- Feb 21, 2024
-
-
Sascha Nowak authored
The cache_treelist handling in PageRepository is broken for a long time already: Entries are get() with an expiry time that is not properly set(), so get() is never successful. There is a second bug in getDescendantPageIdsRecursive() cache handling: get() is done without BE user restriction, but set() is only done when no BE user is logged in. This way, non-BE user state could swap into BE user state, *if* the cache would work. The patch avoids reading and writing the cache instead of fixing cache access: We can not risk bugs in v12 if the cache would suddenly start working but has side effects: Issues like that would be hard to find, hard to report, and have severe impact on FE rendering. Note typical use case of the method are the "menu" content elements, plus the extbase 'starting point' logic. So its not the menu rendering in general - we would otherwise have most likely found the broken cache much earlier. The patch effectively increases performance since the get() and set() queries are gone. Resolves: #103139 Releases: main, 12.4 Change-Id: Icc8d13b583f77d6ffc186d391d46d6830ee50889 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83023 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Benjamin Kott authored
Resolves: #103167 Releases: main Change-Id: Ic890b2b5ea50bd4410709912316e3da7ac0cad38 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83054 Tested-by:
Andreas Kienast <a.fernandez@scripting-base.de> Tested-by:
Benjamin Franzke <ben@bnf.dev> Reviewed-by:
-
Benjamin Kott authored
Resolves: #103166 Releases: main Change-Id: I8ee238e46ba7589e32917d2ac26ee0aa6860c014 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83053 Tested-by:
-
- Feb 20, 2024
-
-
Torben Hansen authored
The dataHandler hook implementation `BackendUserPasswordCheck` sets a random password for a new backend user, if the provided password is empty in `$incomingFieldArray`. The generated password is a random HMAC string, which does not fulfill the requirements of the default TYPO3 password policy. As a result, a password policy warning is shown. This change ensures, that the generated random password at least fulfills the default TYPO3 password policy. Resolves: #103138 Releases: main, 12.4 Change-Id: I20ef7c5958d539533cc76ca41c4cc7b5ab07e594 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83022 Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
-
Andreas Kienast authored
Some modal windows rendered in the workspace management module had hard-coded strings. This commit replaces such usages with translatable locallang keys. Resolves: #103161 Releases: main, 12.4 Change-Id: Id0d6be518abc44b7aab82ebd1312bc159a01898a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83046 Tested-by:
-
Benjamin Franzke authored
Adapt the service provider compiler to perform the same level of optimization as for the array-based callable syntax: We unroll the static closure into its static components (class name and method name). That means the effective generated dependency injection php code is the same as before with the gain of better DX. Note that first class closures can only be used where methods of the current scope are referenced, late state binding is not supported. AbstractServiceProvider therefore keeps using array-based callable syntax to be able to reference method scope of extending classes. Resolves: #103104 Releases: main, 12.4 Change-Id: I2f8ca7a69b1b69c51b1ff6bec384ddafe4492a41 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82593 Tested-by:
-
Andreas Kienast authored
The code of the form creation wizard is cleaned up a bit. The nested `then()` callback hell is replaced with proper async/await statements to make the code more readable. Resolves: #103156 Releases: main Change-Id: I144d6be0c3608f7d412dbefd031dd4d0ce4a3a42 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83041 Tested-by:
Andreas Nedbal <andy@pixelde.su> Reviewed-by:
-
- Feb 19, 2024
-
-
Oliver Bartsch authored
Drop down menus, used in the docheader (e.g. the language selection in then page module) do no longer get cut off on small screens. This is done by setting a dynamic max-height (viewport height - topbar and docheader height) and by allowing to scroll. Resolves: #103074 Releases: main, 12.4 Change-Id: Icd5f6d9c245f40c55e47e1f18901467a5703bc16 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83009 Tested-by:
Jochen Roth <rothjochen@gmail.com> Tested-by:
Garvin Hicking <gh@faktor-e.de> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
Benjamin Franzke authored
