- Oct 08, 2024
-
-
Oliver Hader authored
Change-Id: I7b8b1e8b1e0a87d24daeb904bf16922693dd8f2c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86504 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Hader authored
Backend users were able see page tree items without having access: - in case no DB mounts were configured for a particular user and page permissions configured to allow "everybody" - in case DB mounts were pointing to pages, but actually not having any permission configured for these pages (user/group/everybody) It was not possible to manipulate any of the affected pages. Resolves: #104397 Releases: main, 13.3, 12.4, 11.5 Change-Id: I52079c8cef3d78946083403adb23a3e1a706c652 Security-Bulletin: TYPO3-CORE-SA-2024-012 Security-References: CVE-2024-47780 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86495 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Hader authored
Resolves: #104343 Releases: main, 13.3, 12.4, 11.5 Change-Id: Ie9cd7bec43782282a142ad0911029579442734fd Security-Bulletin: TYPO3-CORE-SA-2024-011 Security-References: CVE-2024-34537 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86494 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Sven Jürgens authored
The API code snippet is related to 'DatePicker' and not to 'AdvancedPassword', probably due to a copy&paste mistake. Releases: main, 12.4, 11.5 Resolves: #105207 Change-Id: Icb57f4f053c8ce86e093bcdfd0f836145c692602 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86474 Tested-by:
Garvin Hicking <gh@faktor-e.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Garvin Hicking <gh@faktor-e.de>
-
- Oct 05, 2024
-
-
Benjamin Franzke authored
Uses correct `base` and `locale` assignments in site configuration. Resolves: #105202 Releases: main, 12.4, 11.5 Change-Id: I872a61574f5858fd6b6269bb829bbdb43f2a56eb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86428 Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Oliver Hader <oliver.hader@typo3.org>
-
- Oct 01, 2024
-
-
SZChimp authored
The extra comma documented in the query will result in invalid SQL syntax, and has now been fixed. Releases: main, 12.4, 11.5 Resolves: #105168 Change-Id: I2241b2eb00c5f61875a940a77ddbb83e4ff212f7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86324 Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Garvin Hicking <gh@faktor-e.de> Tested-by:
Garvin Hicking <gh@faktor-e.de>
-
- Sep 30, 2024
-
-
Benjamin Franzke authored
We can not deprecate a constant and use it at the same time. We basically traded a deprecated constant with a new deprecated constant. Therefore this intermediate constant (added without being released yet in #105155) is removed again and replaced by a plain value. It's too likely that this constant is used by 3rd party code (or dependencies like typo3/testing-framework), which then makes it hard to remove this constant again (despite being deprecated). Also defining an own constant – that looks like an official PHP constant – into the global space, has caused immediate confusions which we want to avoid by using a scalar value + comment. The reason (possible 3rd party extensions that may still trigger this error) why this is kept (and not just removed) is also added to all usages now. Releases: main, 12.4, 11.5 Resolves: #105165 Related: #105155 Change-Id: Ia7526c7d5027f2d0f91cddf4fb2967ef57e9526a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86384 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benjamin Franzke <ben@bnf.dev> Reviewed-by:
Benjamin Franzke <ben@bnf.dev>
-
- Sep 29, 2024
-
-
Stefan Bürk authored
Note that this change addresses three different issues, which need to be done in one step, otherwise none of isolated patches would get a +1 CI verification: * Alignment for changed `$escape` parameter handling of CSV related methods, which must be avoided with PHP versions below 8.4.0-beta5, but is required as of PHP 8.4.0-RC1. * This `$escape` issue needs to be addressed directly in the `typo3/testing-framework` and thus needs a raised dependency directly. * PHP 8.4.0.0-RC1 also deprecated the `E_STRICT` constant, which needs to be addressed directly. With [1] the `$escape` parameter for the following method calls * `str_getcsv()` * `fputcsv()` * `fgetcsv()` must be provided as a 1 character long value. Omitting and using the default value will emit a PHP deprecation [2] warning as of PHP 8.4.0-RC1, for example: str_getcsv(): the $escape parameter must be provided as its default value will change To mitigate this, PHP recommends following: It must be passed explicitly either positionally or via named arguments. This change