Releases: main, 12.4, 11.5
Resolves: #100982
Change-Id: I3cfe29c8a3a3215c8a284681738b5bed152db14d
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79222


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>

A database query was executed when creating a scheduler
task which fetched all optimizable tables.

This was executed with the wrong type in createNamedParameter
(string instead of string array) and resulted in exception in
some scenarios (with MySQL, with additional table mappings).

The problem is now fixed.

Resolves: #100979
Releases: main, 12.4, 11.5
Change-Id: Id5119b9fb07c68baf33fdf4f48e584fec0284455
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79253


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>

This change adds basic support for PHP8.3 to
`Build/Scripts/runTests.sh`. That is done to
get an early chance to evaluate how the core
is behaving against the upcoming PHP version.

Note, no ci runs added for now. First current
existing issues should be fixed first to make
tests green before enabling it for CI runs.

Resolves: #100984
Releases: main, 12.4, 11.5
Change-Id: Icefa0a83f860672ff0d688acb1968185e0bc3053
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79248


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: Stefan Bürk <stefan@buerk.tech>

If the mode is not specified in the configuration,
the default must be used.
The defaultOption can only be retrieved
if the `parseOption` method is used.

Resolves: #100969
Releases: main, 12.4, 11.5
Change-Id: I6b6da6ff9053776b80947b97b084d47d88114b97
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79238


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>

This is relevant for the generated documentation.

Resolves: #100953
Releases: main, 12.4, 11.5
Change-Id: Iaa68d1cb21d399f326341cce2b12514a5402e45e
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79131


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Benni Mack <benni@typo3.org>
Tested-by: Benni Mack <benni@typo3.org>

The parent folder could theoretically be an InaccessibleFolder
according to the return type annotation, but only Folder has the method
"getCombinedIdentifier".

Resolves: #100920
Releases: main, 12.4, 11.5
Change-Id: Ida8ade208279535c06af586b86413787339c5991
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79158


Reviewed-by: Nikita Hovratov <nikita.h@live.de>
Tested-by: Nikita Hovratov <nikita.h@live.de>
Tested-by: core-ci <typo3@b13.com>

The update brings PHP 7 typehints to guzzlehttp/promises.
guzzlehttp/guzzle mainly raised for guzzlehttp/promises v2
compatibility, but also contains a bugfix for SetCookie::fromString.

> composer require -W guzzlehttp/guzzle:^7.7.0
> composer require guzzlehttp/promises:"^1.5.2 || ^2.0"
> composer require --no-update guzzlehttp/promises:"^1.5.2 || ^2.0" \
 -d typo3/sysext/install/
> composer require --no-update guzzlehttp/guzzle:^7.7.0 \
 -d typo3/sysext/core/

Step 1
- Upgrading guzzlehttp/guzzle (7.5.0 => 7.7.0)
- Upgrading guzzlehttp/promises (1.5.2 => 1.5.3)
- Upgrading guzzlehttp/psr7 (2.4.3 => 2.5.0)
- Upgrading psr/http-client (1.0.1 => 1.0.2)
- Upgrading psr/http-factory (1.0.1 => 1.0.2)
- Upgrading psr/http-message (1.0.1 => 1.1)

Step 2
- Upgrading guzzlehttp/promises (1.5.3 => 2.0.0)

Resolves: #100919
Releases: main, 12.4, 11.5
Change-Id: I3183f2619a060ec768646b1c4a97fdf937312514
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79157
Tested-...

Avoid exceptions by casting the values to integers.

Resolves: #100916
Releases: main, 12.4, 11.5
Change-Id: Icb1eeef44b11f3134bec2b5cb036049c8cfbd620
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79125


Tested-by: core-ci <typo3@b13.com>
Tested-by: Georg Ringer <georg.ringer@gmail.com>
Reviewed-by: Georg Ringer <georg.ringer@gmail.com>

This is a preparation patch for a guzzlehttp/guzzle and
guzzlehttp/promises raise.

Resolves: #100918
Releases: main, 12.4, 11.5
Change-Id: I9a2731ade87de8f54b2e3c0e375dde1609e35e2a
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79122


Tested-by: Nikita Hovratov <nikita.h@live.de>
Reviewed-by: Nikita Hovratov <nikita.h@live.de>
Tested-by: core-ci <typo3@b13.com>

Typo3DbQueryParser ignored records with no child records in some cases.

This is mitigated by adding a correct WHERE condition
for the match-field/parent evaluation.

