- Feb 07, 2023
-
-
Benjamin Franzke authored
As already started in #88304 (but only for NormalizedParams) and later reverted in #89312 (because of cgi-bin problems), PATH_INFO is no longer considered as a preferable SCRIPT_NAME alternative. All known server configurations set SCRIPT_NAME these days to a proper value when cgi.fix_pathinfo is set. The fallback to PATH_INFO has been introduced with the initial revision of TYPO3 and isn't needed at all nowadays, it's actually wrong, as a REQUEST_URI like /index.php/foo/bar would incorrectly be interpreted as $scriptName == "/foo/bar", which let's all calculations on $scriptName fail and even leads to XSS where values derived from $scriptName are printed without being escaped. Also any ORIG_SCRIPT_NAME evaluation is dropped, as this variable contains the SCRIPT_NAME that was set by the webserver configuration before PHP applied cgi.fix_pathinfo. Using ORIG_SCRIPT_NAME effectively meant bypassing PHP's pathinfo fix. It usually contains the cgi-wrapper paths, which is why PATH_INFO was used to overrule wrong ORIG_SCRIPT_NAME values. GeneralUtility::getIndpEnv('PATH_INFO') is adapted to trust the servers PATH_INFO information, now that we no longer allow servers to send SCRIPT_NAME as PATH_INFO (we enforce cgi.fix_pathinfo=1 for CGI installations). The normalized SCRIPT_NAME is now adapted to be encoded as a URL path by default, as all TYPO3 usages expect this to be an URL path. Note that $_SERVER['SCRIPT_NAME'] refers to the servers file system path, not the URL encoded value. This SCRIPT_NAME sanitization actually enables: a) TYPO3 to be run in a subfolder that contains characters that need URL encoding e.g. `/test:site/` – url encoded that'd be `/test3Asite/`. b) prevention of XSS in case third party extensions missed to escape any URL that is derived from SCRIPT_NAME (while making sure that properly escaped output is not double escaped) Resolves: #99651 Related: #88304 Related: #89312 Releases: main, 11.5, 10.4 Change-Id: Ief95253d764665db5182a15ce8ffd02ea02ee61e Security-Bulletin: TYPO3-CORE-SA-2023-001 Security-References: CVE-2023-24814 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77738 Reviewed-by:Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Benjamin Franzke authored
Make clear that the early-bail out for empty pageArguments is done to prevent setting `disableCaches` to `true`. Also makes that that the $pageNotFoundOnCacheHashError condition is really tied to pageArguments being non-empty. Prevents us from refactoring that code and missing this bit. Resolves: #99860 Related: #99859 Releases: main, 11.5, 10.4 Change-Id: I98ffa3dffe76a37970784979a2c4f2a9a64aa5bf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77752 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Benjamin Franzke <bfr@qbus.de> Reviewed-by:
-
Oliver Hader authored
If $GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['enforceValidation'] is enabled and the HTTP request only contains the `?id` query parameter, caching for the page is disabled - which should be avoided. Resolves: #99859 Releases: main, 11.5, 10.4 Change-Id: I14a81f5a2ec3ecabedd1abf0756a3ee32e7af4e4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77734 Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
-
- Feb 06, 2023
-
-
Benni Mack authored
When no cHash is given but GET parameters are handed in which _would_ require cHash parameters, these are now properly evaluated during the frontend request. As this has a security impact, a new option called $GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['enforceValidation'] is introduced, which then skips the "requireCacheHashPresenceParameters" option. The latter is an include list, but cache Hash calculation should rather be based on the exclude list such as "excludedParameters" and "cachedParametersWhiteList". If the new option is set, but some properties such as tx_solr[q] should be allowed, then this needs to be added to the excludedList ("excludedParameters") by extension authors. A new test "SlugSiteWithoutRequiredCHashRequestTest" is added which works with a disabled feature flag compared to "SlugSiteRequestTest" which has the feature flag enabled. Resolves: #95297 Releases: main, 11.5, 10.4 Change-Id: Ib72c6a34602e77d8c2044ad2e826c0474ebd2326 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77712 Tested-by:
-
- Feb 04, 2023
-
-
Benni Mack authored
This change updates the main TYPO3 code base vendor/ directory to lock to latest packages from our main dependencies, ready for the next v12.x release, so the "non-composer mode" has various updated dependencies shipped. Used commands: composer update "symfony/*" "doctrine/*" "psr/*" "firebase/php-jwt" "bacon/bacon-qr-code" -W Resolves: #99831 Releases: main, 11.5 Change-Id: If208b89062dab7dac98b140fe6e16a545bf9226f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77703 Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