adjusts all occurences (function calls) and ensures that the `$escape` parameter is explicitly provided via specifying all parameters up to that position and not using a `named arguments` approach for easier backporting. The TYPO3 testing framework also needs to be aligned to mitigate `fgetcsv()` issues, and is raised in the same step - otherwise none of these changes would get a green CI pipeline run. The following testing-framework updates are adjusted: * main: simple update `main` pointer * 12.4: Raise to tag `8.2.2` * 11.5: Raise to tag `6.16.10` Used command(s): > composer require --dev "typo3/testing-framework":"^6.16.10" Additionally, PHP 8.4.0-RC1 deprecated the `E_STRICT` constant, which now emits a E_DEPRECATED which leads to failed CI tests. This change introduces a core internal constant with the same integer value, and replaces usages with this constant to mitigate the E_DEPRECATION. This constant can then be dropped with TYPO3 v14, preventing a breaking change at this time. [3][4] [1] https://github.com/php/php-src/pull/15569 [2] https://github.com/php/php-src/blob/ebee8df27ed/UPGRADING#L617-L622 [3] https://github.com/php/php-src/blob/ebee8df27edf7/UPGRADING#L47-L49 [4] https://github.com/php/php-src/pull/13053 Resolves: #105155 Releases: main, 12.4, 11.5 Change-Id: Ie8b7d46eeb75ba6e32c0e8f6e7e947775083cc15 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86377 Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Garvin Hicking <gh@faktor-e.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Garvin Hicking <gh@faktor-e.de>
-
- Sep 19, 2024
-
-
Helmut Hummel authored
Otherwise the PHP object is transformed to an empty JS object instead of a string containing the actual URI Resolves: #105036 Releases: main, 12.4, 11.5 Change-Id: I083524291d5e86869e3989a4836d2321a133c36f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86186 Tested-by:
Garvin Hicking <gh@faktor-e.de> Tested-by:
Andreas Kienast <akienast@scripting-base.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Garvin Hicking <gh@faktor-e.de> Reviewed-by:
Andreas Kienast <akienast@scripting-base.de> (cherry picked from commit e7b35525) Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86213
-
- Sep 15, 2024
-
-
Ayke Halder authored
This makes FileClipboardCest check if the content-iframe is reloaded before clicking on a button to open a dropdown-menu. Before this change the button click and opening of the dropdown-menu did sporadically happen in the old iframe-content - and before the iframe-reload. As soon as the iframe reloads, the popup-menu is closed again. The subsequent click on a dropdown-menu-entry therefore fails. Resolves: #104714 Related: #104585 Related: #104702 Releases: main, 12.4, 11.5 Change-Id: Id7fd4d993ab563ab530e8c26f741a4ed0cbeb95d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86097 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
- Sep 11, 2024
-
-
Stefan Froemken authored
Add missing "App" node to example in Changelog of notification actions. Resolves: #104903 Releases: main, 12.4, 11.5 Change-Id: Icc88a55c731c7f5b517740673c24acd21b83fa12 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85957 Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Andreas Kienast <a.fernandez@scripting-base.de> Tested-by:
Andreas Kienast <a.fernandez@scripting-base.de>
-
- Sep 10, 2024
-
-
Andreas Kienast authored
The package `mime-db` received some updates since its introduction, hence it is now updated to its latest version. Executed commands: cd Build npm install --save-dev mime-db@^1.53.0 ./Scripts/generateMimeTypes.php Resolves: #104743 Releases: main, 12.4, 11.5 Change-Id: I756eed3e8d1a6b02f7b2f855dc63623a0c97245e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85980 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Andreas Kienast <a.fernandez@scripting-base.de> Reviewed-by:
Andreas Kienast <a.fernandez@scripting-base.de>
-
- Sep 06, 2024
-
-
Lina Wolf authored
This fixes the rendering warnings due to duplicate anchors and provides more structure in general. Also utilize API docs referencing for FQCNs. Resolves: #104712 Releases: main, 12.4, 11.5 Change-Id: I4e088dacec80a44d7c6e24ebb07582cbe84f72a2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85753 Reviewed-by:
Lina Wolf <112@linawolf.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benjamin Franzke <ben@bnf.dev> Tested-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
Benjamin Franzke <ben@bnf.dev>
-
- Sep 05, 2024
-
-
Garvin Hicking authored
