- Sep 19, 2022
-
-
Benni Mack authored
The three legacy hooks * $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['cms/layout/class.tx_cms_layout.php']['record_is_used'] * $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS'][PageLayoutView::class]['modifyQuery'] * $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['cms/layout/class.tx_cms_layout.php']['tt_content_drawItem'] are replaced by new PSR-14 Events: * TYPO3\CMS\Backend\View\Event\IsContentUsedOnPageLayoutEvent * TYPO3\CMS\Backend\View\Event\ModifyDatabaseQueryForContentEvent * TYPO3\CMS\Backend\View\Event\PageContentPreviewRenderingEvent Additionally, the hooks * $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['cms/layout/class.tx_cms_layout.php']['list_type_Info'] * $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['cms/layout/class.tx_cms_layout.php']['tt_content_drawFooter'] are removed as the same functionality can be achieved with the existing PreviewRenderer functionality since TYPO3 v10. The previous "main class" PageLayoutView is now removed (was marked as internal) along with the interfaces for the removed hooks * TYPO3\CMS\Backend\View\PageLayoutViewDrawFooterHookInterface * TYPO3\CMS\Backend\View\PageLayoutViewDrawItemHookInterface Resolves: #98375 Releases: main Change-Id: Iac4a76dce934de31c9749076d8054ae83ac45edb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75778 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Oliver Hader authored
This change addresses several "undefined array key" issues that have been identified by PsalmPHP (see issue #98321). Resolves: #98347 Related: #98321 Releases: main, 11.5 Change-Id: Ibca701d77324a4b2fe1d4a416deba5758d1ebde2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75732 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Hader authored
This change addresses several "undefined array key" issues that have been identified by PsalmPHP (see issue #98321). Resolves: #98329 Releases: main, 11.5 Change-Id: Ia348a8dec1590b641c7ed90247afac29ef43e2af Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75687 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Susanne Moog <look@susi.dev> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Susanne Moog <look@susi.dev> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Benjamin Franzke authored
CodeMirror v6 is a major rewrite of CodeMirror v5. Existing addons and language parsers need to be rewritten. There is a compatibility layer for parsers though, which we use for our TypoScript parser (which itself is based on an old CodeMirror javascript parser). A migration to a grammar based lexer (based on codemirror @lezer infrastructure) would be desirable in future. The TypoScript code completion code is adapted via a small shim that calculates the line-oriented token-state from the CodeMirror v6 syntax tree. Rewriting the code completer (which also parses the object structure) has not been an option, without also rewriting the TypoScript syntax highlighter. Ideally, both the parser and the code completion would be based on a modern lezer grammar based parser, allowing to perform code completion on a proper TypoScript syntax tree. CodeMirror v6 is authored as ES6 modules and can therefore be integrated into our JavaScript importmap infrastructure, without bundling. Note that also JavaScript invoke instruction for exported functions are adapted to allow for empty invoke() JavaScriptModule instructions to call exported functions as plain function without a `this`-context. Exported methods must not be called with the ES6 module passed as this-value/context, as that is forbidden for ES6 module exports: `JavaScriptModuleInstruction->create('@my/module.js', 'myExport')->invoke()` instead of `JavaScriptModuleInstruction->create('@my/module.js')->invoke('myExport')`. This is needed to be able to use JavaScriptModuleInstruction's for CodeMirror v6 function exports. Commands executed: npm remove codemirror npm install \ @lezer/common \ @lezer/lr \ @codemirror/autocomplete \ @codemirror/commands \ @codemirror/language \ @codemirror/lint \ @codemirror/search \ @codemirror/state \ @codemirror/view \ @codemirror/lang-css \ @codemirror/lang-html \ @codemirror/lang-javascript \ @codemirror/lang-json \ @codemirror/lang-php \ @codemirror/lang-sql \ @codemirror/lang-xml \ @codemirror/theme-one-dark npm run build Releases: main Resolves: #96575 Related: #96323 Change-Id: If4a323289144a1212b6fd93ebedd122a62b8052c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/73466 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Benjamin Franzke <bfr@qbus.de> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Benjamin Franzke <bfr@qbus.de>
-
- Sep 18, 2022
-
-
Christian Kuhn authored
Views should be data sinks, but not data sources: In Fluid, RenderingContext is the main state object used to carry rendering related state. As such, StandaloneView should not provide getter methods to retrieve state after it has been set: They could be misused to "park" state, which is a sign of bad architecture since only controllers should keep track, carry and update such state. The patch deprecates offending methods in StandaloveView. Change-Id: Id5c5fc2826b23c258b0f94aedbb0c5e75904e2db Resolves: #98371 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75773 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
