- Feb 13, 2024
-
-
Oliver Hader authored
The File Abstraction Layer Local Driver did not verify whether a given absolute file path is allowed, and made it possible to access files outside of the project path, and to by-pass the setting in $GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath']. In case lockRootPath is not set, any local file path must be at least located in the base directory of the current project. The lockRootPath setting now supports array values as well. The trailing slash is enforced automatically. Example: * instead of 'lockRootPath=/var/spe' previously matching the paths '/var/specs/' and '/var/specials/, * now both paths need to be declared explicitly, since 'lockRootPath=/var/spe' is evaluated as '/var/spe/' Resolves: #102800 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6561df562c5dbaff1f77d33db24d5f1c6358b198 Security-Bulletin: TYPO3-CORE-SA-2024-001 Security-References: CVE-2023-30451 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82957 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Benjamin Kott authored
The style guide should aid in testing and constructing backend components. In this change, we're removing the mandatory light mode for examples to enhance visibility of adjustments within sub-components. Resolves: #103093 Releases: main Change-Id: Ia838d75fdaccb48e4f43a0cdd9fa31e309603d2b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82879 Tested-by:
Benjamin Franzke <ben@bnf.dev> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
-
Benjamin Franzke authored
The autocomplete="off" parameter is ignored by current browsers, autocomplete="new-password" is to be used for disable autocompletion. The explicit request for autocompleting the password is autocomplete="current-password", which is now used in case config TCA autocomplete is set. See following article for more information: * https://web.dev/articles/sign-in-form-best-practices#new-password * https://web.dev/articles/sign-in-form-best-practices#current-password Resolves: #103067 Related: #97104 Releases: main, 12.4 Change-Id: Ice3c7a50020d7e17b14c51dc89c1c8e1700fe9a6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82830 Reviewed-by:
Andreas Kienast <a.fernandez@scripting-base.de> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Reviewed-by:
-
Stefan Bürk authored
A new PHPStan version has been released, which is pulled in automatically in the composerInstallMax nightly test. The higher version allows to remove a ignore pattern from the baseline and a superfluous key unset is detected. This change raises the PHPStan version, removes the superfluous `unset()` and regenerates the baseline to remove the invalid ignore pattern. Used command(s): > Build/Scripts/runTests.sh -s composer \ -- require --dev "phpstan/phpstan":"^1.10.58" > Build/Scripts/runTests.sh \ -s phpstanGenerateBaseline Resolves: #103105 Releases: main, 13.0, 12.4 Change-Id: I689079eaac7f9461084e6a71ff08ef716cf551e4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82932 Reviewed-by:Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
-
- Feb 12, 2024
-
-
Oliver Hader authored
Executed command: composer update composer/composer see https://github.com/advisories/GHSA-7c6p-848j-wh5h Resolves: #103102 Releases: main, 13.0, 12.4, 11.5 Change-Id: Ib3a0baa5c94f0a19b36b8440a30f47f25eab6e65 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82899 Tested-by:
Markus Klein <markus.klein@typo3.org> Reviewed-by:
-
Oliver Bartsch authored
This fixes several bugs in FileList: 1. Properly initializing the `searchTerm` ensures it is kept while sorting. 2. Sorting for "filesize" is now working properly, using corresponding collator attribute. 3. Pagination is properly reset on searching. 4. Correct search term is kept on paginating. Resolves: #103053 Releases: main, 12.4 Change-Id: Ibf7dd278d13aed6142286d7408b9380588485801 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82826 Reviewed-by:
Jochen Roth <rothjochen@gmail.com> Tested-by:
Sybille Peters <sypets@gmx.de> Tested-by:
-
Sybille Peters authored