This effects TCA relations with
MM_match_fields, foreign_match_fields or foreign_table_field.

Resolves: #93337
Releases: main, 12.4, 11.5
Change-Id: Id4804ccb93252be32666ba74aa7c03dab25e6a92
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79145


Tested-by: core-ci <typo3@b13.com>
Tested-by: Georg Ringer <georg.ringer@gmail.com>
Reviewed-by: Georg Ringer <georg.ringer@gmail.com>

* PHP exceptions were logged with level "info"
  in the `sys_log` table
* PHP errors were logged with wrong (numeric)
  error level in the `sys_log` table

Only values from `\Psr\Log\LogLevel` are allowed
and usable. Numeric values can not be used or
filtered in BeLog backend module.

Releases: main, 12.4, 11.5
Resolves: #100830
Change-Id: Ie35fe291ac74edd4173e096b8d12609d32c45e02
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79116


Tested-by: core-ci <typo3@b13.com>
Tested-by: Anja Leichsenring <aleichsenring@ab-softlab.de>
Reviewed-by: Anja Leichsenring <aleichsenring@ab-softlab.de>

The Fluid ViewHelper `f:uri.page` will now cast argument `pageType` to
int before using it.

Resolves: #100845
Releases: main, 12.4, 11.5
Change-Id: Ifbda5befa0757975c20411bfac2549a3affab9bf
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79132


Tested-by: core-ci <typo3@b13.com>
Tested-by: Anja Leichsenring <aleichsenring@ab-softlab.de>
Reviewed-by: Anja Leichsenring <aleichsenring@ab-softlab.de>

This is an edge-case, where `config.index_enable = 1` is set, but the
static TypoScript from indexed_search is not included and thus
`config.index_externals` is undefined.

Resolves: #100888
Releases: main, 12.4, 11.5
Change-Id: I0b9fa04970812ca82edc4d223cd57e59e3a2ed83
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79070


Tested-by: core-ci <typo3@b13.com>
Tested-by: Nikita Hovratov <nikita.h@live.de>
Reviewed-by: Nikita Hovratov <nikita.h@live.de>

Resolves: #100883
Releases: main, 12.4, 11.5
Change-Id: I89f566a1bdf45f214a175cd389ef143c6334cda3
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79056


Tested-by: Anja Leichsenring <aleichsenring@ab-softlab.de>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de>
Reviewed-by: Anja Leichsenring <aleichsenring@ab-softlab.de>

Fix some left-over places where an int-cast
is possibly necessary to avoid PHP warnings.

Resolves: #100866
Releases: main, 12.4, 11.5
Change-Id: If9111e0c2e2de8c90a94202cf518abdbe8c987fb
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79036


Tested-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>

Issue #93884 provided and adjusted CSP header for SVG inline styles:
| default-src 'self'; script-src 'none';
| style-src 'unsafe-inline'; object-src 'none';

For SVG files, having 'unsafe-inline' for style-src is fine, since
it only applies to the very same file and cannot include other local
or remote resources.

Resolves: #100041
Releases: main, 12.4, 11.5
Change-Id: I198e0a8225ef6c0e729a3ae78981581b2d2b2205
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79033


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

A new patch level requires to regenerate baseline.

> composer req --dev phpstan/phpstan:^1.10.15
> Build/Scripts/runTests.sh -s phpstanGenerateBaseline

Change-Id: I50afb973f762f3a4f30105d3cac4445fb81f71df
Resolves: #100850
Releases: main, 12.4, 11.5
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79014


Tested-by: core-ci <typo3@b13.com>
Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>

Change-Id: Ieecc273236bdbf857b543fbe9932cc9b3e5e352b
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78999


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Benni Mack <benni@typo3.org>
Tested-by: Benni Mack <benni@typo3.org>

Change-Id: I558ff721e36d73c28ff8e5849f6fb59d1d50311d
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78998


Tested-by: Benni Mack <benni@typo3.org>
Reviewed-by: Benni Mack <benni@typo3.org>

Use an empty string instead of null as default value
for username and password to avoid warnings with PHP8.

Resolves: #100739
Releases: main, 12.4, 11.5
Change-Id: Ie06431f27cab919a7df8467f1b5711d7b2b42291
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78997


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

Resolves: #100824
Relates: #100739
Releases: main, 12.4, 11.5
Change-Id: I91bf93adbf390e84beda871c399f4785a83d8571
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78993


Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

Resolves: #82481
Releases: main, 12.4, 11.5
Change-Id: Ieffc20f64cac7b546e20964e5f0deeab6e523771
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78966


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Nikita Hovratov <nikita.h@live.de>
Tested-by: Nikita Hovratov <nikita.h@live.de>

In case a site is missing a proper site
configuration - having no default language
a fallback SiteLanguage object is used in
the page module. This fallback however does
provide an empty string as flag identifier,
which does no longer result in a broken icon.