Backport of #104694 for TYPO3 11.5 with PHP 7.4 introduced an example that was not lintable. This patch addresses that and removes PHP 8 language syntax features from the example code. Resolves: #104826 Related: #104694 Releases: 11.5 Change-Id: I390a05e6ffad948a32cd1d12134f3e7c0fdc7049 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85895 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Chris Müller <typo3@brotkrueml.dev> Reviewed-by:
Chris Müller <typo3@brotkrueml.dev> Tested-by:
Torben Hansen <derhansen@gmail.com> Reviewed-by:
Torben Hansen <derhansen@gmail.com> Reviewed-by:
Garvin Hicking <gh@faktor-e.de> Tested-by:
Garvin Hicking <gh@faktor-e.de>
-
- Sep 04, 2024
-
-
serbelanalog authored
This patch shows an example for the frontend login how to get a redirect when an unauthorized visitor tries to access a restricted page. In this case, a 403 ErrorHandler can perform a redirect with special parameters, that a properly configured felogin plugin can utilize to redirect back to. Resolves: #104694 Related: #101252 Releases: main, 12.4, 11.5 Change-Id: Ia2c6723621304b8b3de366590c1be905572b00d1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85817 Reviewed-by:
Garvin Hicking <gh@faktor-e.de> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
Garvin Hicking <gh@faktor-e.de> Tested-by:
Georg Ringer <georg.ringer@gmail.com> (cherry picked from commit 59b7da06) Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85877
-
Garvin Hicking authored
The module "EditModule" was removed with #87498, but the documentation reference remained. Instead of using this module as an example, instead "CacheModule" is referenced, since it addresses similar demonstration purposes. Backports are needed for proper documentation rendering. Resolves: #104802 Related: #87498 Releases: main, 12.4, 11.5 Change-Id: Iab25eec9aec9765f1c71f439c00ca34975d7e8a1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85873 Tested-by:
Garvin Hicking <gh@faktor-e.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Garvin Hicking <gh@faktor-e.de>
-
- Aug 27, 2024
-
-
Till Hörner authored
Resolves: #104749 Releases: main, 12.4, 11.5 Change-Id: I0285dbeb8cabd4dc338797b6b47d3312ca2b9bb3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85762 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
- Aug 26, 2024
-
-
Philipp Kuhlmay authored
This sets the correct code-block caption definitions for the YAML and PHP code blocks so they will be rendered correctly. Resolves: #104716 Releases: main, 12.4, 11.5 Change-Id: Ic1ecc908c5e84f0c72180e4402296a78211263b3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85756 Tested-by:
Chris Müller <typo3@brotkrueml.dev> Reviewed-by:
Chris Müller <typo3@brotkrueml.dev> Reviewed-by:
Garvin Hicking <gh@faktor-e.de> Tested-by:
Garvin Hicking <gh@faktor-e.de>
-
- Aug 22, 2024
-
-
Ayke Halder authored
The FileClipboardCest waits for a button to become 'enabled' before clicking it. Disabled buttons use `class="disabled"` with CSS `pointer-events: none`. This might not be handled properly by `$I->waitForElementClickable()`. Resolves: #104702 Related: #104585 Releases: main, 12.4, 11.5 Change-Id: If0677eb445207612f43b624c2889d7ef6651ae71 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85737 Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Stefan Bürk <stefan@buerk.tech>
-
Lina Wolf authored
A broken backport for #103298 introduced some not properly resolved changes. This patch removes the wrongly merged blocks and further adjusts indentation and class schemes for the 11.5 context. Releases: 11.5 Resolves: #104671 Related: #103298 Change-Id: I9471144476424e2e72adca6b02a58e12d3503f6d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85697 Tested-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
Lina Wolf <112@linawolf.de> Tested-by:
Sandra Erbel <erbel@analog.de> Reviewed-by:
Garvin Hicking <gh@faktor-e.de> Reviewed-by:
Sandra Erbel <erbel@analog.de> Tested-by:
Garvin Hicking <gh@faktor-e.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com>
-
- Aug 20, 2024
-
-
Oliver Bartsch authored
Resolves: #104639 Releases: main, 12.4, 11.5 Change-Id: I74a0cd9e856283d26a382582cc5d6b8e99887cd4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85699 Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Andreas Kienast <a.fernandez@scripting-base.de> Tested-by:
Andreas Kienast <a.fernandez@scripting-base.de>
-
- Aug 14, 2024
-
-
Garvin Hicking authored
The change in #97498 introduced a specific handling for ENUM/SET definitions in MariaDB systems. The check may be performed with a NULL value instead of a string, which can result in a PHP type mismatch error. Due to other refactoring, the issue does not exist in main (v13), but only affects v12 and v11. Resolves: #104621 Related: #97498 Releases: 12.4, 11.5 Change-Id: Ia28aae519b1aebcabe9a5f5c620124dfd22edc6a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85468 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
