- Jul 12, 2018
-
-
Ralf Zimmermann authored
The form editor save and preview actions now check the submitted form definition against configured possibilities within the form editor setup. Releases: master, 8.7 Resolves: #85044 Security-Commit: f4a1a09378ed286f3744d6a72f09bfa11a6ba87e Security-Bulletin: TYPO3-CORE-SA-2018-003 Change-Id: Ibf6083ab98b9fe73effe217380f555892c9c6bb0 Reviewed-on: https://review.typo3.org/57562 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Susanne Moog authored
Before this change, form definitions have been persisted in regular `.yaml` files. In order to make the meaning and purpose of those files more explicit, the new file ending `.form.yaml` is introduced. Invocations of the file abstraction layer API for those form files have to be allowed explicitly by granting commands individually using `FilePersistenceSlot::allowInvocation`. New form definitions are created with the new file ending per default. An upgrade wizard renames existing form definitions that are stored in according storage folders (`allowedFileMounts`). In addition references in FlexForm of content elements are adjusted to the new file names as well - in case a form definition has been referenced before. The file list user interface disabled according direct actions for `.form.yaml` files or redirects those to the according form module. Using just `.yaml` instead of `.form.yaml` from site packages is deprecated. Using just `.yaml` instead of `.form.yaml` from file storages is not allowed anymore. Resolves: #84910 Releases: master, 8.7 Security-Commit: 444f9dc4f1902871391bd1f139d19b46a63a162f Security-Bulletin: TYPO3-CORE-SA-2018-003 Change-Id: I456c03f745e614729cdbf2915efc6b5e6d11fc0f Reviewed-on: https://review.typo3.org/57561 Reviewed-by:
-
Oliver Hader authored
Resolves: #85385 Releases: master, 8.7, 7.6 Security-Commit: f4d645d131fabc98cbbdcefcffb951040d2dd246 Security-Bulletin: TYPO3-CORE-SA-2018-002 Change-Id: Ia138f22856c7dd754e373803af799273868c622b Reviewed-on: https://review.typo3.org/57560 Reviewed-by:
-
Christian Kuhn authored
SoftReferenceIndex throws exceptions on phar streams LegacyLinkNotationConverter throws exceptions on phar streams Resolves: #85385 Releases: master, 8.7, 7.6 Security-Commit: 4fde9d6a2333435af9033f55e9a5e2d428f6ea0d Security-Bulletin: TYPO3-CORE-SA-2018-002 Change-Id: I69333fff4d94dc7369ba729333a39e8be5dda7a3 Reviewed-on: https://review.typo3.org/57559 Reviewed-by:
-
Oliver Hader authored
This custom stream wrapper for the phar:// protocol overrides PHP's native handling. In case Phar bundles shall be loaded from a valid directory, the custom wrapper falls back to the native PHP wrapper in order to invoke Phar-related actions. In case the location is not trustworthy, an according exception is thrown. The custom stream wrapper is registered in the beginning of TYPO3's bootstrap class. Truested locations are those in typo3conf/ext/* - anything else is denied and not considered as trustworthy. Releases: master, 8.7, 7.6 Resolves: #85385 Security-Commit: efa085d9a5aebfac6b92309ea53c455b95a81fcc Security-Bulletin: TYPO3-CORE-SA-2018-002 Change-Id: Ifd38eab7a5757e6cfbd6f773a3fed8f3d742e09d Reviewed-on: https://review.typo3.org/57558 Reviewed-by:
-
Oliver Hader authored
Using password hashing methods that are related by class inheritance can lead to authentication bypass by just knowing a valid username. Resolves: #84703 Releases: master, 8.7, 7.6 Security-Commit: 2951c4fc0529ec0fd6047786edd3b7189428e574 Security-Bulletin: TYPO3-CORE-SA-2018-001 Change-Id: I859a20c85305291e1cd79b61e630bbbfc4e0568a Reviewed-on: https://review.typo3.org/57557 Reviewed-by:
-
- Jul 11, 2018
-
-
Benni Mack authored
The Logger can be used with the LoggerAwareInterface+Trait combination and was fogot for FAL related areas. The LocalImageProcessor and FileProcessingService did not have any usage of the logger, thus, they were removed. Additionally, one should reference against the interfaces, not the implementation classes directly. Resolves: #85519 Releases: master Change-Id: Ie381b1fc9a7007e76ea1c487fa9b1bda4a793bc0 Reviewed-on: https://review.typo3.org/57515 Tested-by:
