- Aug 04, 2020
-
-
Christian Kuhn authored
composer require --dev typo3/testing-framework ^6.3.3 Mostly brings a bugfix of the functional test splitter, relevant for bamboo but relevant and v10, and a deprecation removal preparation for master. Change-Id: I0de875483ba0997f91071242b4d4aa5f9c1398e6 Resolves: #91926 Releases: master, 10.4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65179 Tested-by:
TYPO3com <noreply@typo3.com> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
- Aug 03, 2020
-
-
Benni Mack authored
The information in the sys_file_storage record created automatically should not be persisted as "auto-created" as 90% of the people do not modify this, and it is only confusing to see this information in the filelist without having a good and explained way to change this. Instead "fileadmin" (taken from $GLOBALS['TYPO3_CONF_VARS']['BE']['fileadminDir']) is used when creating the default storage. This was originally added by myself when introducing FAL in 6.0, and never touched, however feedback from newcomers shows that this should be adapted. Resolves: #91921 Releases: master Change-Id: I675ef7818aa6a83191574131f54c1c2b6f490e41 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65151 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
-
Benni Mack authored
The information in the dropdown of the page module "Make new translation of this page" is not very common across native-english speakers, instead the label should be called "Create a new translation of this page". Resolves: #91922 Releases: master, 10.4 Change-Id: Ifa27090741d73ba363e112a8d5f5cdaa23638bcf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65172 Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
Benni Mack authored
The patch drops handling and existence of two further workspaces related db fields: * t3ver_tstamp has been occassionally set to 'now' when records in a workspaces were edited. However, the field was never displayed in the backend and is of little use since it only holds only a 'last' value. A change history on workspace records is available through the 'info' button in the workspace module. This is powered by sys_history and shows modifications with date/time. * t3ver_count is also never rendered in the backend. It has been used in the (non-default) 'swap' workspace actions where live records become the new workspace records. The field was then incremented by one. The loose wording around that is, it's an 'archived' record. However, if swapping a second time, the workspace record does not count two as one would expect, but still one. Only after another swap, the workspace record would have the value two in this field. Together with the fact this field has never been shown/used, the weird behavior, and that swapping is an uncommon case that needs to be explicitely enabled and used, the field is dropped now. Resolves: #89137 Releases: master Change-Id: I7cdfe6e867c14462395d7398123b14464835c1bf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65145 Tested-by:
-
Benni Mack authored
A new TER Extension "legacy_collections" has been added to FriendsOfTYPO3 which contains DB tables and TCA definitions for "sys_collection" and its MM relation table. The functionality was originally intended with the introduction of taxonomy and FAL File relations (which are stored in sys_file_collection) to be used as a generic TCA store for collections, which was never picked up in the past 8 years. A personal survey of several installations showed that almost none of the TYPO3 instances have the database tables filled, making this unneeded code and database code, for only a handful of people. Instead of providing the database tables by default in all installations, the database tables and their TCA definitions are now available in a separate extension "legacy_collections", which serves as a drop-in replacement for everybody who needs this API and the database tables. An update wizard checks if the sys_collection database table is filled, and allows to install this extension. The new extension is compatible with TYPO3 v10, so it should ease the migration path. Resolves: #91909 Releases: master Change-Id: I85d53cc7969f9f9ce93311dd483be31735bf8c05 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65147 Tested-by:
-
Anja Leichsenring authored
Language handling always bases on the existence of a page version for the requested language. If this is not available, handling follows fallback settings. Functional Tests that test for translated content to be returned as expected must provide such a translated page on their own, else the fallback handling kicks in, renders the test falsly reassuring. Resolves: #91905 Releases: master, 10.4, 9.5 Change-Id: I77d1e096cd0e62134ffd818f8bd32667e566d44a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65146 Tested-by:
-
- Jul 31, 2020
-
-
otherpaco authored
The example of how to use the FormProtectionFactory in frontend context uses non-matching arguments making the whole code example harder to understand. This patch adjusts the ReST document to use the same arguments in validateToken() as in generateToken() to make the connection to these methods more clear. Releases: master, 10.4, 9.5 Resolves: #91895 Change-Id: Ie1cff9df38295c08926699af29b4698e1f49d47e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65142 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
-
Anja Leichsenring authored
The added styles avoid icons to be rendered too big to properly serve as icons. Resolves: #91868 Releases: master, 10.4 Change-Id: I49e24e6906668a270f23a8f820fb1c116e8d323f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65113 Tested-by:
-
Anja Leichsenring authored
The TCA ctrl transOrigDiffSourceField database field, often called 'l18n_diffsource', stores information if a default or source language record of a translated record has been changed. This is used to hint editors with "The record you translated from has been changed, maybe an update of the translation is needed" in FormEngine. The storage format of that field is a serialized PHP string. This is no active, but a potential, general security risk. To mitigate this, the storage format is changed to a json string with the patch, including an install tool database updater taking care of existing rows. Resolves: #91906 Releases: master Change-Id: Ib7e2a6128730eebd941ec8a565e72fd7a05d225d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65068 Tested-by:
-
Christian Kuhn authored
Deleting a sys_workspace record currently fetches all live records as to-delete candidates while only records of the according workspace should be considered. Luckily, a check at a later point prevents live records from being deleted, though. The huge amount of records however stresses DataHandler and database a lot. This is a regression of the 'pid -1 gone' patch from a broken database restriction. The patch fixes the where clause and adds a functional test to verify correct records are deleted. Two todos in the test csv mark inconsistent details, those could be handled with a different patch that should review and increase test scenario coverage of version_WSID() first. Resolves: #91881 Related: #89555 Releases: master, 10.4 Change-Id: I6e1edcb3a91dbbb3104ff5656e71cc0f12bf4f1c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65136 Tested-by:
-
Daniel Siepmann authored
As data is fetched from database, it might not be of proper types, e.g. when using sqlite. Therefore ensure returned value is of expected type. Resolves: #91894 Releases: master, 10.4, 9.5 Change-Id: Ie7fefafa8978c0a01755a8e7c749ed7010697f8d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65139 Tested-by:
-
Michael Telgkamp authored
When collapsing or expanding all nodes of a category tree the script tried to change attributes of non existing DOM nodes. This is not required, so there is a check if the node exists. On node generation the correct attributes are set for the node. Resolves: #91779 Releases: master, 10.4 Change-Id: I21b820bbd7bd211f0e30e880e978415391344df1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65065 Tested-by:
-
- Jul 30, 2020
-
-
Andreas Fernandez authored
To improve the event handling in the browsers, events that don't need to listen to `document` have been restructured to listen either directly on an element or to their respective nearest common element instead. To increase UX, an event listener has been removed from Topbar which closes the whole overlay when closing a sub menu in mobile view. Another, redundant event listener has been removed as well. As a drive-by bugfix the mouse cursor position used for context menus is now fetched and stored every 50ms only. In a later iteration this behavior may change completely. Resolves: #91642 Releases: master Change-Id: I7650828e0bc29a298cdaeb7c7bdfd0c1720818d8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64875 Tested-by:
-
Andreas Fernandez authored
A new condition is added to the `CreateSiteConfiguration` DataHandler hook which avoids the creation of a new site configuration for localizations of root pages. Resolves: #91845 Releases: master, 10.4 Change-Id: Ic51ba62600f4304920b66afe53b66e598404a104 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65091 Tested-by:
-
Benni Mack authored