With #100768 the CKEeditor5 CSS scoping was migrated from server-side SCSS preprocessing to a JavaScript based CSS prefixer. The Feature.rst has not been updated and still referred to limitations caused by the removed SCSS parser. Resolves: #103151 Related: #100768 Releases: main, 12.4 Change-Id: I0f9e7d0c8c88c906b65290c29f2b2cc0e179058a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83035 Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
-
Andreas Kienast authored
Resolves: #103142 Releases: main, 12.4, 11.5 Change-Id: I31e5af71aa0e1a9104f8c154a6f0e34f29c90a77 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83034 Reviewed-by:
Guido Schmechel <guido.schmechel@brandung.de> Reviewed-by:
Torben Hansen <derhansen@gmail.com> Tested-by:
-
Johannes Nielsen authored
Add the configuration to the "Full" RTE preset, and also include some modules that missed in Full preset since #102099. npm install --save @ckeditor/ckeditor5-font@41.1.0 npm run build Resolves: #100847 Releases: main, 12.4 Change-Id: Iaa56d48e043397aefb902b6c9a5afbfcc453ae74 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79006 Tested-by:
David Bruchmann <david.bruchmann@gmail.com> Reviewed-by:
-
- Feb 18, 2024
-
-
Chris Müller authored
Resolves: #103145 Related: #102628 Releases: main Change-Id: Ib629563e5289e2dc459b042fe8c5fb7c54beb829 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83029 Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
-
Chris Müller authored
Additionally, avoid double "see" in consecutive sentences. Resolves: #103146 Related: #102875 Releases: main Change-Id: If01e516c07c523dbb4dc7b6acb9cf487c4e6edf0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83030 Tested-by:
-
- Feb 17, 2024
-
-
Stefan Bürk authored
New core-testing-* images have been build and published in the TYPO3 testing-infrastructure repository and pulled to the core ci gitlab runner instances. [1] This change modifies `Build/Scripts/runTests.sh` to set new image version to ensure the usage for all changes based on this change. For information what changed in the image see the patches in the testing-infrastrucure repository linked below. * core-testing-php82 => 1.11 * core-testing-php83 => 1.12 [1] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/072687df3a90e808143b3eded59176ee593e8112 Resolves: #103143 Releases: main, 13.0, 12.4, 11.5 Change-Id: Ia0ec77beb11e3f24614a0f5b531799494c1af988 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83028 Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
-
Benjamin Franzke authored
CKEditor5 renders tablecaptions as figcaption elements, therefore we allow them to be included in RTE and in frontend rendering. Resolves: #101874 Releases: main, 12.4 Change-Id: I0d1c05b2d8a35d765e64713741a0ab05a5aa1a5c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82185 Reviewed-by:
-
- Feb 16, 2024
-
-
Christian Kuhn authored
This `@internal` property and method is another "has never been used" detail: It dates back to very early TYPO3 versions and TER reveals not a single usage. In case there are still extensions dealing with that public property, it should be possible to use hook 'processDatamap_postProcessFieldArray' instead, which is dispatched within process_datamap() a couple of lines later. Resolves: #103137 Releases: main Change-Id: If849f3f36aa160f8c467907b338aed27c7ef94eb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83020 Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Christian Kuhn authored
Some cleanup of the class with obvious things: * Add ConnectionPool, CacheManager and runtime cache as property, created in __construct(), can be DI later. * Remove unused getResourceFactory(), remove getCacheManager() and getRuntimeCache() since they are properties now. * Add type hints to most properties: Those that can be set without headaches since DH would crash if they'd not be of that type, or other obvious reasons. * Turn a protected magic-string property into a constant and add another related constant to avoid a magic-string in code. * Add a series of method return types: Obvious ones where the method clearly can't return something else. * Minor comment spelling improvements. Change-Id: I117548d2ed44236208063774680079578e8392b5 Resolves: #103135 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83019 Reviewed-by:
-
Oliver Bartsch authored
Since FileInterface->getPublicUrl() might return `NULL`, corresponding constructor arguments are updated to now expect `?string`. Resolves: #103051 Releases: main, 12.4 Change-Id: I8d16c6b9361694733dc2c5c4b2e69693fe25cff4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83011 Reviewed-by:
-
Andreas Kienast authored