TYPO3com <no-reply@typo3.com> Reviewed-by:
Mathias Brodala <mbrodala@pagemachine.de> Reviewed-by:
Alexander Schnitzler <typo3@alexanderschnitzler.de> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
-
- Jul 10, 2018
-
-
Stefan Neufeind authored
The setting used bits 1 and 2. But useful values were only 0/1/2. So this setting can be simplified. Resolves: #85508 Releases: master Change-Id: Ib78174035bcefdec7658f37dae9071062dcb52c1 Reviewed-on: https://review.typo3.org/57500 Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Jigal van Hemert <jigal.van.hemert@typo3.org> Tested-by:
-
- Jul 09, 2018
-
-
Ralf Zimmermann authored
Variants allow you to change properties of a form element. Variants can contain conditions. If a concrete condition is TRUE the variant is applied. If no condition exists the variant will be ignored. Variants make it possible to manipulate form element values, validator options, and finisher options based on conditions. This allows you among other things: * translation of form element values depending on the frontend language * set and remove validators of one form element depending on the value of another form element * hide entire pages depending on the value of a form element * set finisher values depending on the value of a form element * hiding a form element in certain finishers and on the summary page This feature implements variants for the frontend rendering and the ability to define variants in the formDefinition. The implementation to define variants in the form editor is out of scope of this patchset. Releases: master Resolves: #84133 Change-Id: I9efeeea5af67df2d2f9252339c26baf8a03cf9c8 Reviewed-on: https://review.typo3.org/54982 Tested-by:
Björn Jacob <bjoern.jacob@tritum.de> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Helmut Hummel authored
Remove inheritance from abstract log module Inheritance was used only to be able to get the time from which to start to look for errors. This however never really worked, because the constraint only had a startTimestamp value set, if the user selected a custom time frame when viewing the log. Therefore we can just assume errors have not been seen, unless they are confirmed through the system information toolbar. Resolves: #85517 Releases: master Change-Id: Id6aa21fbbe0c56baeb19633aba0f9f7ff6215c0e Reviewed-on: https://review.typo3.org/57513 Tested-by:
Helmut Hummel <typo3@helhum.io> Reviewed-by:
-
Michael Giek authored
TCA defines default status code as 307, which seems like a good default. However the SQL definition should match this definition to avoid any invalid redirect status codes. Releases: master Resolves: #85513 Related: #85488 Change-Id: I972d83bd782592c77b6606cd6f7d6a1fc82d2414 Reviewed-on: https://review.typo3.org/57510 Reviewed-by:
Jan Stockfisch <jan.stockfisch@googlemail.com> Tested-by:
-
Benni Mack authored
Similar to https://review.typo3.org/#/c/57434/ the check for TSFE->showHiddenRecords is unneeded as the RestrictionContainer evaluates this information (now done via aspects) directly anyway. Resolves: #85516 Releases: master Change-Id: Icc88b1995fe603f3707c9a83e83bf03ff549422e Reviewed-on: https://review.typo3.org/57512 Tested-by:
Susanne Moog <susanne.moog@typo3.org> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Frank Naegler authored
In case the adminOnly flag is set, an information window is shown. The middleware now creates a valid JSON response to show the information window again. Resolves: #84765 Releases: master Change-Id: Ibe36b9d2c06b730bb2687d528d011268af4da660 Reviewed-on: https://review.typo3.org/56706 Tested-by:
-
Stefan Neufeind authored
Resolves: #85512 Releases: master, 8.7, 7.6 Change-Id: I4077fe7481063feb97014048580c3fb1b1ca5e2a Reviewed-on: https://review.typo3.org/57507 Tested-by:
Stefan Neufeind <typo3.neufeind@speedpartner.de> Tested-by:
-
Łukasz Uznański authored
* replace usages of _GP, getIndpEnv * add return hints Resolves: #84387 Releases: master Change-Id: I156f9005c132ab91abfbd72b97084ede6708d0dc Reviewed-on: https://review.typo3.org/56264 Tested-by:
Robert van Kammen <rvkammen@hotmail.com> Tested-by:
-
- Jul 07, 2018
-
-
Davert authored