- Aug 13, 2024
-
-
Oliver Hader authored
Change-Id: I923ac886427a99eb9a3d7d50799e7e1f4aba2fcd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85605 Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Hader authored
Change-Id: I69b661793f76067cda23b460d1a1aac1bd0896bd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85604 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
- Aug 10, 2024
-
-
Christian Kuhn authored
idn_to_ascii() must not be called with empty string in PHP 8.4. Resolves: #104587 Related: #104513 Releases: main, 12.4, 11.5 Change-Id: I649d157cca3dadbe237e20eb440b071a1885db71 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85581 Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com> Tested-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com> Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85583
-
Christian Kuhn authored
Wait for the drop down to be ready before clicking around on it. Resolves: #104585 Releases: main, 12.4, 11.5 Change-Id: I9fa86d99b02c74bcc0f9efebce8fc4c2f8e54af5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85579 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com>
-
- Aug 09, 2024
-
-
Christian Kuhn authored
Wait for the modal body iframe being there before switching to it. This is mainly an issue in v11 where the modal takes more time server side and webdriver is 'too quick' switching to it. We still sanitize all branches. Resolves: #104577 Releases: main, 12.4, 11.5 Change-Id: Ida09f1945daae3d0fb396f1e495e91ed5042454a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85565 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
- Aug 07, 2024
-
-
Garvin Hicking authored
If an invalid record in `sys_be_shortcuts` is stored like this: ``` INSERT INTO sys_be_shortcuts (userid,route,arguments) VALUES (1,'record_edit','[]'); ``` then the backend cannot be accessed anymore due to PHP errors due to unguarded array key access of the "arguments" contents. This patch guards the array key access to prevent such a situation, so an invalid shortcut can be deleted from the menu. Database records like this might happen for migrated older installations. Resolves: #104496 Releases: main, 12.4, 11.5 Change-Id: I350e620eb403e53d1828cf5dedaab633ba00db55 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85464 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
- Aug 06, 2024
-
-
Christian Kuhn authored
Resolves: #104557 Releases: main, 12.4, 11.5 Change-Id: I1bea6d74fc444007c8787e0a642c86b35a7ccb90 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85538 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Stefan Bürk authored
Doctrine DBAL retrieves for MariaDB `ENUM()` and `SET()` field default values quotes with single quotes, which leads to an endless field change reporting recursion in the database analyzer. The default value is now trimmed to ensure a working field compare within the extending `TYPO3\CMS\Core\Database\Schema\Comparator` class. Note that TYPO3 v13 (main) may reveal the same issue but is shadowed due to the general `ENUM()` and `SET()` type field issue since Doctrine DBAL 4, reported in #104413. That needs a change on its own for main only. Resolves: #97498 Related: #104413 Releases: 12.4, 11.5 Change-Id: I51b79a7f63db43cca2724958b0355a496a49fd33 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85460 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
- Aug 03, 2024
-
-
Mathias Bolt Lesniak authored
SiteResolving will now correctly interpret a temporary ID of a new page (e.g., "NEW12345678ABCDEF") as an invalid ID and try to infer the site using `$result['effectivePid']`. This makes it possible to access site configuration properties within the TCA also on pages that have yet to be created. Resolves: #103573 Releases: main, 12.4, 11.5 Change-Id: I174e71e084e96b24ebe721ad0336a3dd1a8115d9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85458 Reviewed-by:
Andreas Kienast <a.fernandez@scripting-base.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Andreas Kienast <a.fernandez@scripting-base.de>
-
- Jul 31, 2024
-
-
Markus Sommer authored
Resolves: #104513 Releases: main, 12.4, 11.5 Change-Id: I73d4d5eac80e3bd637fa2fabd7b1d1948daf357c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85430 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Stefan Bürk <stefan@buerk.tech>
-
- Jul 29, 2024
-
-
Thomas Hohn authored