Since the linktypes are automatically registered in Linkvalidator, it is no longer quite as easy to replace the "external" linktype. You cannot register another linktype using the same identifier "external", so a different identifier must be used. A minimal example is added to the developer section in the documentation. Resolves: #101673 Related: #96935 Releases: main, 12.4 Change-Id: I9afa1a77fe56675dff2dbc1bacc3635b1b9b36c6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82894 Reviewed-by:
Chris Müller <typo3@krue.ml> Tested-by:
-
- Feb 11, 2024
-
-
Oliver Bartsch authored
The query for fetching extension versions is extended to also find "outdated" extension versions (review_state = -2). Note: For now, this does not change anything in the EM, since the remote XML does not use the -2 state currently, due to the wrong constraint. This can however now be properly fixed in XML. Resolves: #93082 Releases: main, 12.4, 11.5 Change-Id: I522a2c166c6d1af6e8b2a14de51d63a15c4211d2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82821 Tested-by:
-
Torben Hansen authored
The language labels for `noPluginSelected` and `edit` in StandardContentPreviewRenderer can not be resolved, because the extension path is wrong. This change fixes the extension path and additionally streamlines one label output, by using `htmlspecialchars` to escape the generated label similar to the other label output in this class. Additionally a similar wrong extension path in `ExampleLinkType.rst.txt` has been adapted. Resolves: #103095 Related: #100675 Releases: main, 12.4 Change-Id: I4882133025c938fc3b6928b36237e782e9465dcc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82884 Tested-by:
-
- Feb 10, 2024
-
-
Stefan Bürk authored
New core-testing-* images have been build and published in the TYPO3 testing-infrastructure repository and pulled to the core ci gitlab runner instances. [1][2] This change modifies `Build/Scripts/runTests.sh` to set new image version to ensure the usage for all changes based on this change. For information what changed in the image see the patches in the testing-infrastrucure repository linked below. * core-testing-php82 => 1.10 * core-testing-php83 => 1.11 [1] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/e6719d303eacf2f377e308c800b474b735145d61 [2] https://github.com/advisories/GHSA-7c6p-848j-wh5h Resolves: #103096 Releases: main, 13.0, 12.4, 11.5 Change-Id: If9c5ae00334acc4fa5a1417dcbf9f77d31dff62d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82885 Tested-by:
Torben Hansen <derhansen@gmail.com> Tested-by:
-
- Feb 09, 2024
-
-
Yann authored
An editor can trigger a TypeError exception leading to a 503 error message `trim() expects parameter 1 to be string, null given` in the backend page module by creating `menu_categorized_content` objects with `selected_categories` and then turning them into `menu_section` objects. This change mitigates the type error by using a null-coalesce fallback passing an invalid type to the `trim()` method in `StandardContentPreviewRenderer::generateListForMenuContentTypes()`. Resolves: #103052 Releases: main, 12.4, 11.5 Change-Id: I4c0ecbd20c7cdfee22fa324f6b80391be47a1b88 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82794 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
-
Oliver Bartsch authored
The "Export" button in the list module, used to trigger exporting a table does now also respect the `options.impexp.enableExportForNonAdminUser` TSconfig option, preventing a permission exception. The `mod.web_list.noExportRecordsLinks` is no longer used for managing the display of the "Download" button (displayed in the table's header row), but instead a dedicated TSconfig option `mod.web_list.displayRecordDownload` is introduced. Using per-table syntax, it's also possible to manage the "Download" Button for each table individually. Resolves: #99781 Releases: main, 12.4 Change-Id: I8b967218626ecc05dccf4bd7ac441db56a21a753 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82817 Reviewed-by:
-
Benjamin Kott authored
Resolves: #103094 Releases: main Change-Id: Ib755aacd6f3e9a8149691957c08151b36144325b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82882 Reviewed-by:
-
Oliver Bartsch authored
The ExtendedFileUtility component provides the file name as argument for the `fileNotDeletedHasReferences` label. This information is now displayed correctly by adding the missing placeholder to the label. Resolves: #103091 Releases: main, 12.4 Change-Id: Ic9e40034bdf4f3d14e874014210e5d22235cd8c8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82875 Tested-by:
-
Andreas Kienast authored
Lit elements need to get created in the correct browser scope (i.e. frame) to get rendered in Firefox, which is a huge issue in modals (that reside in the global scope), that are triggered in an iframe scope. This commit introduces a helper method `loadModuleFrameAgnostic()` that loads the module depending on the context the Install Tool is in (standalone vs. iframe). All Install Tool modules are modified to load renderable modules (info boxes, flash messages and progress bars) explicitly. Also, a superfluous progress bar is removed from the "Directory status" module that breaks the whole modal in case a user prefers reduced motions. Resolves: #103048 Releases: main Change-Id: I00834e1000c689d4581cbd3ef0124a1f8a391186 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82791 Tested-by:
Andreas Nedbal <andy@pixelde.su> Reviewed-by:
-
Oliver Bartsch authored
Resolves: #103089 Releases: main Change-Id: I87cfaf2baeafb290930cb6142e80ad490fb1a05c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82872 Reviewed-by:
Benjamin Kott <benjamin.kott@outlook.com> Tested-by:
-
Torben Hansen authored
The identifier in the `AsEventListener` PHP attribute uses a space. Allthough this technically works, we do not use spaces elsewhere for event listener identifiers. This change therefore removes the superfluous space. Resolves: #103041 Related: #102440 Releases: main Change-Id: I159ff18e4769e71cba120ccb1dd2b668fd825aea Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82784 Reviewed-by:
-
Andreas Kienast authored
`argon2id` is available since PHP 7.3. Since this version requirement is fulfilled for quite some time already, it's time to set the hashing algorithm as the default one. Resolves: #103084 Releases: main Change-Id: Iad3f4f4e33a7c3aa1b3d790931cf7bff900935b7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82865 Reviewed-by:
-
Thomas Hohn authored
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: https://github.com/Roave/SecurityAdvisories/issues/127#issuecomment-1933647035 [1] https://getcomposer.org/doc/04-schema.md#replace [2] https://github.com/advisories/GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82863 Tested-by:
-
Benjamin Kott authored
The lower part of the node name was inadvertently truncated. This patch ensures that the text is no longer cut off. Resolves: #103077 Releases: main Change-Id: I54dfe7300d1c15ab0b28393e7b15196e2f42aa8c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82870 Reviewed-by:
-
Andreas Kienast authored
In some cases it was missed to enable modal actions again after their execution in the Install Tool. This patch adds the necessary statements to enable said buttons again. Resolves: #101224 Releases: main, 12.4 Change-Id: I793f157302df15912f0506c376d9db2d6041ebcc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82815 Tested-by:
Garvin Hicking <gh@faktor-e.de> Reviewed-by:
-
Benjamin Kott authored
With the move to native drag and drop in the tree component #103043, d3js became obsolete and is now removed. Resolves: #103087 Releases: main Change-Id: I8592ca50550b242b9e452ef0a782cbf60e81a8e4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82869 Tested-by:
-
Andreas Kienast authored
Executed commands: npm install --save sortablejs@^1.15.2 npm run build Resolves: #103064 Releases: main, 12.4 Change-Id: I34c76bbd6b856c10a7a420d6fe652a47fbf0e095 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82823 Reviewed-by:Fabien Udriot <fudriot@omic.ch> Tested-by:
-
Andreas Kienast authored
Executed commands: npm install --save alwan@^2.0.2 npm run build Resolves: #103038 Releases: main Change-Id: Iba79bd1e91c2ffcdfc7ff23e11786d4f6b9ee305 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82781 Reviewed-by: -
Benni Mack authored
This change ensures that `?id=` only validates against an integer-interpreted value, disallowing `?id=nonsense23` which previously resolved to "23" In case an invalid `?id=` parameter value is provided throw a page not found error. Resolves: #103057 Releases: main, 12.4 Change-Id: Iaeb3096944b6872b73b056b690bf4f7fabbe9a6b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82814 Reviewed-by:
-
- Feb 08, 2024
-
-
Benjamin Kott authored
The configured browser capabilities (`chromeOptions`) are passed by `codeception/module-webdriver` to `php-webdriver` as is. php-webdriver expects the PHP constant ChromeOptions::CAPABILITY to be used instead of hardcoding any strings. Therefore php-webdriver 1.15 changed this constants value from `chromeOptions` to `goog:chromeOptions` [1], which means that the option `chromeOptions` is no longer respected and the configured window size (and the headless flag) is ignored. We now use the newer W3C webdriver comaptible `goog:chromeOptions` option and define window size definition via codeception's respective option `window_size` while we are at it. [1] https://github.com/php-webdriver/php-webdriver/commit/235c2aa07 Resolves: #103081 Releases: main, 12.4 Change-Id: Iec345b5ec0226d38b62081aa8c3a51dd3100bdb7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82860 Reviewed-by:
-
- Feb 07, 2024
-
-
Simon Schaufelberger authored
A new test case is added to cover the case when a TCA definition exists without `ctrl`. The test case has been added to the test extension `blog_example` which is not part of the public extension. Resolves: #103025 Releases: main, 12.4, 11.5 Change-Id: Iccd4428ad544fd6a94ed48ec97264b2945463d04 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82771 Tested-by:
-
Benjamin Kott authored
The SVG based renderer for the page, file and select trees has been replaced by a HTML based one. It uses reactive rendering based on lit's component model. Using HTML and CSS rendering offers more flexibility than SVG, so that RTL and dark mode support could now be implemented. Releases: main Resolves: #102125 Resolves: #103043 Resolves: #100467 Resolves: #98088 Resolves: #97346 Change-Id: Ic27b1d08c232d9074a734c80e222fb801672b967 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81411 Reviewed-by:
Frank Nägler <frank.naegler@typo3.com> Reviewed-by:
-
Stefan Bürk authored
This change adds a composer command dispatcher to `Build/Scripts/runTests.sh` to allow the execution of any composer command without the hassle to have a proper composer installed on the host system. This also helps for onboarding new contributors not having a proper php and composer ecosystem installed on the host system. For example, to raise dependencies following can now be used: > Build/Scripts/runTests.sh -s composer -- require --dev \ typo3/testing-framework:dev-main Other examples: > Build/Scripts/runTests.sh -s composer -- dumpautoload > Build/Scripts/runTests.sh -s composer -- info | grep "symfony" Resolves: #103045 Releases: main, 12.4, 11.5 Change-Id: I65fa14e2c8d0d1a1204b3bed701d8c3458b6e3bb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82787 Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Reviewed-by:
-
Stefan Bürk authored
The COMPOSER_ROOT_VERSION environment variable in `Build/Scripts/runTests.sh` has not been updated. This change corrects this. Resolves: #103073 Releases: main Change-Id: I9fa3406ac471e749546473db10db3020d4f92685 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82857 Reviewed-by:
-
Andreas Kienast authored
Executed commands: npm install --save-dev sass@^1.17.0 npm run build Resolves: #103065 Releases: main, 12.4 Change-Id: Id8d3ad111a751299266bdc3abe59c54a15df010c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82824 Reviewed-by:
-
- Feb 06, 2024
-
-
Christian Kuhn authored
This finediff minor raise alignes supported PHP versions >=8.2 with core, symfony, phpunit v11. Releases: main Resolves: #103066 Change-Id: I7af5103daf65a57ca865fa3236803df9368894bc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82825 Tested-by:
-
Dimitri König authored