Christian Kuhn authored
The Extbase Request has been turned into a PSR-7 decorator in v11. Most interface changes have not been enforced in v11 though, since that would have been breaking at this point in the release cycle. With v12, we can now activate the RequestInterface changes. The patch does this, and migrates the "setX()" that violate PSR-7 request immutability towards their 'withX()' counterparts which create new objects. The patch adds quite a bit of syntactic sugar to consuming classes: core phpstan is significantly more happy and extbase extension devs benefit from improved type hints and interface coverage. Change-Id: I111be724fd4e5d6dc9b1305efa31b7c90952730e Resolves: #98370 Related: #94428 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75749 Tested-by:
Lina Wolf <112@linawolf.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
linawolf authored
With https://review.typo3.org/c/Packages/TYPO3.CMS/+/75655 the `AbstractPlugin` was made internal. Option `_DEFAULT_PI_VARS` was only used in the `AbstractPlugin` and can therefore be removed from the TypoScript API. Additionally `_LOCAL_LANG.[lang-key].[label-key]` now only works for Extbase plugins, the description needs to be adjusted. Releases: main Resolves: #98369 Change-Id: I2cf71542f02b5637e8bcf782843e7baa0cb54acd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75772 Reviewed-by:
Chris Müller <typo3@krue.ml> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Lina Wolf <112@linawolf.de> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Lina Wolf <112@linawolf.de>
-
Stefan Bürk authored
This change ensure guarded array key access to avoid corresponding native PHP undefined array key access warnings in `getPageAndRootline` of class `\TYPO3\CMS\Frontend\Controller\TypoScriptFrontendController`. Resolves: #98352 Releases: main, 11.5 Change-Id: Ieefccd94ae3a2d0f6dc1ff198febf898d21f048f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75746 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de>
-
Stefan Bürk authored
Resolves: #98317 Releases: main, 11.5 Change-Id: I4fc1cbd52dda8a9440a6256a5e61be7d89323232 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75748 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de>
-
- Sep 17, 2022
-
-
Christian Kuhn authored
Single FE content objects (TEXT, IMAGE, ...) always receive the PSR-7 request since v11: Instances are created via ContentObjectFactory, which takes care setRequest() is always called after instantiation. As such, single objects can rely on $this->request being set, the property shouldn't be nullable. Declaring the property non-nullable will trigger a fatal PHP "must not be accessed before initialization" error in case setRequest() hasn't been called, which indicates an API misuse. The patch hardens this property. Resolves: #98367 Related: #92984 Releases: main Change-Id: If1668e5de7adf790ccd614aab1b8caef31a7c22c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75747 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Benjamin Franzke <bfr@qbus.de> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
- Sep 16, 2022
-
-
Christian Kuhn authored
The patch rewrites TypoScript related code that uses the comment based TypoScript configuration magic towards the new parser: Most notably the Template "Constant Editor" and the install tool extension configuration settings. On a parser level, these parts are established: The LosslessTokenizer already creates line objects for comments, so nothing has to happen here. The AstBuilder however simply ignores comment lines. This is kept for performance reasons in the frontend. Instead, the second CommentAwareAstBuilder is established which attaches comment lines to nodes. A dedicated include tree visitor is used to feed this builder. With comments being attached to AST, an AST visitor is used to parse comments for these nasty category, sub catogory and type details. It creates a structure that can be used for rendering easily. The main part of the patch are usages of this structure: The ext:tstemplate ConstantEditorController is a full rework, the InfoModifyController is modernized along the way, and the Template Analyzer now shows comments (again). The ext:install 'extension configuration' gets a rework that uses the AST builder comment visitor as well. Other than that, it does not share code with the constant editor, which should simplify future refactorings. Some side code in ext:info and ext:t3editor is adapted to further reduce usages of old TypoScript parser logic. This dissolves a series of snafu classes: * The awful ExtendedTemplateService is gone (yay). This drops a ton of state and a huge amount of HTML creation within PHP classes. * The TypoScriptsConstantsViewHelper is turned into fluid templating, it has been used by ext:install only. * ext:core ConstantConfigurationParser is basically the new AST visitor. * ext:install ExtensionConfigurationService is simplified and inlined to SettingsController. Resolves: #98357 Related: #97816 Releases: main Change-Id: I122d02d68e150942ecb1ffed3e8c5ddbe4ebc03e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75737 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Andreas Fernandez authored
