- Aug 06, 2020
-
-
Helmut Hummel authored
Only try to fetch translated uids for translated records, and provide is_siteroot field for slug helper, so that it can be checked if slug is generated for a site root. Resolves: #90736 Resolves: #89485 Releases: master, 10.4, 9.5 Change-Id: I707e5a1df2d06a81eea2dd491302b003d086e42a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65116 Tested-by:
TYPO3com <noreply@typo3.com> Tested-by:
Stefan Froemken <froemken@gmail.com> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
-
Christian Kuhn authored
Another 'broken since ever' fix: Sorting a record in workspaces by moving it 'after itself', the record vanishes from the interface. While this action is kinda useless, it can for instance accidently happen by an editor. As with other move operations in workspaces, a move placeholder and the versioned data record is created. In case of inserting after itself, the move placeholder state is not correctly updated - both pid and sorting values end up with 0. The records then no longer belong to the correct pid and are not 'seen' by workspaces. The patch fixes this case by making sure the pid and sorting determination of the move placeholder does not accidently operate on itself as reference record. A series of functional DataHandler tests nail the correct state for pages and tt_content in non-workspace and workspace scenarios. Resolves: #53619 Releases: master, 10.4 Change-Id: I39b5e9f72bd05645dcd429bed3833d2a792efaec Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65188 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Christian Kuhn authored
The row selection of records in JavaScript is not reset after execution of a publish action in the workspace module. If an editor tries to publish or disard another set of records without reloading the module, the already handled records from the first action are send again in the request payload, leading to server side exceptions. Resolves: #89927 Releases: master, 10.4 Change-Id: I8800c1df34fd749d84e63ea3e42c7b83513e1a38 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65185 Tested-by:
-
- Aug 05, 2020
-
-
Markus Klein authored
Use the proper check to avoid adding JS libs more than once. Resolves: #91653 Releases: master Change-Id: I3b750e6b2341681b45a722ae8ecfacb1d17243da Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64897 Reviewed-by:
Daniel Siepmann <coding@daniel-siepmann.de> Reviewed-by:
-
- Aug 04, 2020
-
-
Jigal van Hemert authored
The variable $crazyRecursionLimiter actually limits the number of subpages that are rendered for each page and not the depth of recursive calls to getTree(). This limit only affects the browsable pagetree in for example the link browser and not the pagetree in the navigation pane. Resolves: #91853 Releases: master, 10.4, 9.5 Change-Id: Ib2ff5471226217bc880ddee3b278771393a09354 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65083 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Richard Haeser <richard@maxserv.com> Reviewed-by:
-
Benni Mack authored
PropertyMapper (which is a singleton) previously created a new $messages instance every time "convert" was called. This works for most cases, however when using "getMessages()" only the last message was returned. It would be very useful to keep the messages in place until "resetMessages()" is called, which is used within each action of the Extbase controller validation to avoid some edge-case issues when using multiple actions on one request. Resolves: #70872 Releases: master Change-Id: I2fddc4261567cad2ebb12f91296ff3ec8d681ad8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65114 Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
-
Benni Mack authored
When fetching a frontenduser from the database, the constuctor is not called, but initializeObject is called. For this reason, the initialization of the FrontendUser happens on initializeObject() as well. Resolves: #83386 Releases: master, 10.4 Change-Id: I72e39b6485a4a072b7b94f96f947151222d68089 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65177 Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
Stephan Großberndt authored
This patch adds the directory `typo3conf/sites/` and for composer based installs `config/sites/` to the directory status check in the install tool. Resolves: #91488 Releases: master, 10.4 Change-Id: I059c92d7ec2d740ba3f7d3c5d81181cadc146681 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64577 Tested-by:
Daniel Haupt <mail@danielhaupt.de> Reviewed-by:
-
Benni Mack authored
When deleting a page with records an editor does not have access to, the error message "Attempt to delete records from disallowed tables" is shown which does not give a hint to the editor what tables are an issue. This change improves the error message to show the tables that are prohibited. Resolves: #55307 Releases: master, 10.4 Change-Id: Ibe451e7042b9832815e2d4a26104e06adc94656d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65175 Tested-by:
-
Kevin Ditscheid authored
Prevents a non-numeric value warning in ErrorHandler.php by casting the value given to the parameter of the constructor to an int. Resolves: #91930 Releases: master, 10.4, 9.5 Change-Id: I000596ee0bdf8599a2eadea5216286971a94c806 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65182 Reviewed-by:
-
Kevin Ditscheid authored