In v11, extension authors were able to enhance the site configuration "TCA" with richtext fields. Since v12, this is not possible anymore due to the missing `backend.form` imports, required to load necessary JavaScript modules tagged as such. This commit adds the missing instruction, allowing to make use of ckeditor and related modules again. Resolves: #103115 Releases: main, 12.4 Change-Id: I2fb6d6b917ee99d9616593f118daa72d3f3a460b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83000 Reviewed-by:
-
Oliver Bartsch authored
To allow `BackendUtility::getProcessedValue()` to properly resolve the labels for select options, added via TSconfig, the `pid` is now provided by `StandardContentPreviewRenderer`. Resolves: #103076 Releases: main, 12.4 Change-Id: I20777ae532b66800ea61143e1824c895c7673042 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83008 Tested-by:
-
Christian Kuhn authored
Similar to #103132. This time, public `@internal` property $data_disableFields is only read, but never written. Reading the property comment, it looks as if this may have been used as a detail scenario within ext:impexp that has been removed long ago. History reveals no core usage since ever: That property hasn't even been used with Kaspers initial commit in 2003. Let's drop this artifact and keep it in versioning museum forever. Resolves: #103133 Related: #103132 Releases: main Change-Id: I2bfddad06f2cbb2610fb55f67a9dda40d75ab7e8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83016 Tested-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Tested-by:
-
- Feb 15, 2024
-
-
Christian Kuhn authored
In this episode of 'Cracking the Cryptic' we are looking at the DataHandler puzzle ;) Let's get some obvious things done, first: Protected property DataHandler->remapStackChildIds is only written but never read. Remove property and protected addNewValuesToRemapStackChildIds() with all its callers to reduce complexity a bit. Resolves: #103132 Releases: main Change-Id: I914ae36875906acc8e39799e640899116b3206ee Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83015 Tested-by:
-
Andreas Kienast authored
Resolves: #103131 Releases: main Change-Id: I19617a4b2610bd622a887c0a2c1b974ca7617d01 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83014 Reviewed-by:
-
Christian Kuhn authored
Argument 3 $data of `checkRecordUpdateAccess()` is funny: It is only used if argument 4 is given as well. This is only done in method `process_datamap()`, so `checkRecordUpdateAccess` hook method is only triggered from within that method. This situation allows us to move the hook call into `process_datamap()` directly, making it more obvious it's only triggered by that `main` method. This allows us to get rid of arguments 3 and 4. Also point out a logical issue within the method. Resolves: #103126 Releases: main Change-Id: I4f4b2711784c005ed312ca491775c3e1d39b35d3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83010 Tested-by:
-
Christian Kuhn authored
There is no point to substitute GU::trimExplode() of the rather short TCA 'eval' string by substituting it with an md5() operation plus runtime cache object operations. Both things are most likely similarily quick, and the time consumed by queries in DH is multiple orders of magnitude bigger than this simple operation, a difference is not measurable. Let's thus simplify the code a bit. Resolves: #103125 Releases: main, 12.4 Change-Id: I474d3fbe6b503a99a9129856b0f59c777b171844 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83007 Tested-by:
Stephan Großberndt <stephan.grossberndt@typo3.org> Reviewed-by:
-
Oliver Bartsch authored
The EXT:form "version2" is using bootstrap 5, which requires <select> elements to use the `form-select` class. This is now fixed for corresponding form elements. Resolves: #103117 Releases: main, 12.4 Change-Id: I712cecfa4c5ac8facc84bc3cf0f742867ecc9613 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83002 Tested-by:
-
Torben Hansen authored
Install tool suggests to set `$GLOBALS['TYPO3_CONF_VARS']['GFX']['processor_colorspace'] = sRGB` if images appear too dark. In general this is the correct suggestion, but the value must be quoted. This change adds the missing single quotes for the value. Resolves: #103124 Releases: main, 12.4 Change-Id: I2e1fd2ebebf1d67870145df29ec0e40b330a5065 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83005 Tested-by:
-
- Feb 14, 2024
-
-
Oliver Bartsch authored
Since the node is `collapsed` on initial rendering, the `aria-expanded` attribute is set to "false". Resolves: #103119 Releases: main Change-Id: Ia06d0a268cf572453b17f5bd332e7d482019b561 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82997 Tested-by:
-
Oliver Bartsch authored