The live search located at the top right side of the TYPO3 backend now uses a modal window to render the search controls and the results. As more space is now available, the amount of search results is increased to 50 records per search. The modal may be opened via a keyboard shortcut by pressing the Shift key twice in a row. Resolves: #98348 Releases: main Change-Id: I84072cda634bc0a60a17326540905f7f468cf36c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75699 Tested-by:
Benjamin Kott <benjamin.kott@outlook.com> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Tested-by:
Jonas Eberle <flightvision@googlemail.com> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Benjamin Kott <benjamin.kott@outlook.com> Reviewed-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de>
-
Christian Kuhn authored
Casual raise of typo3/cms-styleguide and typo3/testing-framework to latest dev versions in main. > composer u --dev typo3/cms-styleguide typo3/testing-framework Resolves: #98365 Releases: main Change-Id: I00c2a4d07b67a3f7ad952b9f94fbed59735f7b9f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75745 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Nikita Hovratov authored
In case an inline field doesn't define the "disabled" column in its "showitem" list, a hidden checkbox is now rendered in the expanded state. This is the same checkbox, which is rendered, when the inline item is initially visited in the collapsed state. Resolves: #98353 Releases: main, 11.5 Change-Id: I9b8b65c359f34aff9c6bad64e0d7b0870cbd259d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75734 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
Andreas Fernandez authored
If no size is explicitly given, the avatar size is based on the text size, similar to icons. In the SetupModuleController, this lead to an itty bitty small avatar image. This fix discovered a CSS bug where the avatar classes used the wrong CSS variables for sizing. Resolves: #98364 Releases: main Change-Id: I5c202f08ae08c23533087c9b8e70a1bd04fdb71c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75744 Tested-by:
Benjamin Kott <benjamin.kott@outlook.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Benjamin Kott <benjamin.kott@outlook.com> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de>
-
Guido Schmechel authored
The flash messages for the executed state and the not executed state have been adapted to the previous flash messages. Resolves: #98327 Releases: main, 11.5 Change-Id: I4b386f76232e6b4de550057509ee2239b4a37728 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75686 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Jonas Eberle authored
This outputs a "bell" character to notify the developer that the "watch" task has picked up and finished compilation of changes. "bell" is meant to draw user attention and modern developer-oriented terminals usually implement it by flashing the title bar or showing a notification. The action is usually configurable in the terminal settings. This is basically https://www.npmjs.com/package/grunt-bell. Resolves: #98326 Releases: main Change-Id: Ia462fcd6ba2a24c56332b481895e29be02a1771f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75685 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
Daniel Siepmann authored
Resolves: #98337 Releases: main, 11.5 Change-Id: I048defb5d96c4365a2005a5a2c0adae806b3e298 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75697 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
linawolf authored
`\TYPO3\CMS\Frontend\Plugin\AbstractPlugin` is not a recommended way of developing Frontend Plugins anymore. As long as it is neither deprecated nor internal we cannot remove it from the documentation. Also, it is one of the features that let TYPO3 appear outdated. There are still several non-Extbase plugins that base on `AbstractPlugin`. However, in most cases, the same result can be achieved by removing `AbstractPlugin` as parent class. In the rare case where functionality of `AbstractPlugin` is still used, those methods can be copied into the affected plugin. Releases: main Resolves: #98281 Change-Id: I22e9bc2784f6bc0feaf38a4be1e7e1461f025620 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75655 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Thomas Löffler <loeffler@spooner-web.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
Torben Hansen authored
The doc comments for some functions in `\TYPO3\CMS\Core\Database\Connection` state, that table expressions and columns are not escaped. This is actually not true and it seems those doc comments have been adopted directly from `doctrine/dbal` back in 2016, when Doctrine DBAL was introduced to TYPO3. Resolves: #98318 Releases: main, 11.5, 10.4 Change-Id: If23d568b23ef1b3c6f40efd50e907af54c349b3d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75681 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Thomas Löffler <loeffler@spooner-web.de> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Oliver Klee authored
