- Sep 13, 2022
-
-
Oliver Hader authored
FileDumpController is used to expose stored files from the backend user interface through a corresponding service-side process. Since content-security-policy settings for files served directly by the web server won't be applied, FileDumpController has to take care. Resolves: #98221 Releases: main, 11.5, 10.4 Change-Id: I4fde10e48e33fa08452eddf876172f56b4f38e28 Security-Bulletin: TYPO3-CORE-SA-2022-009 Security-References: CVE-2022-36107 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75718 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Torben Hansen authored
When a TYPO3 backend user performs a password reset request, a password reset link including an expiration time is sent to the user. The expiration time is included in HMAC calculation of the saved password reset hash, but it is never evaluated if the expiration time is exceeded. This change adds the missing validity check for the expiration time included in the password reset link. Resolves: #97998 Releases: main, 11.5, 10.4 Change-Id: I8a1730faf6489e5c5eebb44ff4f82606785bd637 Security-Bulletin: TYPO3-CORE-SA-2022-008 Security-References: CVE-2022-36106 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75717 Tested-by:
-
Oliver Hader authored
Observing response time during user authentication can be used to distinguish between existing and non-existing user accounts. This change introduces `MimicServiceInterface::mimicAuthUser` - to be implemented by 3rd party authentication services - which simulates corresponding times regular processing would usually take. Resolves: #98217 Releases: main, 11.5, 10.4 Change-Id: I143ae0d3877dffe6f2decbb3f0cf8c9d9cb6ca0b Security-Bulletin: TYPO3-CORE-SA-2022-007 Security-References: CVE-2022-36105 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75716 Tested-by:
-
Oliver Hader authored
This fixes TYPO3-CORE-SA-2021-005 again, which accidentally had been removed during TYPO3 v11 development. An inaccessible error page amplified potential denial-of-service scenarios. Resolves: #97818 Releases: main, 11.5 Change-Id: Ia9c666731f70db5e0a60572cd008f1d0c541af37 Security-Bulletin: TYPO3-CORE-SA-2022-006 Security-References: CVE-2022-36104 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75715 Tested-by:
-
Oliver Hader authored
The changes applied for issue #93887 introduced a bunch of regressions, which were partially addressed. However, there are still much more issues related to cache handling that have been introduced by mentioned change. #97977: This reverts commit d3d8bc04 #98023: This reverts commit ccc9b433 #93887: This reverts commit 667346ae Resolves: #98336 Reverts: #97977 Reverts: #98023 Reverts: #93887 Releases: main, 11.5 Change-Id: I731069b7d2485bf1bd94e78ebe3e9500d2a752ea Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75694 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Elias Häußler <e.haeussler@familie-redlich.de> Tested-by:
-
Oliver Hader authored
This change addresses several "undefined array key" issues that have been identified by PsalmPHP (see issue #98321). Resolves: #98325 Releases: main, 11.5 Change-Id: I340f49059677c05348a3d4fedc2aa4ed0aca843b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75684 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
Torben Hansen <derhansen@gmail.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Thomas Löffler <loeffler@spooner-web.de> Reviewed-by:
-
- Sep 12, 2022
-
-
Benni Mack authored
With the change #98308 it was forgotten that the TypoScript property "config.disableImgBorderAttr" is removed as well. This change adapts the RST file accordingly. Fixes: #98334 Related: #98308 Releases: main Change-Id: If112aed84e758d0dbe5cf476b0bc7efa5da36a44 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75693 Tested-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
-
Benni Mack authored
In order to consolidate TypoScript options, the TypoScript option page.CSS_inlineStyle is removed in favor of the much more flexible page.cssInline which allows to add multiple inline settings and is available since TYPO3 v4. Resolves: #98312 Releases: main Change-Id: I66a1479be12659b2039d211d105caf89c1116d54 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75485 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
-
- Sep 09, 2022
-
-
Benjamin Kott authored
Badges are currently in an inconsistent state and sometimes the severity it shows is not related to the contents of the badge at all. To resolve this we are removing all auto coloring of badges. If a badge needs a meaningful severity it must be set explicitly. Badges are now also not extremely rounded by default anymore. Except for the notification in the topbar, there is no need to have them look like notification bubbles. Resolves: #98311 Releases: main Change-Id: I29dc9e8909e1c32ecc084dfaad6a3279531c389d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75679 Tested-by:
Susanne Moog <look@susi.dev> Tested-by:
-
Benni Mack authored
HTML deprecated the "border" attribute and the "longdesc" attributes which are not set anymore by TYPO3's Frontend. This mainly relates to "IMAGE" ContentObject. TypoScript properties * IMAGE.border * IMAGE.longdescURL are no longer used. The helper function "imgTag" in GraphicalFunctions is also removed. Fluid's Thumbnail ViewHelper in Backend does not allow "longdesc" anymore. As this ViewHelper is internal, it does not affect public API. References: * https://developer.mozilla.org/en-US/docs/Web/API/HTMLImageElement/border * https://developer.mozilla.org/en-US/docs/Web/API/HTMLImageElement/longDesc Resolves: #98308 Releases: main Change-Id: I5396c6b01a2157b132278ce388150b793f2d3bbd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75602 Tested-by:
-
Benni Mack authored
New PSR-14 events are introduced in favor of old hooks within PageRepository which are related to overlaying records. This is now achieved by using PageRepository->getLanguageOverlay() consistently which now contains the events both for pages and any other kind of translatable record. The main benefit of the events are that they consistently work with LanguageAspect instead of integers. Resolves: #98303 Releases: main Change-Id: I6cf64b77e9df8581f8aafc3b6a41f4690d277830 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75626 Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
Shehfinaz Kadavil authored
The primary actions in the file list visible as dedicated buttons in the table list are now configurable on a backend user basis to show more or less actions. Resolves: #97821 Releases: main Change-Id: Ifbac86427f8109eb4cd7453f74fb5f3ef69cf104 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75606 Tested-by:
-
linawolf authored
Fixed the display of pseudocode to simple rest as these get displayed in TYPO3 Explained. This resolves rendering warnings and incorrect code display Releases: main, 11.5 Resolves: #98305 Change-Id: Iafe32a55722ee0ad475f0f4b562aef548e47a7be Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75669 Tested-by:
-
Benjamin Kott authored
This patch cleans up and streamlines the dropdown, datepicker and context menu css components. They now look unified, by day and night. Change-Id: I9d67ba31d5358ee5074e60b707bba578b8a7bcb7 Resolves: #98307 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75658 Tested-by:
-
Andreas Fernandez authored
All requests are changed to use the AJAX API. Due to this, the return type of some methods is changed, resulting in a breaking change. There is one exception: due to how the PersistentStorage module is designed, the private method `loadFromServer()` send a synchronous request to the server. In the long run, this must become an asynchronous request but requires more refactorings as this affects all consumers. Resolves: #98193 Releases: main Change-Id: I314e63604c22753925daca29d7eeb25420832352 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75537 Tested-by:
Benjamin Franzke <bfr@qbus.de> Reviewed-by:
-
- Sep 08, 2022
-
-
Benni Mack authored
When TSFE->set_no_cache() is called without a reason (usually through third-party code), the Logger now ships with more information such as the class name and function / method name, which was previously just the filename. If the code was called from outside a PHP class, which is very uncommon in 2022, then just the filename without the path is now put into the context of the Logger. This way, a nasty hack around resolving symlinks can be removed. Resolves: #98302 Releases: main Change-Id: I4dd349162704e51cb49a463405107039401a82b3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75667 Tested-by:
-
Oliver Bartsch authored
For not yet migrated filemount records, the StoragePermissionsAspect previously triggered an undefined array key since the new field "identifier" (see #97922) might be empty or at least does not contain the combined identifier with the ":" sign. Resolves: #98300 Related: #97922 Releases: main Change-Id: I17671f6ab785983ed77f3990ec5c353e6d099bc2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75664 Tested-by:
Jochen <rothjochen@gmail.com> Tested-by:
-
Benjamin Franzke authored
Avoid jQuery and especially the bootstrap jQuery compat layer. Use lit as template engine instead of jQuery composition and avoid the bootstrap jQuery compat layer for initialization. Will allow lit's TemplateResult to be directly passed to the modal as content, allowing for a secure and straight forward templating system for the modal API. Left for another patch is the migration of AbstractInteractableModule away from jQuery and the adaption of login-refresh.ts to use the TYPO3 Modal api, instead of directly calling into bootstraps jQuery-Modal API. Support for jQuery based modal content is kept for now, as it doesn't require us to load jQuery proactively and may ease migration for some users, but lit TemplateResults are suggested to be used instead. The jQuery content support may be deprecated in an upcoming sprint release. Releases: main Resolves: #98288 Change-Id: Ic212485293b4cbe86f8a855d40de4c72f8de9558 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74165 Tested-by:
Jonas Eberle <flightvision@googlemail.com> Tested-by:
-
Georg Ringer authored
Avoid mistakes, especially by copy & paste, and trim the given data before closing the modal and delegating the data. Resolves: #98220 Releases: main, 11.5 Change-Id: Ie1a5670653fc28e16c54e1b7b1d1452a1e4f1917 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75621 Tested-by:
-
Oliver Bartsch authored
The ToolbarItemInterface requires the methods hasDropDown() as well as getDropDown(). Since #98214 the evaluation whether a toolbar item provides a dropdown is done in Fluid, using the corresponding magic "{toolbarItem.dropDown}". Fluid however first checks for a "Getter" and therefore uses the getDropDown() method instead of the hasDropDown() method to determine whether a toolbar item provides a dropdown. This led to display errors in case a toolbar item only provides a dropdown for some use cases as this was now always used. This is now fixed using a dedicated conditional ViewHelper. Resolves: #98299 Related: #98214 Releases: main Change-Id: I3aabfd0debe95ae35f2d9459c483d55e2260292b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75663 Tested-by: -
Oliver Bartsch authored
Resolves: #98245 Releases: main Change-Id: I03f3d485b75e1475d651479142bed40897c2b992 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75597 Tested-by:
-
Andreas Fernandez authored
If a backend user switches pages in the list module right after the clipboard is being loaded, the error message "An error occurred while fetching clipboard data" may arise as a "global" notification which is technically correct but confuses users. To relax the situation, the error message is now rendered as a regular alert box where the clipboard is expected to be and only if there is a real error. Resolves: #98242 Releases: main, 11.5 Change-Id: Ia1fddba64ac459601789aa7f68151840ddeadb3c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75661 Tested-by:
-
Larry Garfield authored
Four new PSR-14 Events are added, which allow to fully control the flex form parsing in an object-oriented way. They replace the now removed $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS'][FlexFormTools::class]['flexParsing'] hook. The new events work similar to the removed hooks. One noteworthy change however is, that event propagation of the "Before*" events is immediately stopped as soon as a listener sets a corresponding value. Previously, hook implementations had to always return a value, which means they returned e.g. an empty array to allow further hooks to be called. This however would now stop propagation and should therefore be avoided. Listeners which don't want to set corresponding value should just "return" without any change to the event object. Resolves: #97449 Releases: main Change-Id: I3f82a62d6ba06dfbe50d86c8318f7d810fc66799 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75158 Tested-by:
-
- Sep 07, 2022
-
-
Benjamin Kott authored
The datetimepicker (flatpickr) is now not based on the Bootstrap DateTimePicker (which was used before), but uses native CSS variables and SCSS features to be styled properly. Resolves: #98284 Releases: main Change-Id: I52ebf820f11d492f380a1918a2743562a3333d66 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75656 Tested-by:
-
Benni Mack authored
This change adapts various places where tests are run / simulated to be in "Backend Context" (such as ConditionMatcher or cObject or typolink tests) which should rather be used with the absolute getPublicPath() functionality - same as in one place in the installer. Resolves: #98285 Releases: main Change-Id: I77f72fa2b2326f27ea7a71145ef6a7ce52017b65 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75657 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Oliver Bartsch authored
Resolves: #98280 Releases: main Change-Id: I81078af2444b78df9eb26d0495fcb7cc73315162 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75653 Tested-by:
-
Oliver Bartsch authored
This patch removes any usage of jQuery from the link browser JS component. Additionally, some obsolete functionality regarding additional link attributes is removed. Resolves: #98282 Releases: main Change-Id: I10569bf017a979b0f65e9139183e3790cc0bc112 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75654 Tested-by:
-
Matthias Vogel authored
With PHP 8.1 we got Enums, to use them also in our extbase actions, a new TypeConverter is added with this patch. The EnumConverter is automatically used if the target type is an enum. Resolves: #98171 Releases: main Change-Id: Ic95bb69f2a02580f86878cd14a3f608ed3b474f6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75512 Tested-by:
-
Benni Mack authored
This patch deprecates the constant "TYPO3_mainDir" in favor of a BackendEntryPointResolver which contains the information in a unified way to work with the prefix for the path or URL. Some tests are adapted properly to run in "frontend context" now (e.g. felogin") to simulate the proper behavior. Resolves: #98283 Releases: main Change-Id: I8d7c410456a9fe41d220aa481032df251e949936 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75620 Tested-by:
-
Andreas Fernandez authored
This patch removes any usage of jQuery from EXT:rte_ckeditor. Some obsolete handling from times when the link browser opened in a popup window is removed as well. Resolves: #98272 Releases: main Change-Id: I1c587dc4398d2ef65f549c723199458a940ebaf4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75615 Tested-by:
-
Oliver Bartsch authored
This patch removes any usage of jQuery from the constant editor JS component. Additionally, some obsolete functionality regarding the color picker is removed as well. Resolves: #98276 Releases: main Change-Id: I0aef4853368c27f6595e9c0f9efb0fed070eb109 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75630 Tested-by:
-
Oliver Bartsch authored
When changing the doktype of a page in the "create multiple pages" wizard, the corresponding icon does now correctly update by using the correct data attribute name again. Resolves: #98279 Releases: main, 11.5 Change-Id: Iaba7517e0486c42ce61aeadfe3ce478a27208114 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75652 Tested-by:
-
Benni Mack authored
Since TYPO3 v7 the RequestType Ajax was used to identify AJAX routes. This is nowadays only used in FormProtectionFactory. However, this information is already built into the Backend Routing functionality since at least TYPO3 v8 where backend routes where unified. This way, the superfluous property is not needed anymore and can be removed, as the only check is now built into the route object. Resolves: #98277 Releases: main Change-Id: Ica1d623853c38b3e9eaaddf30851fc685407cef4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75631 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Andreas Fernandez authored
Back in the old HTMLArea it was possible to pre-define a link title in the `classesAnchor` configuration which got applied after selecting the CSS class for a link. This feature was migrated to EXT:rte_ckeditor in TYPO3 v8. From an SEO and accessibility point of view, this doesn't make much sense as this would lead to repetitive usage of the same link title, not helping much at all. For those reasons, the possibilities to * pre-define a link title * make the link title field readonly have been removed without substitution. Resolves: #98275 Releases: main Change-Id: I775f097c610ca14d3c0b20b1c04f62866a7fddc1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75629 Reviewed-by:
-
Andreas Fernandez authored
Resolves: #98273 Releases: main, 11.5 Change-Id: I521d855fb4dc8fbafb302de16f8d446abfb4d9e1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75628 Tested-by:
-
linawolf authored
Link to the TSconfig reference where it makes sense, also for setting page TSConfic, as this changed in v12. We do not need to duplicate the information here. Releases: main, 11.5 Resolves: #98244 Change-Id: I8c6b76ad8a2101cb84508cd0988c890ca467bd95 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75619 Tested-by:
-
- Sep 06, 2022
-
-
Benjamin Kott authored
Resolves: #98269 Releases: main Change-Id: Ibdaf9319071b3b596330a3be41c17a862a247b8a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75624 Reviewed-by:
-
Benjamin Franzke authored
`unsafe-perm = true` is not available in npm v8 documentation, and TYPO3 core requires npm =>v8. The file has been introduced with #96355 during yarn to npm migration, it has been added during early patchsets that targeted npm v6. Now that we use npm v8 it is no longer needed. Releases: main Resolves: #98270 Related: #96355 Change-Id: Ide7eea24f6b78da2f83a8d6303021e734bdcb47b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75625 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
-
Stephan Großberndt authored
README.md and CONTRIBUTING.md use the current repository links with this change. The change also includes several minor edits. Resolves: #98260 Releases: main, 11.5, 10.4 Change-Id: I77d4741df4134ae0babec2415cd8f5345592e29e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75607 Tested-by:
-
Benjamin Kott authored
Commands executed: npm install --save-dev grunt-stylelint@^0.18 stylelint@^14.11 stylelint-order stylelint-scss npm run build Resolves: #98267 Releases: main Change-Id: I06887ef24d7e1f0614b6881624851fbe26fa6617 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75618 Tested-by:
-