The about system extension is responsible for the log-in screen (if EXT:dashboard is not installed), and despite having just one single controller, EXT:backend is depending on the extension / module when EXT:dashboard is not installed. To help newcomers reduce the number of (from their PoV) extensions that need to be installed via composer, or need to be upgraded, this package is moved into EXT:backend. Resolves: #91888 Releases: master Change-Id: I3e37ba9d9dbc850d1ae0f2c7b345e3526d35029d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65036 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
- Jul 29, 2020
-
-
Christian Kuhn authored
Selecting a page and records on the page to be discarded in the workspace module can lead to log entries that records could not be deleted. This can happen when discarding (deleting) a page that only exists in the workspace already has deleted records on the page. The explicit call to delete single records then creates this log. The solution is to ask the DataHandler if the record in question has already been deleted to avoid deletion in this case. Additionally, the log entry now contains the table:uid to make it more useful in case it pops up again. Resolves: #61719 Releases: master, 10.4 Change-Id: I8fee34fad2484e9e656bcb5ff611a91374127d94 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65132 Reviewed-by:
Daniel Goerz <daniel.goerz@posteo.de> Tested-by:
-
Christian Kuhn authored
Discarding records in the workspace module may lead to 'You do not have edit access' log entries. The issue is hard to reproduce without the table name and uid in the log. The patch changes the log entry to contain this info. This is similar to the log entry change for issue #61719. Resolves: #69310 Related: #61719 Related: #91881 Releases: master, 10.4 Change-Id: I0da0d13cb6be193f17835bedc1027dbf6559a796 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65135 Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Simon Gilli <typo3@gilbertsoft.org> Tested-by:
-
Anja Leichsenring authored
Per convention, extbase controllers define first fields, then inject methods, then initialize methods. All other functions follow behind. In order to ease reading in this big class, the lost order following this convention is restored. Resolves: #91877 Relates: #89554 Releases: master, 10.4 Change-Id: I7b4e0f16e0c5266d3d6ed93952f929deb3b5cc6c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65121 Tested-by:
-
- Jul 28, 2020
-
-
Oliver Hader authored
Cryptographic hashes being calculated from and for query parameters must only be used for a specific use-case or scope in order to avoid resulting hashes being ambiguous. Resolves: #91689 Releases: master, 10.4, 9.5 Change-Id: I59ca16fe71e27195b98a822607aab564425d248d Security-Bulletin: TYPO3-CORE-SA-2020-008 Security-References: CVE-2020-15098 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65127 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Oliver Hader authored
The file deny pattern is applied to public eID API to mitigate the possibility to retrieve configuration stored in PHP files (like for instance typo3conf/LocalConfiguration.php). Resolves: #91754 Releases: master, 10.4, 9.5 Change-Id: Iaba30dcf9c7c90e2d78507c6c72a420ea53198a1 Security-Bulletin: TYPO3-CORE-SA-2020-007 Security-References: CVE-2020-15099 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65126 Tested-by:
-
- Jul 27, 2020
-
-
Anja Leichsenring authored
The extensionScannerRstFileReferences check expects rstFiles listed in first level of the configuration array. ConstructorArgumentMatcher puts them in the second level. Thus, no files are found during the check, indicated by PHP warnings. The rstFiles given to ConstructorArgumentMatcher have never been checked due to this incompatibility. Resolves: #91866 Relates: #90722 Releases: master, 10.4, 9.5 Change-Id: I36abbef7e1eb5af372a8655d4a3d593f298fa404 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65089 Tested-by:
-
Andreas Fernandez authored
This patch removes a lot of either unused or superfluous CSS code. Some stuff seems to have travelled in time to stay present, e.g. a star hack for IE or code affecting ExtJS which was removed in v9. The class `form-field-inputlink-explanation` was in use but has been removed nevertheless as it had no effect since we have Bootstrap in place. Resolves: #91867 Releases: master, 10.4 Change-Id: Idc2dd3fa46d393024abce80b46f796f3de867ee2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65112 Tested-by:
-
Benni Mack authored
ObjectManager is not used anymore in ExtensionManager, except for e.g. Controllers and Repository logic. Resolves: #91799 Releases: master Change-Id: I7ac2bb32ee9e2f27850137107f308003f75baa45 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64789 Tested-by:
-
Torben Hansen authored
