on it. Resolves: #71698 Releases: master, 6.2 Security-Commit: c854186c419f26a109afaf068149a58ef1745f32 Security-Bulletins: TYPO3-CORE-SA-2015-010, 011, 012, 013, 014, 015 Change-Id: I7dbed505624718010023cd8192ff7174a6a43fa6 Reviewed-on: https://review.typo3.org/45277 Reviewed-by:
-
Nicole Cordes authored
Resolves: #59150 Releases: master, 6.2 Security-Bulletins: TYPO3-CORE-SA-2015-010, 011, 012, 013, 014, 015 Change-Id: I93386ba95b02713368b8155b73a6da620c3795c2 Reviewed-on: https://review.typo3.org/45276 Reviewed-by:
-
Nicole Cordes authored
Due to the json request format during a TER extension installation, the EM is susceptible to XSS. Resolves: #71524 Releases: master, 6.2 Security-Commit: 45f7ec93279bff9cbbde1d76a5947b73adce81ab Security-Bulletins: TYPO3-CORE-SA-2015-010, 011, 012, 013, 014, 015 Change-Id: I0e555c4e711c2d3f956b74ca53b0c0534c131724 Reviewed-on: https://review.typo3.org/45275 Reviewed-by:
-
Markus Klein authored
Remove a left-over code from the LiveSearch migration to autocomplete which causes a PHP warning. The removed code and its results is never used in JS. Resolves: #72226 Releases: master Change-Id: Ia27c5cd7e863c4d6c0ca89ed8ca3f78a47ed2bfb Reviewed-on: https://review.typo3.org/45259 Reviewed-by:
-
Markus Klein authored
If the content has no markers at all, the full content needs to be returned. Additionally, the result does not need to be cached if no markers are present. Resolves: #72224 Releases: master, 6.2 Change-Id: I8fd39ab705eaa2217bba4fd5a069d940e677ea47 Reviewed-on: https://review.typo3.org/45255 Reviewed-by:
-
Wouter Wolters authored
Correct wrong PHPdoc for getIncludeScriptByCommandLineKey. It returns an array and not a string. Resolves: #72212 Releases: master Change-Id: If5907d44106b3405ccf462a0b9e902226a7f5199 Reviewed-on: https://review.typo3.org/45252 Reviewed-by:
-
- Dec 14, 2015
-
-
Morton Jonuschat authored
This patch changes viewhelpers that inherit from the fluid ActionViewHelper but have a different method signature for render() to inherit from a base viewhelper that doesn't have a default render() method, removing the incompatibilities. Resolves: #72183 Releases: master Change-Id: Ifb3479b39d972056c2cf8c431f6dc580f5b2630c Reviewed-on: https://review.typo3.org/45217 Reviewed-by:
-
Markus Klein authored
Only specify a *single* type information for parameters, otherwise Fluid fails to extract the right type and does not validate the boolean expressions anymore. Resolves: #67225 Releases: master Change-Id: Ibf9873a74e94fb731a3440da25024853663e9c7e Reviewed-on: https://review.typo3.org/45246 Reviewed-by:
-
Marco Huber authored
Set the default value for list_type to an empty string in the database to match the default value in the TCA. Resolves: #72171 Related: #32209 Releases: master Change-Id: I46ed9935571e3b3d8dbfb6bec232ffd8f63a35f0 Reviewed-on: https://review.typo3.org/45208 Reviewed-by:
-
Andreas Fernandez authored
Return `$text` instead of an empty string if EXT:context_help is not installed. This shows the field label again but hides the help buttons. Resolves: #72205 Related: #71659 Releases: master Change-Id: I6dba5e40c05e2555ad73d71eb6d177990225a0b4 Reviewed-on: https://review.typo3.org/45236 Reviewed-by:
Mathias Brodala <mbrodala@pagemachine.de> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