This commit prevents a warning regarding a non-numeric value in the phpErrorCode argument of the PhpErrorCodeViewHelper. TYPO3 Fluid is actually not converting the value to int, and there could be anything incoming as parameter. Resolves: #91929 Releases: master, 10.4, 9.5 Change-Id: I3514004829f97849b9fb6f16b07f9ffb53679f87 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65181 Reviewed-by:
-
Martin Bless authored
Update Settings.cfg to current standards. Releases: master Resolves: #91765 Change-Id: I868f4823ff4d5dbb837e209e71836cbf1b77af4f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65004 Tested-by:
-
Benni Mack authored
The sys_template.sitetitle field has been deprecated in v10 and is superseded by title handling of site configuration. The patch removes handling and db field. Resolves: #91927 Related: #91473 Releases: master Change-Id: I14f034193a31b7fdb0c37aeca9a485060843cefc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64618 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
-
Markus Klein authored
The core version check is run synchronously while logging into the Backend. If the get.typo3.org service is down, logins take extremely long. Since there is no API to run this check asynchronously, the patch drops this information from the toolbar, it is only available in the reports module. Resolves: #91507 Related: #84549 Releases: master, 10.4, 9.5 Change-Id: I78fd381df1aff6a40cc9bd57ac5a4babed2ec999 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64904 Tested-by:
Simon Gilli <typo3@gilbertsoft.org> Tested-by:
-
Jan Delius authored
This patch correctly applies the already configured and documented sender address for the recovery email. Resolves: #91923 Releases: master, 10.4 Change-Id: I48f6959bbca7ae9d9572a48b8948de2de8d0550c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65176 Tested-by:
Jan Delius <me@jandelius.eu> Tested-by:
falcop <falco.preusche@live.de> Tested-by:
Rico Drexler <rico.drexler@gmx.de> Reviewed-by:
-
Christian Kuhn authored
composer require --dev typo3/testing-framework ^6.3.3 Mostly brings a bugfix of the functional test splitter, relevant for bamboo but relevant and v10, and a deprecation removal preparation for master. Change-Id: I0de875483ba0997f91071242b4d4aa5f9c1398e6 Resolves: #91926 Releases: master, 10.4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65179 Tested-by:
-
- Aug 03, 2020
-
-
Benni Mack authored
The information in the sys_file_storage record created automatically should not be persisted as "auto-created" as 90% of the people do not modify this, and it is only confusing to see this information in the filelist without having a good and explained way to change this. Instead "fileadmin" (taken from $GLOBALS['TYPO3_CONF_VARS']['BE']['fileadminDir']) is used when creating the default storage. This was originally added by myself when introducing FAL in 6.0, and never touched, however feedback from newcomers shows that this should be adapted. Resolves: #91921 Releases: master Change-Id: I675ef7818aa6a83191574131f54c1c2b6f490e41 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65151 Tested-by:
-
Benni Mack authored
The information in the dropdown of the page module "Make new translation of this page" is not very common across native-english speakers, instead the label should be called "Create a new translation of this page". Resolves: #91922 Releases: master, 10.4 Change-Id: Ifa27090741d73ba363e112a8d5f5cdaa23638bcf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65172 Tested-by:
-
Benni Mack authored
The patch drops handling and existence of two further workspaces related db fields: * t3ver_tstamp has been occassionally set to 'now' when records in a workspaces were edited. However, the field was never displayed in the backend and is of little use since it only holds only a 'last' value. A change history on workspace records is available through the 'info' button in the workspace module. This is powered by sys_history and shows modifications with date/time. * t3ver_count is also never rendered in the backend. It has been used in the (non-default) 'swap' workspace actions where live records become the new workspace records. The field was then incremented by one. The loose wording around that is, it's an 'archived' record. However, if swapping a second time, the workspace record does not count two as one would expect, but still one. Only after another swap, the workspace record would have the value two in this field. Together with the fact this field has never been shown/used, the weird behavior, and that swapping is an uncommon case that needs to be explicitely enabled and used, the field is dropped now. Resolves: #89137 Releases: master Change-Id: I7cdfe6e867c14462395d7398123b14464835c1bf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65145 Tested-by:
-
Benni Mack authored
A new TER Extension "legacy_collections" has been added to FriendsOfTYPO3 which contains DB tables and TCA definitions for "sys_collection" and its MM relation table. The functionality was originally intended with the introduction of taxonomy and FAL File relations (which are stored in sys_file_collection) to be used as a generic TCA store for collections, which was never picked up in the past 8 years. A personal survey of several installations showed that almost none of the TYPO3 instances have the database tables filled, making this unneeded code and database code, for only a handful of people. Instead of providing the database tables by default in all installations, the database tables and their TCA definitions are now available in a separate extension "legacy_collections", which serves as a drop-in replacement for everybody who needs this API and the database tables. An update wizard checks if the sys_collection database table is filled, and allows to install this extension. The new extension is compatible with TYPO3 v10, so it should ease the migration path. Resolves: #91909 Releases: master Change-Id: I85d53cc7969f9f9ce93311dd483be31735bf8c05 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65147 Tested-by:
-
Anja Leichsenring authored
Language handling always bases on the existence of a page version for the requested language. If this is not available, handling follows fallback settings. Functional Tests that test for translated content to be returned as expected must provide such a translated page on their own, else the fallback handling kicks in, renders the test falsly reassuring. Resolves: #91905 Releases: master, 10.4, 9.5 Change-Id: I77d1e096cd0e62134ffd818f8bd32667e566d44a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65146 Tested-by:
-
- Jul 31, 2020
-
-
otherpaco authored
The example of how to use the FormProtectionFactory in frontend context uses non-matching arguments making the whole code example harder to understand. This patch adjusts the ReST document to use the same arguments in validateToken() as in generateToken() to make the connection to these methods more clear. Releases: master, 10.4, 9.5 Resolves: #91895 Change-Id: Ie1cff9df38295c08926699af29b4698e1f49d47e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65142 Tested-by:
-
Anja Leichsenring authored
The added styles avoid icons to be rendered too big to properly serve as icons. Resolves: #91868 Releases: master, 10.4 Change-Id: I49e24e6906668a270f23a8f820fb1c116e8d323f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65113 Tested-by:
-
Anja Leichsenring authored
The TCA ctrl transOrigDiffSourceField database field, often called 'l18n_diffsource', stores information if a default or source language record of a translated record has been changed. This is used to hint editors with "The record you translated from has been changed, maybe an update of the translation is needed" in FormEngine. The storage format of that field is a serialized PHP string. This is no active, but a potential, general security risk. To mitigate this, the storage format is changed to a json string with the patch, including an install tool database updater taking care of existing rows. Resolves: #91906 Releases: master Change-Id: Ib7e2a6128730eebd941ec8a565e72fd7a05d225d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65068 Tested-by:
-
Christian Kuhn authored
Deleting a sys_workspace record currently fetches all live records as to-delete candidates while only records of the according workspace should be considered. Luckily, a check at a later point prevents live records from being deleted, though. The huge amount of records however stresses DataHandler and database a lot. This is a regression of the 'pid -1 gone' patch from a broken database restriction. The patch fixes the where clause and adds a functional test to verify correct records are deleted. Two todos in the test csv mark inconsistent details, those could be handled with a different patch that should review and increase test scenario coverage of version_WSID() first. Resolves: #91881 Related: #89555 Releases: master, 10.4 Change-Id: I6e1edcb3a91dbbb3104ff5656e71cc0f12bf4f1c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65136 Tested-by:
-
Daniel Siepmann authored
As data is fetched from database, it might not be of proper types, e.g. when using sqlite. Therefore ensure returned value is of expected type. Resolves: #91894 Releases: master, 10.4, 9.5 Change-Id: Ie7fefafa8978c0a01755a8e7c749ed7010697f8d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65139 Tested-by:
-
Michael Telgkamp authored
When collapsing or expanding all nodes of a category tree the script tried to change attributes of non existing DOM nodes. This is not required, so there is a check if the node exists. On node generation the correct attributes are set for the node. Resolves: #91779 Releases: master, 10.4 Change-Id: I21b820bbd7bd211f0e30e880e978415391344df1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65065 Tested-by:
-
- Jul 30, 2020
-
-
Andreas Fernandez authored
To improve the event handling in the browsers, events that don't need to listen to `document` have been restructured to listen either directly on an element or to their respective nearest common element instead. To increase UX, an event listener has been removed from Topbar which closes the whole overlay when closing a sub menu in mobile view. Another, redundant event listener has been removed as well. As a drive-by bugfix the mouse cursor position used for context menus is now fetched and stored every 50ms only. In a later iteration this behavior may change completely. Resolves: #91642 Releases: master Change-Id: I7650828e0bc29a298cdaeb7c7bdfd0c1720818d8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64875 Tested-by:
-
Andreas Fernandez authored
A new condition is added to the `CreateSiteConfiguration` DataHandler hook which avoids the creation of a new site configuration for localizations of root pages. Resolves: #91845 Releases: master, 10.4 Change-Id: Ic51ba62600f4304920b66afe53b66e598404a104 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65091 Tested-by:
-
Benni Mack authored