typo3/testing-framework got a major release: composer update typo3/testing-framework ^4.0 * codeception acceptance tests now live in a proper php namespace * merged installation suites yml files into one * installer tests are now one suite with different environment settings * aligned with changes in typo3/testing-framework * renamed Acceptance test suite to Backend test suite * removed Admin/Editor steps, replaced with useExistingLogin('role') Resolves: #85472 Releases: master Change-Id: Ia049b43f5f9f645dddb509bde557ad83a7ac9023 Reviewed-on: https://review.typo3.org/57461 Tested-by:
-
- Jul 06, 2018
-
-
moger-xx authored
Releases: master Resolves: #85500 Change-Id: I060e27a52a2a840dca2fd65db0e206f73dc5c8f9 Reviewed-on: https://review.typo3.org/57482 Tested-by:
Rudy Gnodde <rgn@windinternet.nl> Reviewed-by:
Mona Muzaffar <mona.muzaffar@gmx.de> Tested-by:
-
Andreas Fernandez authored
Resolves: #85505 Releases: master Change-Id: I73315ce0c958cccbce401875b13514b7dae58f27 Reviewed-on: https://review.typo3.org/57495 Reviewed-by:
-
Andreas Fernandez authored
Resolves: #85504 Releases: master Change-Id: I75580fb05c0217b1c28a2109b7f6bc2147d458d8 Reviewed-on: https://review.typo3.org/57494 Reviewed-by:
-
Wouter Wolters authored
Resolves: #85476 Releases: master Change-Id: I879bb7546e7e7ca0d46e8d682eb739f76df61b01 Reviewed-on: https://review.typo3.org/57465 Tested-by:
-
Andreas Fernandez authored
The extension scanner now scans an extension by opening its panel again. Resolves: #85440 Releases: master Change-Id: I7b72f8c658d200c5c4d4ca90f7d6b55828c33efd Reviewed-on: https://review.typo3.org/57493 Reviewed-by:
Jürgen Venne <venne@schaffrath-digital.de> Tested-by:
-
Andreas Fernandez authored
The styling of the caret was only applied, if it is a child of `.panel-collapsed`, which is no official Bootstrap markup. The CSS is now changed to rotate the caret icon with the correct markup, too. This fixes the issue in the System Maintenance Area that the caret rotation is broken. Resolves: #85503 Releases: master Change-Id: I095b7339c3ae8d86e6642fb1953d3bff2b042bfb Reviewed-on: https://review.typo3.org/57492 Tested-by:
-
Wouter Wolters authored
Resolves: #85474 Releases: master Change-Id: I62b1fe0b5ea3e1b5340aa18c216c7491d2d64fad Reviewed-on: https://review.typo3.org/57463 Reviewed-by:
-
Georg Ringer authored
Saving a scheduler task without any changes leads to 0 affected rows which must not be interpreted as an error. Resolves: #85366 Releases: master, 8.7 Change-Id: I474e16478cb09ad4940aaab5fe1d3eb21498c4c4 Reviewed-on: https://review.typo3.org/57358 Reviewed-by:
Wouter Wolters <typo3@wouterwolters.nl> Tested-by:
Frans Saris <franssaris@gmail.com> Reviewed-by:
-
Frank Naegler authored
Resolves: #82595 Releases: master Change-Id: Iebec35d3f1be6b70e3976a04c9820c9277a845e3 Reviewed-on: https://review.typo3.org/57475 Tested-by:
Frank Naegler <frank.naegler@typo3.org> Reviewed-by:
-
Ralf Zimmermann authored
The SaveToDatabase now converts DateTime(Immutable) objects to strings to make it possible to save values from "Date" or "DatePicker" form elements into the database. Resolves: #85246 Releases: master, 8.7 Change-Id: I1533252d462d08bf7b743884d4e8e5fab12f6423 Reviewed-on: https://review.typo3.org/57205 Reviewed-by:
Lidia Demin <typecat@gmx.net> Reviewed-by:
Riny van Tiggelen <info@online-gamer.nl> Tested-by:
-
Markus Klein authored
When fetching only headers from an URL there is no need to download the whole content. This was overlooked when migrating the core to use Guzzle. Resolves: #85491 Releases: master, 8.7 Change-Id: I6475b405d51135372e022b5e133368f15a917687 Reviewed-on: https://review.typo3.org/57479 Reviewed-by:
-
Andreas Wolf authored
Change-Id: If29efc14acf4155ac820dfbd966fd7cdc8003fe2 Resolves: #84168 Releases: master Reviewed-on: https://review.typo3.org/56281 Reviewed-by:
-
Jan Helke authored
This patch is just groundwork for upcomming "make test xxx notice free" patches. Resolves: #85497 Related: #84456 Releases: master Change-Id: Ib4517cbccadced40e828ded0f76115f00abb5530 Reviewed-on: https://review.typo3.org/57481 Reviewed-by:
Jord de Jong <jord.dejong@windinternet.nl> Tested-by:
-
Wouter Wolters authored
