- May 27, 2016
-
-
Frank Naegler authored
Resolves: #75397 Releases: master, 7.6 Change-Id: I7cb4f04e38e3d9f755aaf92012eb56d71a1ad6f7 Reviewed-on: https://review.typo3.org/48110 Reviewed-by:
Wouter Wolters <typo3@wouterwolters.nl> Reviewed-by:
Andreas Fernandez <typo3@scripting-base.de> Tested-by:
Morton Jonuschat <m.jonuschat@mojocode.de> Tested-by:
-
Torben Hansen authored
When an admin user tries to upload a file which has a fileextension that is included in the fileDenyPattern, the upload is denied. With the security fix in #51326 admin users are now able to change the extension of a file to any value, since the fileDenyPattern is not checked for admin users. This leads to the situation, that admin users can create/rename files in the filelist with a fileextension of their choice. To keep the behavior consistent, this patch re-enables the check of the fileDenyPattern for admin users in the filelist. Resolves: #60173 Releases: master, 7.6, 6.2 Change-Id: I3b819e70cf2218a4580203ac7b7a6b0c3c5087ab Reviewed-on: https://review.typo3.org/32610 Reviewed-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Nicole Cordes <typo3@cordes.co> Tested-by:
Helmut Hummel <helmut.hummel@typo3.org> Tested-by:
-
Christian Kuhn authored
To mitigate potential "unsecure unserialize()" issues, the new PHP7 feature to allow only specific classes or to totally deny object creation is rolled out throughout the core in v8. Since a lot of places use unserialize() and some are critical or hard to understand, this is done with a series of patches for single areas. This patch denies object creation at all places where $GLOBALS['TYPO3_CONF_VARS']['EXT']['extConf']['anExtension'] is unserialized() - the extension manager and ext_conf_template.txt handling never handles objects at this place, so it should be safe to deny objects at all places. Change-Id: Ie96e6fb6837418fd765f883b216b7a9c5af5795d Resolves: #76320 Releases: master Reviewed-on: https://review.typo3.org/48314 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Elmar Hinz authored
Double slash one-line comments are standard in many languages. Make them standard in TypoScript, too. Deprecated: / Line comment headed by single slash Resolves: #76104 Releases: master Change-Id: Id78391f973cdf8147bf91b269996f31d475de717 Reviewed-on: https://review.typo3.org/48051 Reviewed-by:
Frank Naegler <frank.naegler@typo3.org> Tested-by:
-
Wouter Wolters authored
Remove the second parameter of getLL and replace it with htmlspecialchars directly in the code. Resolves: #76321 Related: #71917 Releases: master Change-Id: Iaccd3e31b235632fac9022e9120a35426bd5d99b Reviewed-on: https://review.typo3.org/48320 Reviewed-by:
-
Frank Naegler authored
The MenuViewHelperTrait has been marked as deprecated. All methods of the Trait have been implemented in a new AbstractMenuViewHelper class. Resolves: #75209 Releases: master Change-Id: Ie8cad645c80c3cb7814dd2b69f22feb729334779 Reviewed-on: https://review.typo3.org/48111 Reviewed-by:
-
Elmar Hinz authored
Explain the creation and name of the variable in concise words. Resolves: #76195 Related: #76194 Releases: master Change-Id: Ifff61c38dbb4ea07f79cb42cfe7f6aca41e5fbe1 Reviewed-on: https://review.typo3.org/48132 Reviewed-by:
Olaf Schmidt-Wischhöfer <osw@eadi.org> Tested-by:
-
Andreas Fernandez authored
Use `$table` for logging instead of the hardcoded `pages` table. Resolves: #74125 Releases: master, 7.6 Change-Id: I13b4306bdc54cf461d23c401d54c04983059df46 Reviewed-on: https://review.typo3.org/48318 Reviewed-by:
-
Andreas Fernandez authored