-
Nikita Hovratov authored
Since the recent release of PHPUnit 9.6 some new deprecations were added which signal breaking changes for version 10. As deprecations are causing our tests to fail, they need to be addressed immediately. Method `expectErrorMessage` replaced with `expectExceptionMessage`. Method `getMockClass` replaced with `createMock` and a subsequent get_class call. Move test with deprecations to UnitDeprecated and remove expectation. Also update phpunit/phpunit and dependencies to latest version: > composer req --dev phpunit/phpunit:^9.6.1 -W Resolves: #99817 Releases: main, 11.5 Change-Id: I6d01ccca398a8ff5db735a35b19061b711c843cc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77693 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
-
- Feb 03, 2023
-
-
Thomas Hohn authored
The method getTemplateQueryBuilder has a reference to $GLOBALS['BE_USER']->workspace. This value should be fetched via the WorkspaceAspect. Resolves: #99795 Releases: 11.5 Change-Id: Ia5444b582da7436ab653923bbd8f91d87710a7b8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77670 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
-
- Feb 02, 2023
-
-
Andreas Fernandez authored
When using drag&drop in the page tree, many style changes happen: * a shadow node is rendered that is moved around * the content within the shadow node changes depending on whether dropping is allowed * CSS classes are changed The previous implementation was not optimal in several ways: * the nodes wrapper (aka the "tree") was updated twice which each `dragover` event, being expensive on huge trees * adding and removing CSS classes may have become redundant in some cases, triggering a re-paint every time All these cases are handled in this patch by executing tasks only when absolutely necessary. Resolves: #99786 Releases: main, 11.5 Change-Id: Ibc8cbce2785e2de646e254590b4eddbdc42839c1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77669 Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
-
- Feb 01, 2023
-
-
Thomas Hohn authored
Sanitize the mountPointParameter in class constructor. Resolves: #99731 Releases: main, 11.5 Change-Id: Ic6fec228c462c7ec4a75a7efc934d7d17fc5c1e0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77657 Tested-by:
-
Thomas Hohn authored
Added a guard around the calculation of $sameBeginEnd. Resolves: #99752 Releases: main, 11.5 Change-Id: I754b4e67b2b04db20dc9adb8ee26bbd2ab2651ad Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77581 Tested-by:
-
Thomas Hohn authored
The variable sameBeginEnd should have the type bool, since the comparison calculation yields a bool. Resolves: #99776 Releases: main, 11.5 Change-Id: Iddbd04197b1b2f99bc96d365c0c4dde1615568da Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77580 Tested-by:
-
- Jan 31, 2023
-
-
Česlav Przywara authored
Releases: main, 11.5 Resolves: #99773 Change-Id: Ife6196a387db61ab7d81506cd32d7adc14bf609d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77579 Reviewed-by:
-
- Jan 30, 2023
-
-
Oliver Bartsch authored
The method `getContentObject()` might return null. This is now properly handled in the MenuProcessor and LanguageMenuProcessor. Resolves: #99722 Releases: main, 11.5 Change-Id: Iebaa2324c59032bd10610c2a63156168777070db Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77614 Tested-by:
-
- Jan 27, 2023
-
-
Andreas Fernandez authored
The class `PageLayoutController` has some custom methods to fetch data of localized pages: * `getLocalizedPageRecord()` * `getLocalizedPageTitle()` The same data can be retrieved using the standardized method `PageRepository->getPageOverlay()`, which replaces the aforementioned methods. Resolves: #99613 Releases: main, 11.5 Change-Id: I06a374411b34211ed45d57f30d142ead7c7e6fba Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77620 Reviewed-by:
-
Oliver Bartsch authored
The "titleLen" setting is now respected in the page modules' "language mode" to prevent overlapping of long page titles. Note: Overlapping might still happen, depending on the configured "titleLen" value, the current display resolution and the number of languages being displayed (when "All languages" is selected). Resolves: #99729 Releases: main, 11.5 Change-Id: I02458e5b7b0d136303499a83fb6c2fcb5bbc0ef8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77618 Tested-by:
-
Thomas Hohn authored
If fe_groups are deleted building the labels for the fe_groups in titleAttribForPages will throw a PHP warning. Resolves: #99712 Releases: main, 11.5 Change-Id: I61a340b74096c0da6eccc2eb0cd425c9fe02b71c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77578 Tested-by:
-
- Jan 26, 2023
-
-
Oliver Bartsch authored
When calculating the number of hidden elements for the currently displayed language columns in the page module, the corresponding language constraint is now properly set. Considering more then one language is now only done, in case language mode with a language > 0 is selected. Additionally, L=-1 is now properly taken into account. Some further cleanup of the method is done. The actually defined field names of corresponding enable columns are now used instead of the static ones. Resolves: #99720 Releases: main, 11.5 Change-Id: I751ea0d2f2de88d5eb208215bb81543fc01ca32b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77617 Tested-by:
Fabien Udriot <fudriot@omic.ch> Tested-by:
-
Andreas Fernandez authored
The method `sendChangeCommand()` now builds a proper payload by pushing data into `params.data.copy` prior to the non-exisiting `data.copy` array. Resolves: #99726 Releases: main, 11.5 Change-Id: I96f279cb2f5eedc4a6658f89f0975c8a14bd42c1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77612 Tested-by:
-
- Jan 25, 2023
-
-
Achim Fritz authored
EXT:frontend's Preview simulation already sets the userGroup values properly, which allows to simulate a usergroup. However, this change also needs to be set in EXT:adminpanel in order to allow usergroups. This change adds the same change (see #96381) as in PreviewSimulator in EXT:adminpanel. This is required as otherwise, the Frontend user would re-set the userGroup in FrontendUserAuthentication->createUserAspect() Resolves: #99718 Related: #96381 Releases: main, 11.5 Change-Id: I346f14e2c7bd655efe3883c3a1543bddff8364e8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77577 Tested-by:
-
Benni Mack authored
Resolves: #98630 Releases: main, 11.5 Change-Id: Iae48bf68a9f18a33e86d79cf7826617e2b3d48c6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77570 Reviewed-by:
-
Oliver Bartsch authored
Prior to the introduction of the column selector in #84184, did a boolean flag "$addDateFields" define whether record date fields (tstamp and crdate) should be added to the available field list. Actually, those fields were always added, because all usages of the corresponding method set either "$addDateFields" or "$dontCheckUser" to TRUE. This fact is now restored by always adding the mentioned fields. Resolves: #98574 Related: #84184 Releases: main, 11.5 Change-Id: I4f212aaf62d9dec26530f6f7a39f1135d684d015 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77601 Tested-by:
-
- Jan 24, 2023
-
-
Thomas Hohn authored
Since $conf['externalBlocks.'][$tagName . '.'] can be null, added a null coalescing check to ensure that $cfg contains a valid value. Resolves: #99706 Releases: main, 11.5 Change-Id: Ia80bc50504e27eb0155232e1f1eb956f9b88ac79 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77576 Reviewed-by:
-
Benni Mack authored
Resolves: #98681 Releases: main, 11.5 Change-Id: I4d7bc72efe4256c5e5d9009afd9327428f2661d4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77567 Tested-by:
-
Benni Mack authored
Resolves: #99270 Related: #99572 Releases: main, 11.5 Change-Id: I0b3aed81b7ee5d8449c1db962b423fc4fb542287 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77575 Tested-by:
-
Benni Mack authored
Resolves: #99255 Releases: main, 11.5 Change-Id: I10981e55a9efe2a891bf61ca304a287ec2759aad Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77574 Tested-by:
-
Benni Mack authored
Resolves: #99315 Releases: main, 11.5 Change-Id: Ib6bae3be83742212d063bd7b746bb2885d79222b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77572 Tested-by:
-
Benni Mack authored
Change-Id: I92ccd2aaed0332becb806e83e2d886813c740909 Resolves: #98966 Resolves: #98425 Releases: main, 11.5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77573 Tested-by:
-
- Jan 23, 2023
-
-
Oliver Hader authored
When rendering preview images of online-media assets (YouTube, etc.), the corresponding image is retrieved from the remote host and stored in typo3temp. In case configured dimension and file extension of the target file are not different, the image won't be processed and thus not stored in a public FAL storage. Resolves: #99550 Releases: main, 11.5 Change-Id: Ib2e28b2e5d2bc4ea96207917ca8f26f407f53856 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77543 Reviewed-by:
-
Oliver Bartsch authored
The SiteInterface provides the "getDefaultLanguage()" method, which will always return the first configured language - usually L=0. However, this language might be disabled, which means, it should not be visible in frontend context. The PageContentErrorHandler therefore now tries to fetch the first enabled language, in case the requested language id does not exist in the current site and the sites' default language is disabled. Resolves: #99530 Releases: main, 11.5 Change-Id: Ib02cbd8f01a4fc1a69be46ad2015e8863553fae0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77440 Tested-by:
-
Nikita Hovratov authored
Resolves: #99410 Releases: 11.5 Change-Id: I354ed27532f7f07ef070488866e685762fe14165 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77426 Tested-by:
-
Georg Ringer authored
Resolves: #99213 Releases: 11.5 Change-Id: I1a664d2e4b9c84063383769f956609390e8c3021 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77371 Reviewed-by:
-
- Jan 22, 2023
-
-
Thomas Hohn authored
Ensure that call to parse_url in http_makelinks handles parsing error correctly. Resolves: #99653 Releases: main, 11.5 Change-Id: I056d1737a27607f5f2ae9832a5ee495ccf7494c8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77439 Tested-by:
-
- Jan 20, 2023
-
-
David Blatter authored
A tca column with a SITE: placeholder inside the foreign_table_where config whould not work when used as a foreign_selector in an irre. To make it work, this change adds the resolved site from the parent context. Resolves: #99382 Releases: main, 11.5 Change-Id: I39658576da3159c071a46505683b8641eb3bada4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77516 Tested-by:
-
Benni Mack authored
This change prevents triggering a updateModuleData in CLI, which happens when e.g. running a importer on CLI which then updates Slugs automatically via CLI, which in turn trigger setUpdateSignal in EXT:redirects' SlugService.php. Resolves: #99656 Releases: main, 11.5 Change-Id: Ia0eae69820b0f7c762542cd6c06ad6d8ee45b789 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77517 Tested-by:
-
Josef Glatz authored
This patch extends the documentation of typo3/cms-redirects by an example of redirecting to an relative target while using regular-expressions. This adds more clarity for TYPO3 integrators and administrators. Resolves: #99639 Releases: main, 11.5 Change-Id: I6f6e24b5cf0a378d0efe0c7266c9abf249559e7d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77438 Tested-by:
-
- Jan 19, 2023
-
-
linawolf authored
One place has been overseen, when stabilizing deserialization in scheduler. The automatic cleaning of stuck executions now also uses the TaskSerializer to catch potential InvalidTaskExceptions. The info log message contains dummy values in such a case. Resolves: #99605 Related: #92466 Releases: main, 11.5 Change-Id: Id100991dbba61d7761987f0a0bdd04415ad86891 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77437 Tested-by:
-
- Jan 18, 2023
-
-
Chris Müller authored
The docblock of the class is rendered for documentation, see: https://docs.typo3.org/other/typo3/view-helper-reference/main/en-us/typo3/fluid/latest/Format/Html.html This information should therefore be mentioned. Related: #99031 Resolves: #99536 Resolves: https://github.com/TYPO3-Documentation/Changelog-To-Doc/issues/250 Releases: main, 11.5 Change-Id: I6f21710975a8916e27cdcd38c0bcb83a129319ea Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77436 Tested-by:
-
Benni Mack authored
TYPO3's log is mostly covered with "Locale fr_FR.UTF-8 not found", which can be simplified, if setlocale() is not working properly. The POSIX Platform suffix "UTF-8" is then removed, and setlocale() is called again with "fr_FR" instead of "fr_FR.UTF-8" thus avoiding log flooding in some systems. Resolves: #99591 Releases: main, 11.5, 10.4 Change-Id: I4609d453c29a306d448bcdc3277b51a344af28ae Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77434 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
-
- Jan 17, 2023
-
-
Oliver Hader authored
Using CSP directive `style-src 'unsafe-inline'` seems to be fine for directly requested SVG files, since corresponding definitions are bound to the corresponding resource. Loading styles from any other external resource is still denied. Resolves: #93884 Releases: main, 11.5, 10.4 Change-Id: Ifddf8782ecaa81bf26026ae8850d8c53b7977bd7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77456 Reviewed-by:
-
Nikita Hovratov authored
Since the introduction of always absolute (web) paths inside the TYPO3 backend, the TCA ctrl option `selicon_field` didn't work anymore since relative web paths like `fileadmin/file.png` changed to `/fileadmin/file.png`, which were not handled and resulted in a missing icon. This patch extends the condition for checking for absolute paths and prevents the GU:getFileAbsFileName method from turning web paths into empty strings. Resolves: #95572 Resolves: #97442 Related: #95027 Releases: main, 11.5 Change-Id: I1b82f71fe4f0636bd786d102f361ca60c1294af9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77431 Tested-by:
-