Due to the previously used pagination, the "items per page" option has been reset when searching in the record list. However, since the "new" pagination is able to handle such filtered list, resetting the "items per page" option is no longer necessary and therefore makes lists with a lot of matched items usable again. Resolves: #103107 Releases: main, 12.4 Change-Id: Ibeb5a65666a3796f98d3dd61c9efc0bd3bfb0c72 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82998 Tested-by:
-
Stefan Bürk authored
With #103015 the table definition merge has been moved to an earlier point, providing an associative array with the table definitions. This change modifies `DefaultTcaSchema` to operate on that array and simplifies the required handling code. More precise doc-block annotations for humans and PHPStan are added along the way. Resolves: #103016 Related: #103015 Related: #103014 Releases: main Change-Id: I7d2120ee836854b2fa9072e44444e7387873bd2e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82760 Tested-by:
-
Nikita Hovratov authored
The BootCompletedEvent receives the constructor argument `$cachingEnabled`. However, the variable `$disableCaching` was passed in Bootstrap::init() which is the exact opposite. In fact, the caching is logically always enabled when reaching the dispatched event. Resolves: #103114 Releases: main, 12.4 Change-Id: I81c26027bb8e2cb4009fbfcd0bfd6015bd9c1dec Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82993 Reviewed-by:
-
Oliver Bartsch authored
It's now possible to use a TCA type `group` field as `foreign_selector` together with the `useCombination` functionality. The corresponding "child child table" information is in this case fetched from the `allowed` option. Side note: Using TCA type `group` for a `foreign_selector` field is not really documented, but it's also not forbidden. Actually, it's a valid use case and also working quite well as the new styleguide examples demonstrate. However, the documentation should be adjusted to mention that only one table can be defined in `allowed` for such fields. Resolves: #102904 Releases: main, 12.4 Change-Id: Icdde6a8acb1fb9166da8e6259758f6bf64d6c41f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82721 Tested-by:
-
Garvin Hicking authored
The original patch in [1] wrongly stated that the column type was changed to "bigint unsigned", when in fact it is "bigint signed" (to allow dates before 1970). This documentation mistake is now fixed. [1] https://review.typo3.org/c/Packages/TYPO3.CMS/+/80668 Resolves: #103113 Releases: main Change-Id: Iff9b1cc00a040c4315ce3ee13bb6bd93afb97fb0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82992 Reviewed-by:
-
- Feb 13, 2024
-
-
Andreas Kienast authored
This commit updates ckeditor5 to v41.1. See changelog at https://github.com/ckeditor/ckeditor5/releases/tag/v41.1.0. Executed commands: npm i --save \ @ckeditor/ckeditor5-alignment@^41.1.0 \ @ckeditor/ckeditor5-autoformat@^41.1.0 \ @ckeditor/ckeditor5-basic-styles@^41.1.0 \ @ckeditor/ckeditor5-block-quote@^41.1.0 \ @ckeditor/ckeditor5-clipboard@^41.1.0 \ @ckeditor/ckeditor5-code-block@^41.1.0 \ @ckeditor/ckeditor5-core@^41.1.0 \ @ckeditor/ckeditor5-editor-classic@^41.1.0 \ @ckeditor/ckeditor5-engine@^41.1.0 \ @ckeditor/ckeditor5-essentials@^41.1.0 \ @ckeditor/ckeditor5-find-and-replace@^41.1.0 \ @ckeditor/ckeditor5-heading@^41.1.0 \ @ckeditor/ckeditor5-horizontal-line@^41.1.0 \ @ckeditor/ckeditor5-html-support@^41.1.0 \ @ckeditor/ckeditor5-indent@^41.1.0 \ @ckeditor/ckeditor5-link@^41.1.0 \ @ckeditor/ckeditor5-list@^41.1.0 \ @ckeditor/ckeditor5-paragraph@^41.1.0 \ @ckeditor/ckeditor5-paste-from-office@^41.1.0 \ @ckeditor/ckeditor5-remove-format@^41.1.0 \ @ckeditor/ckeditor5-show-blocks@^41.1.0 \ @ckeditor/ckeditor5-source-editing@^41.1.0 \ @ckeditor/ckeditor5-special-characters@^41.1.0 \ @ckeditor/ckeditor5-style@^41.1.0 \ @ckeditor/ckeditor5-table@^41.1.0 \ @ckeditor/ckeditor5-theme-lark@^41.1.0 \ @ckeditor/ckeditor5-ui@^41.1.0 \ @ckeditor/ckeditor5-undo@^41.1.0 \ @ckeditor/ckeditor5-utils@^41.1.0 \ @ckeditor/ckeditor5-word-count@^41.1.0 npm i --save-dev \ @ckeditor/ckeditor5-dev-utils@^39.6.0 npm run build Resolves: #103069 Releases: main, 12.4 Change-Id: I571ccb8d8531108f99272f6c4cf11c351d3f5692 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82852 Tested-by:
-
Christian Kuhn authored