In the RestoreRegisterContentObject::render method a call to array_pop is performed. The result is assigned to the variable $frontendController->register which has type array. However array_pop can return null, this patch add's a null coalesce operator to ensure that correct type. Resolves: #104495 Releases: main, 12.4, 11.5 Change-Id: I46efce10e4322ff3cd39b5a0eeafd1f768644e38 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85359 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Benni Mack <benni@typo3.org>
-
- Jul 24, 2024
-
-
Andreas Kienast authored
This commit updates the package `requirejs` to version 2.3.7 to fix a prototype pollution vulnerability [1]. [1] https://github.com/requirejs/requirejs/compare/2.3.6...2.3.7 Resolves: #104459 Releases: 12.4, 11.5 Change-Id: I73a62c7e4e715954db5802d0a46d5758c407ac7a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85335 Reviewed-by:
Andreas Kienast <a.fernandez@scripting-base.de> Tested-by:
Andreas Kienast <a.fernandez@scripting-base.de> Tested-by:
core-ci <typo3@b13.com>
-
- Jul 19, 2024
-
-
Oliver Hader authored
Fixes an array key warning in $backendUser->groupData['webmounts']. Resolves: #104430 Releases: main, 12.4, 11.5 Change-Id: I077c59c67067f6221288ca4a73589dcc9c69bd07 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85298 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
- Jul 12, 2024
-
-
Christian Kuhn authored
BcryptPasswordHash has an option to set a cost value. The lower barrier used to be identical to PHP constant PASSWORD_BCRYPT_DEFAULT_COST. Tests use the lower barrier to speed up tests. With PHP <8.4, PASSWORD_BCRYPT_DEFAULT_COST is 10, it has been raised to 12 with PHP 8.4. The patch frees our code from access to this constant and hard codes 10 as lower barrier check. This keeps the API as is, and this hash is by default set to 12 already in default options if none are provided. Resolves: #104373 Releases: main, 12.4, 11.5 Change-Id: I4c1e94fdc50aa3075570549ccdd3b81a2de2e98a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85237 Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
- Jul 08, 2024
-
-
Loek Hilgersom authored
Fixes exception in impexp when an extension does not have a value for TCA[tableName][ctrl][rootLevel] Resolves: #104308 Releases: main, 12.4, 11.5 Change-Id: Ia2b8095c35ba6b07827525a65e0dcbb6fa1d060e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85153 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
- Jul 02, 2024
-
-
Stefan Bürk authored
With PHP 8.4 marking method parameter implicitly nullable is deprecated and will emit a `E_DEPRECATED` warning. One recommended way to resolve this, is making it explicitly nullable using the `?` nullable operator or adding a null type to an union type definition. [1] This prepares the way towards PHP 8.4 compatibility. [1] https://php.watch/versions/8.4/implicitly-marking-parameter-type-nullable-deprecated Resolves: #104284 Releases: main, 12.4, 11.5 Change-Id: Iadea4cde1d3b80962a47ffa4c183a885504bef6b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85054 Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
Stefan Bürk <stefan@buerk.tech>
-
- Jul 01, 2024
-
-
Stefan Bürk authored
With PHP 8.4 marking method parameter implicitly nullable is deprecated and will emit a `E_DEPRECATED` warning. One recommended way to resolve this, is making it explicitly nullable using the `?` nullable operator or adding a null type to an union type definition. [1] This prepares the way towards PHP 8.4 compatibility. [1] https://php.watch/versions/8.4/implicitly-marking-parameter-type-nullable-deprecated Resolves: #104278 Releases: main, 12.4, 11.5 Change-Id: Ia3a4bc344b369b8697c88ed14ac06354dd988dce Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85042 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com>
-
Stefan Bürk authored
With PHP 8.4 marking method parameter implicitly nullable is deprecated and will emit a `E_DEPRECATED` warning. One recommended way to resolve this, is making it explicitly nullable using the `?` nullable operator or adding a null type to an union type definition. [1] This prepares the way towards PHP 8.4 compatibility. [1] https://php.watch/versions/8.4/implicitly-marking-parameter-type-nullable-deprecated Resolves: #104270 Releases: 11.5 Change-Id: I107a89d5f2a2e3d4c1f16c9d2551d8be6ec74b33 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85029 Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Mogens Fiebrandt <mogens.fiebrandt@googlemail.com> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
Mogens Fiebrandt <mogens.fiebrandt@googlemail.com> Tested-by:
Benni Mack <benni@typo3.org>
-