`GeneralUtility::flushInternalRuntimeCaches` now also flushes the caches used by `makeInstance` to determine the final class name for instantiating classes. This allows unit tests to test that classes can be XCLASSed without the dummy XCLASS configuration spilling over into the next unit test. Resolves: #98346 Releases: main, 11.5, 10.4 Change-Id: Iea1d85231c5b51bb743f48ab018340997e39c3d3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75731 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Marc Willmann authored
Circumvent 'Unitialized string offset' error when trying to prefix the url of a page from type 'external page' when field 'url' is not set. Resolves: #98344 Releases: main, 11.5 Change-Id: I9ff73556caa8c796b81cd25c0e0ec926da1a6a84 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75730 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Kevin Appelt <kevin.appelt@icloud.com> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stefan Bürk <stefan@buerk.tech>
-
Daniel Siepmann authored
Resolves: #98361 Releases: main, 11.5 Change-Id: Ib94267b45199a5cf5cce3fa48df51e53cff9a256 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75741 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Daniel Siepmann authored
Resolves: #98359 Releases: main, 11.5 Change-Id: I2651ca3b0c5bbad93fc931134d2d2480d51f7af6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75739 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Oliver Hader authored
Instead of creating new database queries for each user group, corresponding items are fetched in just one query. Resolves: #98356 Releases: main, 11.5 Change-Id: I84a6304e4d82b36e01d8b7a1f203aafa38e32d6e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75736 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Kevin Appelt authored
Resolves: #98232 Releases: main, 11.5 Change-Id: I8c1277a1d9b611785c6c852069d976033abda813 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75592 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Torben Hansen authored
In ext:viewpage, jQuery UI resizable is used to allow an editor to resize the iframe with the page preview. The fluid template includes a customized jQuery UI theme, which is superfluous and can be removed, since CSS classes required by the jquery-ui-resizable component have been added to backend.css with #90437 This change removed the custom jQuery UI theme from ext:viewpage. Resolves: #98345 Releases: main Change-Id: I9ba9b9418964c4e97a8bff460d2dd525d4b2c450 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75729 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de>
-
Markus Klein authored
The documentation clearly states that the Testing application context may only be used internally. This information is now also added to the code. Resolves: #98341 Releases: main, 11.5 Change-Id: Icf28c2962b08f6bff0fd5777f01a590cb1af89b3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75725 Tested-by:
Johannes Kasberger <johannes.kasberger@reelworx.at> Tested-by:
Kevin Appelt <kevin.appelt@icloud.com> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Johannes Kasberger <johannes.kasberger@reelworx.at> Reviewed-by:
Kevin Appelt <kevin.appelt@icloud.com> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Daniel Siepmann authored
Resolves: #98358 Releases: main, 11.5 Change-Id: I4f1080dc4308660eff99c3a70a35c3917d688ab6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75738 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
Benjamin Kott authored
The core currently uses a wide range of state colors across the backend. This is a mixture of defined colors for specific areas and the global usage of the Bootstrap 5 theme colors. The current state is a mixture of vibrant and faded colors. The current implementation results in false calculated contrast colors for certain areas. To resolve this we are now unifying all used colors across the backend and streamline the text color contrast calculation. That needed several cleanups across the backend regarding markup and CSS styles. The result is a more harmonized look and feel of the Backend. Affected areas are: - Alerts - Badges - Buttons - Callouts - Panels - Modals - Tables Resolves: #98349 Releases: main Change-Id: I4311e35bc9e1dcebb8cca9e2af26c86735656155 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75692 Tested-by:
Frank Nägler <frank.naegler@typo3.com> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Frank Nägler <frank.naegler@typo3.com> Reviewed-by:
Benni Mack <benni@typo3.org>
-
Andreas Fernandez authored
In #98288 the modal component was rewritten to be a lit element. The modal title was defined by a `title` attribute. However, using this attribute has the side effect that a tooltip is rendered wherever the cursor is positioned. Unfortunately, this behavior cannot get disabled in browsers. To circumvent this issue, the attribute is now renamed to `modalTitle`. Resolves: #98355 Related: #98288 Releases: main Change-Id: I585bfb7c69376e8a38f85e48393625d16235b31c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75735 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Benni Mack <benni@typo3.org>
-
- Sep 15, 2022
-
-
Susanne Moog authored