The about system extension is responsible for the log-in screen (if EXT:dashboard is not installed), and despite having just one single controller, EXT:backend is depending on the extension / module when EXT:dashboard is not installed. To help newcomers reduce the number of (from their PoV) extensions that need to be installed via composer, or need to be upgraded, this package is moved into EXT:backend. Resolves: #91888 Releases: master Change-Id: I3e37ba9d9dbc850d1ae0f2c7b345e3526d35029d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65036 Tested-by:
-
- Jul 29, 2020
-
-
Christian Kuhn authored
Selecting a page and records on the page to be discarded in the workspace module can lead to log entries that records could not be deleted. This can happen when discarding (deleting) a page that only exists in the workspace already has deleted records on the page. The explicit call to delete single records then creates this log. The solution is to ask the DataHandler if the record in question has already been deleted to avoid deletion in this case. Additionally, the log entry now contains the table:uid to make it more useful in case it pops up again. Resolves: #61719 Releases: master, 10.4 Change-Id: I8fee34fad2484e9e656bcb5ff611a91374127d94 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65132 Reviewed-by:
Daniel Goerz <daniel.goerz@posteo.de> Tested-by:
-
Christian Kuhn authored
Discarding records in the workspace module may lead to 'You do not have edit access' log entries. The issue is hard to reproduce without the table name and uid in the log. The patch changes the log entry to contain this info. This is similar to the log entry change for issue #61719. Resolves: #69310 Related: #61719 Related: #91881 Releases: master, 10.4 Change-Id: I0da0d13cb6be193f17835bedc1027dbf6559a796 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65135 Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
-
Anja Leichsenring authored
Per convention, extbase controllers define first fields, then inject methods, then initialize methods. All other functions follow behind. In order to ease reading in this big class, the lost order following this convention is restored. Resolves: #91877 Relates: #89554 Releases: master, 10.4 Change-Id: I7b4e0f16e0c5266d3d6ed93952f929deb3b5cc6c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65121 Tested-by:
-
- Jul 28, 2020
-
-
Oliver Hader authored
Cryptographic hashes being calculated from and for query parameters must only be used for a specific use-case or scope in order to avoid resulting hashes being ambiguous. Resolves: #91689 Releases: master, 10.4, 9.5 Change-Id: I59ca16fe71e27195b98a822607aab564425d248d Security-Bulletin: TYPO3-CORE-SA-2020-008 Security-References: CVE-2020-15098 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65127 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Oliver Hader authored
The file deny pattern is applied to public eID API to mitigate the possibility to retrieve configuration stored in PHP files (like for instance typo3conf/LocalConfiguration.php). Resolves: #91754 Releases: master, 10.4, 9.5 Change-Id: Iaba30dcf9c7c90e2d78507c6c72a420ea53198a1 Security-Bulletin: TYPO3-CORE-SA-2020-007 Security-References: CVE-2020-15099 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65126 Tested-by:
-
- Jul 27, 2020
-
-
Anja Leichsenring authored
The extensionScannerRstFileReferences check expects rstFiles listed in first level of the configuration array. ConstructorArgumentMatcher puts them in the second level. Thus, no files are found during the check, indicated by PHP warnings. The rstFiles given to ConstructorArgumentMatcher have never been checked due to this incompatibility. Resolves: #91866 Relates: #90722 Releases: master, 10.4, 9.5 Change-Id: I36abbef7e1eb5af372a8655d4a3d593f298fa404 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65089 Tested-by:
-
Andreas Fernandez authored
This patch removes a lot of either unused or superfluous CSS code. Some stuff seems to have travelled in time to stay present, e.g. a star hack for IE or code affecting ExtJS which was removed in v9. The class `form-field-inputlink-explanation` was in use but has been removed nevertheless as it had no effect since we have Bootstrap in place. Resolves: #91867 Releases: master, 10.4 Change-Id: Idc2dd3fa46d393024abce80b46f796f3de867ee2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65112 Tested-by:
-
Benni Mack authored
ObjectManager is not used anymore in ExtensionManager, except for e.g. Controllers and Repository logic. Resolves: #91799 Releases: master Change-Id: I7ac2bb32ee9e2f27850137107f308003f75baa45 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64789 Tested-by:
-
Torben Hansen authored
Remove an outdated reference to the user agent in the description of [FE][lockIP] and [FE][lockIPv6]. Session locking is not based on the user agent anymore. Resolves: #91869 Releases: master, 10.4, 9.5 Change-Id: I4f5f5e42571ef02fff78d6e2cc3511b0a42e719e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65115 Tested-by:
-
Stephan Großberndt authored
This patch fixes the SQL query retrieving the failed login attempts which was broken due to a missing GROUP BY statement on PostgreSQL and MySQL when using strict mode. Additionally the performance has been improved by reversing the order of query executions: The failed attempts are now only retrieved if more than $max allowed failures have been recorded. Resolves: #91649 Releases: master, 10.4, 9.5 Change-Id: I1778e74cd4fc820d7fd330794b61f068babb9206 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64899 Tested-by:
Helmut Hummel <typo3@helhum.io> Reviewed-by:
Xavier Perseguers <xavier@typo3.org> Reviewed-by:
-