There have been quite a lot of patches around the pagelayout condition, which was introduced in early TYPO3 v11. It was broken in the beginning and got fixed with #98044. Soon after, a major refactoring of the ConditionMatcher has been applied with #100047, which re-introduced bugs regarding the pagelayout TypoScript condition. These have partially fixed with #100764 and #100921. The affected code is a bit messy due to a weird sorted array returned by the 'rootline' methods and classes, which we can't resolve right now. The fix itself revolves a last issue by reversing the rootline again. This was already done in the old backend ConditionMatcher. The frontend ConditionMatcher received the fullRootline, which is already reversed (deepest first). With the introduction of IncludeTreeConditionMatcherVisitor this has been unified, but the array_reverse was forgotten. In addition, the fullRootline from the frontend controller and BackendUtility::getPagesTSconfig() calls are sorted with `ksort` before passed over, meaning we always receive a top-down (root-first) rootline. Hence, the array_reverse is a viable fix for both backend and frontend. The patch covers BE pageTS, FE TypoScript and FE getData with tests to cover the situation once and for all. Resolves: #102268 Related: #100047 Related: #100764 Related: #100921 Related: #98044 Related: #97816 Releases: main, 12.4 Change-Id: Ibec77f3cf63073e40e4a711d69f584b9265b1ad6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82560 Tested-by:
-
Andreas Kienast authored
Resolves: #103055 Releases: main, 12.4 Change-Id: If1c9f1dee8952faba5ed65bf54770a51aefdd37d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82812 Reviewed-by:
Mathias Brodala <mbrodala@pagemachine.de> Tested-by:
Stephan Großberndt <stephan.grossberndt@typo3.org> Reviewed-by:
-
- Feb 05, 2024
-
-
Andreas Kienast authored
The version was outdated and is removed as it is not needed, since there is no intent to publish the build-folder as-is on npmjs. Resolves: #103039 Releases: main, 12.4 Change-Id: I799e03b00caefea946fb9700a6863ae325551f90 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82782 Reviewed-by:
-
Stefan Bürk authored
To give extensions the ability to change the expected database schema, adding or changing columns of existing TYPO3 Core tables or other extension tables, `ext_tables.sql` of extension are read and taken as partial table definitions. All table definitions are merged at a later point in the `ConnectionMigrator`, forcing proper handling of partial table information. This change moves the table definition merge process from the `ConnectionMigrator` to the `SchemaMigrator` at the earliest possible place to pave the way for further code cleanups. Resolves: #103015 Related: #103014 Releases: main Change-Id: I7f5bfa6f438604ca6295f20eb85fb9e24a44189a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82758 Reviewed-by:
-
Oliver Bartsch authored
The element browsers, such as file browser, folder browser or the create folder browser are rendering the FileList in the `browse` mode. In this case the context menu component is not loaded. This is correct, since using the context menu inside the modal would lead to various side effects. Because the JS component is not loaded for mentioned reasons, wrapping the icons with the click menu needs to be omitted. This otherwise leads to further side effect, e.g. loading a second folder tree in the create folder browser. Therefore, this change now omits wrapping the icon with then click menu when the Filelist is used in the `browse` mode. Resolves: #103001 Releases: main, 12.4 Change-Id: Ifd4daf5487b5dd9c74553d48cd0c2270b2c4f58b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82755 Tested-by:
-
Stefan Bürk authored
This change adds further MySQL Server versions to the `Build/Scripts/runTests.sh` to allow executing local functional and acceptance tests with these version. Added versions: - MySQL 8.1 - MySQL 8.2 - MySQL 8.3 Resolves: #103030 Releases: main, 12.4, 11.5 Change-Id: I578ed524560ae1907ab8a79df7694470f9aa234a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82777 Tested-by:
-
Simon Praetorius authored
This patch should cover all of the arguments and variants both <f:image /> and <f:uri.image /> offer to generate images in Fluid templates. Resolves: #103013 Releases: main Change-Id: Ibf55b785d74d076edef121ac2f43e862677acdd7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82757 Tested-by:
-
- Feb 04, 2024
-
-
Andreas Kienast authored
Executed commands: npm install --save \ @lit/reactive-element@^2.0.4 \ lit@^3.1.2 \ lit-element@^4.0.4 \ lit-html@^3.1.2 npm run build Resolves: #103024 Releases: main, 12.4 Change-Id: Iec49465ce10b9da4cd2a05bcc13c09dd49508ef0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82768 Tested-by:
-