In case `$rows` in the method `DataHandler::copySpecificPage()` is null, the foreach loop will throw an error. `$rows` may become null if an extension brings TCA but the table does not have `uid` field, for example. It's now checked whether the result being iterated is an array, otherwise an error is logged. Resolves: #74125 Releases: master, 7.6 Change-Id: I20cb101155632309b9e08600fcd33e655c1c9d2f Reviewed-on: https://review.typo3.org/48311 Reviewed-by:
-
Frank Naegler authored
Mark stdWrap_removeBadHTML as deprecated in doc comment. Resolves: #15415 Releases: master Change-Id: I4534a8b93b731f8e736752e712c0c13293b0b05d Reviewed-on: https://review.typo3.org/48313 Reviewed-by:
Elmar Hinz <t3elmar@gmail.com> Reviewed-by:
-
Wouter Wolters authored
Resolves: #15415 Releases: master Change-Id: Iac92d6d36e2a84b069fa7c4a17d2dc567d952309 Reviewed-on: https://review.typo3.org/48301 Reviewed-by:
-
Elmar Hinz authored
The PHP char() function only works reliably with ASCII codes independent of the actual char set. See http://php.net/manual/en/function.chr.php Releases: master Resolves: #76315 Change-Id: Ia87b95239fc4678f297571704f031003f84a5759 Reviewed-on: https://review.typo3.org/48306 Reviewed-by:
-
Morton Jonuschat authored
Instead of passing the simple value "1" to QueryGenerator->getTreeList() use a page permission clause created using $BE_USER->getPagePermsClause() when determining the recursive storage pids. Passing the unprocessed value "1" causes invalid SQL statements and does not perform any access checks. Releases: master, 7.6 Resolves: #75912 Change-Id: I6edadd627c0a9c01a78c3cb55805455fed710d14 Reviewed-on: https://review.typo3.org/48220 Reviewed-by:
-
Andreas Fernandez authored
It's possible to open some backend modules (e.g. RTE or EditDocumentController) in a new tab. However, the configuration for popups is missing in such case, causing e.g. opening the "Insert image" wizard of RTE is not possible anymore. Place configuration inline in TYPO3.settings to not have this problem of missing configuration. Resolves: #76285 Releases: master Change-Id: I1405dd90e4e00fc709d504af2ed0a936a6374fce Reviewed-on: https://review.typo3.org/48276 Reviewed-by:
-
- May 26, 2016
-
-
Georg Ringer authored
Due to the wrong approach of RemoveXSS it is not 100% safe and does not keep its promise. Resolves: #76164 Releases: master Change-Id: I8aa0a05f7866041f392441fa852bae5a7c202142 Reviewed-on: https://review.typo3.org/48102 Reviewed-by:
-
Markus Klein authored
Resolves: #76303 Releases: master, 7.6 Change-Id: Ia03f62ccc1c7c989a4284de36ac814758c63d288 Reviewed-on: https://review.typo3.org/48290 Tested-by:
Riccardo De Contardi <erredeco@gmail.com> Reviewed-by:
Stephan Großberndt <stephan@grossberndt.de> Reviewed-by:
Gianluigi Martino <gmartino27@gmail.com> Tested-by:
-
Helmut Hummel authored
Fluid variables must never be used in JavaScript context. Instead they should be put into data attributes, which can be accessed from JavaScript easily. Resolves: #76304 Releases: master Change-Id: I16c0d6b265ad446d73cbe285be7653d1a8ebcfd2 Reviewed-on: https://review.typo3.org/48291 Reviewed-by:
-
Helmut Hummel authored
When adding visibility information in DebuggerUtility it was not respected that this utility can also be used to output in cli. Add the missing condition and output HTML only if requested. Additionally when the property has nested objects, the visibility info must be right after the property not after every nested object. Also prettify object type output on command line on the go. Resolves: #76301 Related: #76008 Releases: master Change-Id: If82192bf9d1fb0ca1dc843242167d01b1a915f6e Reviewed-on: https://review.typo3.org/48287 Reviewed-by:
-
- May 25, 2016
-
-
Georg Ringer authored
By using the <code>-tag, the output of paths is improved: - XCLASS usage - Path to ENABLE_INSTALL_TOOL - Path to deprecation log Resolves: #76288 Releases: master, 7.6 Change-Id: I591009cd52ba1dec6d25ff135e76b7b536b84193 Reviewed-on: https://review.typo3.org/48282 Reviewed-by:
Jigal van Hemert <jigal.van.hemert@typo3.org> Tested-by:
-
Jigal van Hemert authored
The URI is HSC'd by default. Using the output unformatted produces a correct URI for use inside JS. Resolves: #76289 Releases: master Change-Id: Iec7b9aaa0a26ec9acfe6ba49924373965a989a2f Reviewed-on: https://review.typo3.org/48283 Reviewed-by:
-
Markus Klein authored
Resolves: #76296 Releases: master Change-Id: I039e031ff6f46c94d474c35c43de372cfc5b0fc2 Reviewed-on: https://review.typo3.org/48286 Reviewed-by:
-
- May 24, 2016
-
-
Markus Klein authored
The patch for #70463 introduced a regression which caused added elements to include HTML markup. Resolves: #76286 Releases: master, 7.6 Change-Id: I596602b03fd65f2e8d95171c2f2f79ff57006f14 Reviewed-on: https://review.typo3.org/48277 Reviewed-by:
Johannes Kasberger <johannes.kasberger@reelworx.at> Tested-by:
-
Helmut Hummel authored
Resolves: #76150 Releases: master Change-Id: Ia51ec33ba4aacabc884292d4a9508ce0d2c4cd9d Reviewed-on: https://review.typo3.org/48078 Reviewed-by:
-
Wouter Wolters authored
With the introduction of Doctrine DBAL the obsolete settings of all upgrade wizards related to TYPO3 CMS 7 are added again. Remove them now again. Resolves: #76258 Related: #75454 Releases: master Change-Id: Ib86591525724b2fd189038a04dfa645815f4fe55 Reviewed-on: https://review.typo3.org/48238 Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
Marvin Dettinger authored
Resolves: #76098 Releases: master, 7.6 Change-Id: I4ceb644328671cd3355340d6b6991d60e88b265a Reviewed-on: https://review.typo3.org/48046 Reviewed-by:
Christoph Kratz <ckr@rtp.ch> Tested-by:
Marvin Dettinger <mde@rtp.ch> Tested-by:
-
Helmut Hummel authored
Resolves: #76278 Releases: master, 8.1, 7.6, 6.2 Change-Id: Iedb71737ab3b69f2873292ea1cab165e0ec21cec Reviewed-on: https://review.typo3.org/48265 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Frans Saris <franssaris@gmail.com> Tested-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Tested-by:
Jan Helke <typo3@helke.de> Reviewed-by:
-
Helmut Hummel authored
Instead of only checking for valid request arguments by using a hmac, we now check the complete request including action, controller and vendor to avoid spoofing these arguments and bypassing other security checks during forwarding to the referring action. Additionally, ReferringRequest is now separate from regular Request. The meaning of properties starting with "@" is only valid for processing a referring request. To avoid mixed concerns in using the same Request implementation for regular requests and referring requests, they are separated now. Resolves: #76231 Resolves: #76256 Releases: master, 7.6, 6.2 Security-Commit: 3562e177f1720e62cab84232dcc67c580a3cc3db Security-Bulletin: TYPO3-CORE-SA-2016-013 Change-Id: Ic94e11341df98c1326dc73c92a5c9e061a64cc9e Reviewed-on: https://review.typo3.org/48258 Reviewed-by:
-
- May 18, 2016
-
-
Andreas Fernandez authored
Using `children()` to get the option tags from the select fields will fail if the select field contains `optgroup` tags (e.g. rendered by a hook). This patch replaces `children()` with `find()` to cover this edge case. Resolves: #76097 Releases: master, 7.6 Change-Id: Ib80f422d465d9e48232b1820e524a01a97eb94e6 Reviewed-on: https://review.typo3.org/48044 Reviewed-by:
Daniel Goerz <ervaude@gmail.com> Reviewed-by:
-
Andreas Fernandez authored
The message in the extension manager that notices about installing a conflicting extension contains HTML. As all output is encoded by default, the HTML is obviously also encoded. Wrap the text in `f:format.raw` to decode the HTML and get a functional list again. Resolves: #76214 Releases: master Change-Id: I0b31b907d95679b528a2dc8422cd41c497fe8ec3 Reviewed-on: https://review.typo3.org/48202 Reviewed-by:
-
Tomita Militaru authored
Removes the htmlspecialchars from the rendering of page content titles / tooltips. Resolves: #76149 Releases: master, 7.6 Change-Id: Ia5ad3df56101fe3962e4a5814df53dabdf5a4bbc Reviewed-on: https://review.typo3.org/48106 Reviewed-by:
-
Helmut Hummel authored
Instead of calling the driver registry on every request, we can cache the TCA addition, by putting the call into overrides. Resolves: #76102 Releases: 7.6, master Change-Id: I8cfc72f0e7dbb133eecc754fd3cb774637a0d4bf Reviewed-on: https://review.typo3.org/48047 Reviewed-by:
-
- May 17, 2016
-
-
Oliver Hader authored
Issue #75022 reported problems with libxml and operations on compressed file streams. The work around for that patch showed drawbacks with memory consumption. That's why the push parser is used as default now. Resolves: #75721 Related: #75022 Releases: master, 7.6, 6.2 Change-Id: I6daadd4b375634cf45272bb249e4bfa083f03646 Reviewed-on: https://review.typo3.org/48189 Reviewed-by:
-
Markus Klein authored
Uploaded files must be moved with the specific PHP function, otherwise permissions may be wrong. Resolves: #76205 Releases: master, 7.6 Change-Id: Ic96e6b8927ed5d21131952004805fa72fb8b6857 Reviewed-on: https://review.typo3.org/48181 Reviewed-by:
-
Oliver Hader authored
This reverts commit 3d449f91. This change did not completely solve the libxml issue and introduced additional trouble on memory consumption with the current pull parsers. Related: #75022 Releases: master, 7.6, 6.2 Change-Id: I42454d61ab444860fc53b29715df69e65a2f0475 Reviewed-on: https://review.typo3.org/48182 Reviewed-by:
-
- May 16, 2016
-
-
Andreas Fernandez authored
The exceptions show now the affected class that does not implement the required interface. Where possible, the FQCN in the exception message string was replaced with the shorter ::class syntax. Resolves: #76187 Releases: master, 7.6 Change-Id: Id2c290a0cf29bdec5da504a8959996bb747f1c27 Reviewed-on: https://review.typo3.org/48115 Reviewed-by:
-
Adrian Mot authored
- Use expectedException() and expectedExceptionCode() instead of deprecated setExpectedException() - Fix a couple of incomplete tests in core/Http section, add some and slightly refactor a bit Resolves: #76159 Releases: master Change-Id: I3333f94494ce76601a61e4b5286cfef982867f8f Reviewed-on: https://review.typo3.org/48091 Reviewed-by:
Adrian Mot <adrian.mot@gmail.com> Tested-by:
-
- May 12, 2016
-
-
Wouter Wolters authored
Resolves: #76173 Releases: master Change-Id: I2a273c0e3ab4d4fad7db11ebad84fe00ca4493a1 Reviewed-on: https://review.typo3.org/48108 Reviewed-by:
-
Adam Marcinkowski authored
* Add fixture with categories * Add test to check if categories are visible in list module * Add test to check if category is editable Releases: master Resolves: #76162 Change-Id: Ia518e059d23238f52f79224acffccd21bf8aaa88 Reviewed-on: https://review.typo3.org/48096 Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Tomita Militaru authored
Adds support in the media field for opensource formats: * ogg * flac * opus Resolves: #76072 Releases: master Change-Id: Ie17e1572a5eeb8d4b8954158e4a62e0b54ec6e86 Reviewed-on: https://review.typo3.org/48086 Reviewed-by:
Sebastian Fischer <typo3@evoweb.de> Reviewed-by:
-
Andreas Fernandez authored
The original patch introduced some regressions which are fixed now: - Deletion of multiple items works correctly now - Inserting items by the Element Browser does not throw an error anymore Resolves: #76071 Releases: master, 7.6 Change-Id: Ie16a1d404c2f12e6c952dc5022caff08ec6af171 Reviewed-on: https://review.typo3.org/48062 Reviewed-by:
Tomita Militaru <militarutomita@gmail.com> Reviewed-by:
-