This change allows the injection of the fluid RenderingContextFactory while disallowing the direct injection of the RenderingContext. Resolves: #98351 Related: #96271 Releases: main Change-Id: Ia1ec782581dfc56fca86cf62cb506624b5f80bcc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75733 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benjamin Franzke <bfr@qbus.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Benjamin Franzke <bfr@qbus.de>
-
linawolf authored
I added and improved non-trivial method descriptions from the Changelog descriptions here: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75158 to the source code. This also eases usage for Coders who use the code as documentation. Some parts of the class comments were also improved. Releases: main Resolves: #98298 Change-Id: Ia6902c0a1699aa652ff5e7430c6ace06e50483f2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75662 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Lina Wolf <112@linawolf.de>
-
- Sep 13, 2022
-
-
Oliver Hader authored
see https://github.com/TYPO3/html-sanitizer/releases/tag/v2.0.16 composer req masterminds/html5:^2.7.6 typo3/html-sanitizer:^2.0.16 composer req masterminds/html5:^2.7.6 typo3/html-sanitizer:^2.0.16 \ -d typo3/sysext/core --no-update Resolves: #98340 Releases: main, 11.5, 10.4 Change-Id: I254ea25410e01f7610b0c4ef8b83441ab216f1ca Security-Bulletin: TYPO3-CORE-SA-2022-011 Security-References: CVE-2022-36020 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75720 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Hader authored
Variables in child nodes like `<f:asset.css>{value}</f:asset.css>` were not encoded and allow cross-site scripting. In case values shall be taken as is, corresponding `f:format.raw` instruction has to be used. Resolves: #97900 Releases: main, 11.5, 10.4 Change-Id: Id843a41c42bbe1f74cdc4efbc117b24d20026b97 Security-Bulletin: TYPO3-CORE-SA-2022-010 Security-References: CVE-2022-36108 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75719 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Hader authored
FileDumpController is used to expose stored files from the backend user interface through a corresponding service-side process. Since content-security-policy settings for files served directly by the web server won't be applied, FileDumpController has to take care. Resolves: #98221 Releases: main, 11.5, 10.4 Change-Id: I4fde10e48e33fa08452eddf876172f56b4f38e28 Security-Bulletin: TYPO3-CORE-SA-2022-009 Security-References: CVE-2022-36107 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75718 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Torben Hansen authored
When a TYPO3 backend user performs a password reset request, a password reset link including an expiration time is sent to the user. The expiration time is included in HMAC calculation of the saved password reset hash, but it is never evaluated if the expiration time is exceeded. This change adds the missing validity check for the expiration time included in the password reset link. Resolves: #97998 Releases: main, 11.5, 10.4 Change-Id: I8a1730faf6489e5c5eebb44ff4f82606785bd637 Security-Bulletin: TYPO3-CORE-SA-2022-008 Security-References: CVE-2022-36106 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75717 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Hader authored
Observing response time during user authentication can be used to distinguish between existing and non-existing user accounts. This change introduces `MimicServiceInterface::mimicAuthUser` - to be implemented by 3rd party authentication services - which simulates corresponding times regular processing would usually take. Resolves: #98217 Releases: main, 11.5, 10.4 Change-Id: I143ae0d3877dffe6f2decbb3f0cf8c9d9cb6ca0b Security-Bulletin: TYPO3-CORE-SA-2022-007 Security-References: CVE-2022-36105 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75716 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Hader authored
This fixes TYPO3-CORE-SA-2021-005 again, which accidentally had been removed during TYPO3 v11 development. An inaccessible error page amplified potential denial-of-service scenarios. Resolves: #97818 Releases: main, 11.5 Change-Id: Ia9c666731f70db5e0a60572cd008f1d0c541af37 Security-Bulletin: TYPO3-CORE-SA-2022-006 Security-References: CVE-2022-36104 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75715 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Hader authored
The changes applied for issue #93887 introduced a bunch of regressions, which were partially addressed. However, there are still much more issues related to cache handling that have been introduced by mentioned change. #97977: This reverts commit d3d8bc04 #98023: This reverts commit ccc9b433 #93887: This reverts commit 667346ae Resolves: #98336 Reverts: #97977 Reverts: #98023 Reverts: #93887 Releases: main, 11.5 Change-Id: I731069b7d2485bf1bd94e78ebe3e9500d2a752ea Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75694 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Elias Häußler <e.haeussler@familie-redlich.de> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Elias Häußler <e.haeussler@familie-redlich.de> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-