The database column defined by TCA ctrl 'origUid' ('t3_origuid') had a bumpy ride over the years. It was mostly obsoleted in v8 with the introduction of 'translationSource' ('l10n_source'). A patch to fully remove it with #88495 has been reverted with #88501, leaving the field in limbo. The only remaining "true" usage of 'origUid' is in an inline relation scenario in DataMapProcessor when an inline parent *is* localizable (TCA ctrl 'languageField' and 'transOrigPointerField' set), but a child *is not*: Due to the copy strategy of all inline children upon localization of a parent record, the core needs to know if a child exists already or needs to be created. 'origUid' then stores the uid of the default language child. A couple of tests refer to this scenario as "monoglot" children. We could potentially get rid of that scenario by postulating that an inline child has to be localizable as well if the parent is, but that decision can be taken later. The patch does not touch this scenario, but looks at 'origUid' from a different perspective: If a table *is* localizable, or is not used as inline child, then 'origUid' is not needed. The patch thus removes TCA ctrl 'origUid' from TCA tables, keeping it only in the test scenario extensions 'test_irre_csv', 'test_irre_foreignfield' and 'test_irre_foreignfield_non_ws'. The bulk of the patch is about removing 't3_origuid' from the functional test .csv fixture files, while the most important TCA changes are dropping ctrl 'origUid' from table 'pages' and 'tt_content'. Resolves: #103099 Related: #79856 Related: #88494 Related: #88495 Related: #88501 Releases: main Change-Id: I622afde74294c389639974d312f121d0a6466b60 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82888 Tested-by: -
Stefan Bürk authored
The constant editor has been revamped with #98357 using the new TypoScript parser introduced with TYPO3 v12 under the hood. For category and subCategory handling lower-cased keys have been used, missing to lower-case the custom categories and subcategories names (keys) integrator are able to add since aeons. That leads to a failing match later on, and adding constants to the generic `other` subcategory. The revamped code supports only one category per subCategory sorting value. The documentation say that this **should** be omitted, but it worked in the past and broke with the revamped implementation. This change fixes muliple issues with the constant editor: * Ensure that custom categories and subcategories are read lower-case, otherwise later lookup will fail and sorted into sub-categorie `other`. * Add addtional array level to have `subCategory->items` per second sorting value as array (to avoid overriding). * Add additional item loop to the fluid template to respect the additional array level. Note: In the past it was possible to display a constant in multiple categories/subcategories by adding them again with different category configure comment lines. This is not supported anymore and not considered as bug. Resolves: #103088 Related: #98357 Related: #97816 Releases: main, 12.4 Change-Id: I4403420cc957cdef4bf077365deac0f7af621c71 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82898 Tested-by:
Thomas Anders <me@naderio.de> Tested-by:
-
Oliver Hader authored
Write access to table `sys_file` is denied per default, unless data is being imported. In addition, write access to related FAL entities `sys_file_reference` and `sys_file_metadata` is denied in case a file on legacy storage (uid=0) is used or corresponding user does not have permissions to access a particular file. Resolves: #93969 Releases: main, 13.0, 12.4, 11.5 Change-Id: Ic8ac7132d732bd117aa63f6a33545ceb1d1f421d Security-Bulletin: TYPO3-CORE-SA-2024-006 Security-References: CVE-2024-25121 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82962 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Benjamin Franzke authored
Resolves: #93571 Releases: main, 13.0, 12.4, 11.5 Change-Id: I9622bfa47ef9637cecaff4a790f742445f598682 Security-Bulletin: TYPO3-CORE-SA-2024-005 Security-References: CVE-2024-25120 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82961 Reviewed-by:
-
Benjamin Franzke authored
The encryptionKey is a secret that must never be sent within any request, therefore it is now dropped from the editing interface in "Configure Installation-Wide Options". The log file writer has been adapted to be aware of the fact that the encryption key might not be set when TYPO3 has not yet been installed (which is the case when `vendor/bin/typo3 setup` is executed). Resolves: #103046 Releases: main, 13.0, 12.4, 11.5 Change-Id: I260a8a2e9af29908543dfe48ac3658d8c45cc440 Security-Bulletin: TYPO3-CORE-SA-2024-004 Security-References: CVE-2024-25119 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82960 Tested-by:
-
Oliver Hader authored
Backend form fields of TCA `type=password` should never expose the persisted value - especially, in case the value is explicitly configured not to be hashed (having TCA `hashed=false`). Resolves: #101965 Releases: main, 13.0, 12.4, 11.5 Change-Id: Ie05a708185c621b8a2120ad7851ac4caf180893f Security-Bulletin: TYPO3-CORE-SA-2024-003 Security-References: CVE-2024-25118 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82959 Tested-by:
-