Resolves: #100799
Releases: main, 12.4, 11.5
Change-Id: I23f3d9347d2ea8a63520086054b9fa842a9f5cfd
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78945


Reviewed-by: Nikita Hovratov <nikita.h@live.de>
Tested-by: Nikita Hovratov <nikita.h@live.de>
Tested-by: core-ci <typo3@b13.com>

The mime type 'audio/x-wav' must be added to the AudioTagRenderer to
render those files as audio file.

Resolves: #100138
Releases: main, 11.5
Change-Id: Icce1698f2de725161fc5add2b711a8b764ee6c59
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78894


Tested-by: Benni Mack <benni@typo3.org>
Reviewed-by: Benni Mack <benni@typo3.org>

When defining a default value in column overrides
e.g. for tt_content TCA field sys_language_uid
this value from TCA will override the value that will
be set via the page module when adding a content
element for a different language, because the change
introduced in #86876 does not respect default values
that are set via defVals (which are passed to form engine
as defaultValues)

A check if such values are set is now added, so that
the fix for #86876 will still work, but default values set
via editing forms are also respected

Resolves: #99381
Releases: main, 11.5
Change-Id: Ib4270665b396bbe520afb21a7f145d0d549305ac
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78893


Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Oliver Bartsch <bo@cedev.de>

Properly check for the given value being an object before
passing it to corresponding method, which is type-hinted
since #100068.

Resolves: #100774
Related: #100068
Releases: main, 11.5
Change-Id: I704ef93ebbbfd1f161bf56dd7ef0058bd2b4875d
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78918


Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Oliver Bartsch <bo@cedev.de>
Tested-by: core-ci <typo3@b13.com>

This helps static analysis of projects using this class.

Resolves: #100778
Releases: main, 11.5
Change-Id: I41cbf38477fb6743e5039dd9905ed38be81e96fc
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78915


Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>

Resolves: #100770
Releases: main, 11.5
Change-Id: I549371e78de399195d6810858d337528f39ce0ad
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78892


Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Oliver Bartsch <bo@cedev.de>

The list of ids generated by `getSearchableWebmounts()` may contain
duplicated values being passed into an `IN()` criteria, causing
additional load to the database server.

The values are now de-duplicated by applying `array_unique()` onto the
list before passing the list around.

Resolves: #100750
Releases: main, 11.5
Change-Id: Ib49bf1a5903cca2fbaa12ea240050caa7908f69c
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78874


Tested-by: core-ci <typo3@b13.com>
Tested-by: Andreas Fernandez <a.fernandez@scripting-base.de>
Reviewed-by: Andreas Fernandez <a.fernandez@scripting-base.de>
Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de>

Resolves: #100742
Releases: main, 11.5
Change-Id: Ibff1f2da48192a23d3fe6e5404c95f3b7e6c8ae8
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78852


Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de>
Tested-by: Georg Ringer <georg.ringer@gmail.com>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Georg Ringer <georg.ringer@gmail.com>

With #100720 the AbstractExceptionHandlers
const IGNORED_EXCEPTION_CODES was set from private
to public in order to allow to use it in subclasses.

However, public is making this a full public API,
which should be within the ExceptionHandler logic
in general.

For this reason, the constant is now changed from
public to protected.

Resolves: #100736
Relates: #100720
Releases: main, 11.5
Change-Id: I58427977c2217792ae854738f59527bdb2e8339e
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78736


Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: core-ci <typo3@b13.com>

Body content generation may be triggered by calling some getter or
indirectly when the mail is sent (via `ensureValidity`).

This changes ensures that multiple tries to generate the body are only
executed if the state of the view has actually changed.

This enables extensions to manipulate the content of an e-mail via
events without getting their changes overridden again when the mail is
sent.

Resolves: #99944
Releases: main, 11.5
Change-Id: I5eced5710feeb66e6f1e32f10f710d388bc43a62
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78251


Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Markus Klein <markus.klein@typo3.org>
Tested-by: core-ci <typo3@b13.com>

The variable $row['url_response']['errorParams'] should always contain
a value. Either the actual error message array or an empty array to
avoid a PHP 8 warning.
The corresponding getErrorMessage methods now have a guard clause to
check if the array is empty to avoid further propagated warnings.
In TYPO3 v13 that signature of the getErrorMessage should be changed to
be array.