Remove an outdated reference to the user agent in the description of [FE][lockIP] and [FE][lockIPv6]. Session locking is not based on the user agent anymore. Resolves: #91869 Releases: master, 10.4, 9.5 Change-Id: I4f5f5e42571ef02fff78d6e2cc3511b0a42e719e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65115 Tested-by:
-
Stephan Großberndt authored
This patch fixes the SQL query retrieving the failed login attempts which was broken due to a missing GROUP BY statement on PostgreSQL and MySQL when using strict mode. Additionally the performance has been improved by reversing the order of query executions: The failed attempts are now only retrieved if more than $max allowed failures have been recorded. Resolves: #91649 Releases: master, 10.4, 9.5 Change-Id: I1778e74cd4fc820d7fd330794b61f068babb9206 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64899 Tested-by:
Helmut Hummel <typo3@helhum.io> Reviewed-by:
Xavier Perseguers <xavier@typo3.org> Reviewed-by:
-
Benni Mack authored
If adding a message to the TimeTracker (for admin panel) in the ErrorHandler fails, that error fails silently now. This can happen when e.g. instanstiating logging fails due to file permission errors. Resolves: #84654 Releases: master, 10.4 Change-Id: Iba0949539d3b8c315f9d16335e62da59be0adc11 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65069 Tested-by:
-
Nicole Cordes authored
This patch adds the current selected value in the parents selectbox if no uid is set in its data attributes. This ensures that the value is removed from the option list on adding the inline element. Resolves: #91863 Releases: master, 10.4 Change-Id: I9adb35208dbf4f80db12b766ff273aaa27927a6d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65084 Tested-by:
Nicole Cordes <typo3@cordes.co> Tested-by:
-
- Jul 25, 2020
-
-
Stephan Großberndt authored
This patch fixes the SQL query retrieving the statistics in the indexed_search backend module for pages containing subpages when using PostgreSQL by making sure the IN clause only contains a plain int array instead of a multidimensional one (which MySQl appears to cope with without issues surprisingly). Resolves: #91659 Releases: master, 10.4, 9.5 Change-Id: Ic64e7da033299a4406559c39f9f341c645b95eba Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64901 Tested-by:
-
Christian Kuhn authored
This fixes an issue that has been in the core "since ever": Have a localized page with localized records on it. If the page localization is deleted (for instance via list module), its localized records are NOT marked as deleted. They are not shown anymore since the localized page record is gone, but they're still there. If later a localization of this page with the same sys_language_uid is created again, the records magically reappear. The patch changes DataHandler->deleteSpecificPage() to delete localized records of localized pages correctly for the sys_language_uid in question if the table is localization aware. An edge case within workspace is handled to suppress the cascading delete while swapping pages. Resolves: #90447 Releases: master, 10.4, 9.5 Change-Id: Iea44deeea929f165c717d17e6b997ff6bb829847 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65067 Tested-by:
-
- Jul 24, 2020
-
-
Simon Gilli authored
During the removal of the class aliases the configurations in the core extensions were not removed. This patch removes the references to the deleted ClassAliasMap.php files from the composer.json of the related core packages. Resolves: #91861 Related: #91539 Releases: master Change-Id: I34a10165a7e17ed6e90ed483d9b34fa5e93532f4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65082 Tested-by:
-
Helmut Hummel authored
Currently the dev dependency ocramius/package-versions does not work with Composer 2. To overcome this, Composer published an API compatible package which can be used as replacement. This does not affect any published package. It is only a preparation to be able to switch to Composer 2 for testing and packaging. composer req --dev composer/package-versions-deprecated --no-update composer up typo3/cms-composer-installers composer/package-versions-deprecated ocramius/package-versions Releases: 10.4, master Resolves: #91864 Change-Id: I943cb07486f444c1d971afcde37c0d5fe2becd13 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65085 Tested-by:
Frank Nägler <frank.naegler@typo3.org> Reviewed-by:
Manuel Selbach <manuel_selbach@yahoo.de> Reviewed-by:
-
Anja Leichsenring authored
The famous runTests.sh script misses an example on how to run a filtered set of tests only in a given test file. This comes in handy, when the wanted method name is not unique in the set of tests. By adding an example to the help text of the script, users can run only their wanted test more easily. Resolves: #91856 Releases: master, 10.4, 9.5 Change-Id: I2cf5c6f3e8d29ed9505bc52b10be3e22c65e0842 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65080 Tested-by:
-
Nicole Cordes authored
This patch adds the missing css class to get the "add new relation" button for IRRE selector fields working again. Resolves: #91839 Releases: master, 10.4 Change-Id: I1cb3ff34db608eb826f4e351850bf78f2bbe4e27 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65070 Tested-by:
-
- Jul 23, 2020
-
-
Christian Kuhn authored
Since #89555 versioned records do not have pid=-1 set anymore, but the uid of the live page or live placeholder record. The translation modal of the page module to create records for a translated page now shows records twice. Solution is to use the correct database restriction to suppress retrieval of versioned records of the translation source, those are handled via BackendUtility::workspaceOL() already. Resolves: #91851 Related: #89555 Releases: master, 10.4 Change-Id: Ia5262d3b25687c96f68389f5e8b49ec287c094e6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65076 Tested-by:
David Steeb <david.steeb@b13.com> Tested-by:
-
Florian Auderset authored
When creating an own backend module with a table list from be.tablelist viewhelper, controlpanel buttons can be displayed if needed. Resolves: #91843 Releases: master, 10.4 Change-Id: I08696176e45650f0167327aacbccccf5f477fab3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65075 Tested-by:
-
Tymoteusz Motylewski authored
Page tree will fetch just 2 levels of pages plus pages which are expanded on the initial load. Next levels are fetched on demand via Ajax when expanding the node. Search work server side now (hit enter). To clear search, click on "x" button. If you select a page when filtering, it's kept selected after removing the filter. Releases: master, 10.4, 9.5 Resolves: #88943 Resolves: #88098 Resolves: #88259 Change-Id: Ie83839ce801c509f24c1e2c1dc516bce9599d55e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62086 Tested-by:
Sybille Peters <sypets@gmx.de> Tested-by:
Dennis Prinse <dennis@dennisprinse.com> Tested-by:
Marcus Schwemer <ms@schwemer.de> Tested-by:
Uwe Trotzek <trotzek@citeq.de> Tested-by:
Richard Haeser <richard@maxserv.com> Reviewed-by:
-
- Jul 21, 2020
-
-
Simon Gilli authored
Since phpdocumentor/reflection-docbloc 5.2.x a tag is required to implement also the phpDocumentor\Reflection\DocBlock\Tags\Formatter\Tag interface. This patch implements the tag interface for the Null_ tag defined in Extbase. Resolves: #91832 Releases: master, 10.4 Change-Id: Idb836dc3f8816a5c2c40d429a61dcda1cd27fd7f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65061 Tested-by:
-
Benni Mack authored
Both fe_users/be_users and be_groups/fe_groups have a feature called "lockToDomain". Although it is called the same, it has a different use-case: * Users: If lockToDomain is set, the user is only allowed to login when a given HTTP_HOST is given. * Groups: If lockToDomain is set, the group is only added to the logged in user, if the HTTP_HOST matches this domain. Both features are rarely used, and even in multi-tenant setups not viable or flexible enough. In addition, the features are not any additional security measures as HTTP_HOST can be faked. They both add unneeded complexity for the rare use of a similar feature, a custom extension should be used. Plus: All of these features can be added via extensions, depending on a specific use case of an installation, so _if_ people use it, custom extensions should be used instead for the specific use case they have. The database fields, TCA definitions, labels, domain model logic in Extbase and actual validation within the AuthenticationService and BE_USER are removed without any substitution. Resolves: #91782 Releases: master Change-Id: I4a12185b79efaf1e3bded5120675e3c1095dcd42 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65011 Tested-by:
-
Nikita Hovratov authored
A common way to apply stdWrap is to use the ternary operator to check for existing stdWrap config. This can be replaced by using the $cObj->stdWrapValue method. Not only is it shorter, it is also more robust and less error-prone. To start off all ContentObject classes have been cleaned up. Resolves: #91657 Releases: master Change-Id: I65c28e27c21ae13bdbcb47068bc32b510b8b0dc0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64898 Tested-by:
-
Andreas Fernandez authored
Due to a naming mismatch in the refactoring during #87724 it was tried to render information boxes based on the parent container element. The code is adjusted now to reference the correct object in the rendering loop. Resolves: #91831 Related: #87724 Releases: master, 10.4 Change-Id: Ib80f0f04a9e7ce164be1cd6717fd105d3339b269 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65060 Tested-by:
-