Resolves: #85480 Releases: master Change-Id: I0c666be36a30add9742fdba33d8211daf839fcf9 Reviewed-on: https://review.typo3.org/57469 Tested-by:
Joerg Boesche <typo3@joergboesche.de> Reviewed-by:
-
Andreas Fernandez authored
- Introduce proper `<html>` tag - Use callouts instead of alerts - Deleted obsolete template files - Streamline handling of inline vs. modal - Fix CSS for nested panels, if parent is `flat` Resolves: #85463 Releases: master Change-Id: Ide545367d2153da5c170eda1e69397005bb8ed58 Reviewed-on: https://review.typo3.org/57454 Tested-by:
Jan Helke <typo3@helke.de> Tested-by:
-
Mathias Brodala authored
This vastly simplifies running common commands for TYPO3 development. E.g. executing PHPUnit can be done like this: composer test:php:unit Since Composer uses Symfony Console this can even be shortened: composer t:p:u Also arbitrary arguments can be passed to the executed command: composer t:p:u -- --filter unitTestMethodName Change-Id: I3ef62417227b3c4c1c3d8f8f3662052ca36ed885 Resolves: #83249 Related: #84836 Releases: master, 8.7 Reviewed-on: https://review.typo3.org/54959 Tested-by:Sybille Peters <sypets@gmx.de> Tested-by:
Patricia Tiedemann <pixelaeffchen@googlemail.com> Tested-by:
-
- Jul 05, 2018
-
-
Oliver Hader authored
In order to harden the deserialization of scalar and array values in extension manager unserialize() calls are hardened further to disallow object reconstitution. The information is retrieved from the TYPO3 extension repository (TER) where according countermeasures are in place to protect object injections - that's why this change is considered as hardening and not as security issue. Resolves: #85466 Releases: master, 8.7 Change-Id: I65b61d61e08d0c50b27ae9102d7ba4c4518a8788 Reviewed-on: https://review.typo3.org/57458 Reviewed-by:
Daniel Goerz <ervaude@gmail.com> Tested-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Tested-by:
-
Benni Mack authored
RequireJS configs do not have a slash at the end of the path. The Debug Console shows that files are loaded with double slashes in the install tool, so they should be avoided. Resolves: #85481 Releases: master Change-Id: I80326d176c6dbd54847f1c188d312da1c5e55078 Reviewed-on: https://review.typo3.org/57470 Tested-by:
-
Daniel Siepmann authored
Releases: master, 8.7, 7.6 Resolves: #85473 Change-Id: Ic0ac284bb8f02c7275e17bde67e79bb20a7fd919 Reviewed-on: https://review.typo3.org/57462 Tested-by:
-
- Jul 04, 2018
-
-
Roberto Presedo authored
Resolves: #78592 Releases: master, 8.7 Change-Id: Ia7b3a25f6af61fce5376a68c1188c9564d603a23 Reviewed-on: https://review.typo3.org/57320 Tested-by:
Fabien Udriot <fabien.udriot@ecodev.ch> Tested-by:
Robert Vierke <robert.vierke+typo3@gmail.com> Reviewed-by:
Maik Peuser <maik.peuser@verdure.de> Reviewed-by:
-
Nicole Cordes authored
If an extension and its dependencies get installed, the whole database needs to be updated instead of executing each extensions SQL on its own. Resolves: #79094 Releases: master, 8.7 Change-Id: I9a870e0efb6af241eeae563adbaa14af100edaec Reviewed-on: https://review.typo3.org/57429 Tested-by:
-
Christian Kuhn authored
This is one patch in the 'stabilize acceptance tests' again mission. It changes various details in the Cest files. At the same time changes within typo3/testing-framework and the bamboo test execution are prepared, the version bumps for those will follow with single patches later. Resolves: #85470 Releases: master Change-Id: I6ebe2499337e075f818b2726886ed02d743bb144 Reviewed-on: https://review.typo3.org/57460 Tested-by:
Michael Bodnarchuk <davert.ua@gmail.com> Tested-by:
-
Mathias Brodala authored
Resolves: #85459 Releases: master, 8.7 Change-Id: I1732782fa920ffa0f7bfd42016a45ac6437bff0a Reviewed-on: https://review.typo3.org/57453 Reviewed-by:
Karavas Aristeidis <aristeidis.karavas@gmail.com> Tested-by:
-
- Jul 03, 2018
-
-
Andreas Fernandez authored
Due to a wrong change on the template container, the extension scanner broke. This change recovers the functionality. Resolves: #85464 Related: #85455 Releases: master Change-Id: I3c62e89c59f0424e5381b485f7a11319a303296c Reviewed-on: https://review.typo3.org/57456 Tested-by:
-