The array $errorParams is always initialized to an empty array instead
of null. IN TYPO3 v13 the default value of $errorParams should be []
instead of null.

Resolves: #99988
Releases: main, 11.5
Change-Id: I0f7e10f45e0f5ec7e80b79d705b38fda9a3f1410
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78812


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: Stefan Bürk <stefan@buerk.tech>

This makes AbstractExceptionHandler::IGNORED_EXCEPTION_CODES public accessible in order to re-use it in custom error handlers.

Resolves: #100720
Releases: main, 11.5
Change-Id: Id9217d3bbf3b66982adceb485918e52bb5cddd56
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78735


Tested-by: Benni Mack <benni@typo3.org>
Reviewed-by: Benni Mack <benni@typo3.org>
Tested-by: core-ci <typo3@b13.com>

Illegal requests should not fill log files.

The Exception is thrown in \TYPO3\CMS\Core\Http\Request::validateMethod()

Resolves: #100718
Releases: main, 11.5
Change-Id: I202fba9e76ac00ab11e02dc401633b383b0048b6
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78734


Reviewed-by: Benni Mack <benni@typo3.org>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Benni Mack <benni@typo3.org>

The redirect evaluation is currently always processed no matter if
a `redirectMode` based on the referer is configured or not. Also, given
referers are checked for validity using `RedirectUrlValidator`, which
logs a message in the TYPO3 log with the log level `warning` if the given
URL is considered as invalid.

This patch adds a check to the referer evaluation, so it is only processed,
if a redirect mode supporting the referer is active. Additionally, the log
level for invalid redirect URLs in `RedirectUrlValidator` is changed to
`debug`, since a warning is not appropriate for invalid redirect URLs.

Resolves: #100197
Releases: main, 11.5
Signed-off-by: Torben Hansen <derhansen@gmail.com>
Change-Id: I10d1723de131e0387f7dd2103c8a1ca21ed015e5
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78733


Reviewed-by: Benni Mack <benni@typo3.org>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Benni Mack <benni@typo3.org>

Prior to #93240 URL routes were reverse sorted using the corresponding
site identifier (which did not contain any URL information). For the
scenario of matching undefined URLs (e.g. base URL is "/website/", but
request was like "https://example.org/"), the first item of a reverse
sorted list was used.

Resolves: #99149
Related: #93240
Releases: main, 11.5
Change-Id: Ia242591cebfba7d8221494a5d214f6dca75a00fc
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78794


Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: core-ci <typo3@b13.com>

Remove any modification done to Context by the
RedirectHandler/RedirectService in order to have a
proper rendering of FE in case no valid redirect
is found (circular).

Resolves: #100654
Releases: main, 11.5
Change-Id: I7fb0c1ac9619d7599151e57cbcacc916deee41c5
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78722


Tested-by: core-ci <typo3@b13.com>
Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>

Whenever a scheduler task fails during execution
via CLI `scheduler:run`, the error message is
now always written to stderr.

This gives the task executor (e.g. cron) a chance
to identify any failures, if even stdout is
redirected to /dev/null.

The task-loop is adapted to avoid (ab)using
exceptions for control-flow (for loop-abortion).
It instead now uses nullables to signal that
not finding a next-task is expected behavior,
not an exception.

Also the exit code of the command is adapted
to switch to 1 in case at least one error
occured. (This is important in case the cronjob
is executed as systemd-timer)

Resolves: #87806
Releases: main, 11.5
Change-Id: I0b55bab7fcd916209114d9e3e07f54c7243ce9a5
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78220


Tested-by: core-ci <typo3@b13.com>
Tested-by: Benjamin Franzke <benjaminfranzke@gmail.com>
Reviewed-by: Benjamin Franzke <benjaminfranzke@gmail.com>

The dimensions available in `CropperEvent` are fractions in some cases,
that probably happens when an image gets upscaled. This causes issues
as those dimensions are apparently adjusted downward in the cropper
library, resulting in dimension reduced by 1px. To solve this issue,
`Math.ceil()` is applied to round up incoming dimensions.

Resolves: #96722
Releases: main, 11.5
Change-Id: I537bccd32a634805a37957bea59ec51e5e856272
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78769


Reviewed-by: Andreas Fernandez <a.fernandez@scripting-base.de>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Andreas Fernandez <a.fernandez@scripting-base.de>