- Jul 12, 2021
-
-
Oliver Hader authored
This change introduces behavior of extension `t3g/svg-sanitizer` into the TYPO3 core. Sanitizing SVG data is actually done by external package `enshrined/svg-sanitize` by Daryll Doyle. The following aspects are introduced: + handle `GeneralUtility::upload_copy_move` invocations + handle FAL action events `file-add`, `file-replace`, `set-content` + provide upgrade wizard, sanitizing all SVG files in storages that are using `LocalDriver` Custom usage: ``` $sanitizer = new \TYPO3\CMS\Core\Resource\Security\SvgSanitizer(); $sanitizer->sanitizeFile($sourcePath, $targetPath); $svg = $sanitizer->sanitizeContent($svg); ``` Basically this change enforces following public service announcements concerning SVG files, to enhance these security aspects per default: + https://typo3.org/security/advisory/typo3-psa-2020-003 + https://typo3.org/security/advisory/typo3-psa-2019-010 Resolves: #94492 Releases: master, 10.4, 9.5 Change-Id: I42c206190d8a335ebaf77b7e5d57b383e3bcbae1 Reviewed-...
-
Oliver Hader authored
For legacy reasons storage resolving in file abstraction layer still supports using identifiers like `/fileadmin/img.png` instead of `1:/img.png` (given, that `1:` corresponds to `fileadmin/` storage). To resolve the "best matching storage", existing storage paths are analyzed - however this did not work in the following cases: + identifier like `/fileadmin/img.png` on storage using relative base-path like `fileadmin/` + identifier using absolute path on storage with relative base-path + identifier using relative path on storage with absolute base-path Resolves: #94519 Releases: master, 10.4, 9.5 Change-Id: Id8663b3e7fc40d777288bd498d2250e528f4f4af Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69793 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Jochen Roth authored
Added fallback value for array undefined keys for filelist as well as for impexp because it is part of the current clipboard fuctionality. Introduced new tests for clipboard and file upload. Resolves: #94509 Releases: master Change-Id: Ibed7c53f49665c4502aaa05dbe78f468d354f3a1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69771 Tested-by:
-
Benni Mack authored
Due to the change of scalable SVG icons the tree actions for selecting actions in the Page Selector / File Selector were not rendered again. This change fixes the issue by properly using a SVG inside another SVG again, just like with icons of the actual tree. Resolves: #94545 Releases: master Change-Id: I7bfae2e422adce6fd07eed46a26e8ab9767f12a6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69814 Tested-by:
Jochen <rothjochen@gmail.com> Tested-by:
-
Lina Wolf authored
With the release of TYPO3 v11.3, Changelog documentation is no longer expected in master, but in 11.3 folder. Resolves: #94532 Releases: master Change-Id: I04808715808e6ac66e8a032e2809fc1d4d44109c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69807 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
-
Oliver Bartsch authored
When fetching available shortcuts for a user, also permissions are checked by the ShortcutRepository. However previously a lot of use-cases were missed and the implemented checks were more or less faulty, especially when it comes to non-admin users. Therefore, three main topics are now handled properly: * Evaluation of record edit permissions for shortcuts, targeting the record_edit route * Evaluation of page access permissions for every shortcut not targeting the file list * Proper distinction between shortcuts for file list and the ones for other modules, since both use the "id" argument, while for the file list, this is a string (combined identifier), and for the rest, this is an integer (the requested page id or the records' pid) Resolves: #89530 Resolves: #93516 Releases: master, 10.4 Change-Id: Ib18eaf506886627360c58857f0160d008e130368 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69758 Tested-by:
-
Oliver Bartsch authored
The Extbase ImageService contains a helper method `getImage()`. This method tries to find an image in a couple of different ways, depending on the given input arguments. To improve the usability, the exception messages are now dedicated to their corresponding try. As a side effect, the method is now also more readable as it now uses guard clauses and also contains a couple of code comments. Resolves: #94518 Releases: master, 10.4 Change-Id: I31d94eb89dd58a01d7911907ca82a256a0ba7cf3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69792 Tested-by:
-
Oliver Bartsch authored
The FileDragProvider was a special provider, only used in the "legacy" FileList tree. As this tree was already replaced by the svg tree, the provider is now removed. Resolves: #94523 Releases: master Change-Id: I2536cfe8fd9fbd92704b4cd7ea66c0fb3143d070 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69801 Tested-by:
-
Oliver Bartsch authored
To allow further improvements of the FileList, it is important to be able to distinguish between file and folder rows. This is done by adding data attributes to the corresponding table rows. Besides the type (file or folder), also relevant identifiers, e.g. folder identifier or sys_file uid, are added. Additionally the addElement() method, building the table rows, is cleaned up as it was obviously just copied from DatabaseRecordList and therefore contained a lot of unused and - in this context - wrong functionality (e.g. fetching a possible l10n_parent from the data array). Resolves: #94522 Releases: master Change-Id: Ib4dbccb8d0957956ca46cdacdefb7e1a71fb9fe7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69799 Tested-by:
-
Oliver Bartsch authored
The custom ContextMenu ItemProviders for sys_filemounts and sys_file_storage are removed as they never worked, because they extended the FileProvider, which uses the combined identifier as record identifier instead of the records uid. Also their $itemsConfiguration does not make any sense. In the end, there is no reason to treat those record types differently than the rest. Resolves: #90921 Releases: master, 10.4 Change-Id: Ifd24755455d75d781a7caefa808a8b87318ca487 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69800 Tested-by:
-
Nikita Hovratov authored
Under certain conditions closing divs were missing: 1. When all fieldControls are disabled. 2. If the field itself is disabled. This fixes these cases, so we have correct html at all times. Resolves: #94535 Releases: master, 10.4 Change-Id: Ieb7670666b6a927e80eb7377770d7f54189bc093 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69808 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Nikita Hovratov authored
This patch fixes several small bugs regarding DataHandler range validation: 1. The strict comparison of the value against the default value might compare floats with integer values. This causes the condition to be always true. Besides of that, it's not smart to skip range validation if the value equals the default value as the default value itself can be out of range due to user error. 2. The TCA option "checkbox" for fields of type "input" is not used anymore since TYPO3 4.5. This can be safely removed as the todo stated. 3. The tests for range validation with values evaluated as type double used an incorrect eval value: "double". The correct value is "double2". Tests are fixed according to that. Resolves: #94527 Releases: master, 10.4 Change-Id: I9cdf836272b4cce64f9e35a09107499d25fc955f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69804 Tested-by:
-
Nikita Hovratov authored
The class form-inline is not present anymore and has to be replaced with layout classes. Also remove empty spacing div. Resolves: #94530 Releases: master Change-Id: Id34244f54c065a94abca85c4ac442f256187fa0f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69806 Tested-by:
-
Benni Mack authored
The IRRE header block of each element (such as "filename" and "title") renders a "dl" as block as "dl-horizontal" was removed in Bootstrap 4. This change changes the styling and markup to utilize the Bootstrap 5 grid structure. Resolves: #94485 Releases: master Change-Id: I65542e0d32812a31be883d07701473061e5d3e0c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69720 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
-
Nikita Hovratov authored
Due to refactoring or very old code some places in the core define unused variables or variables, which are immediately overridden. They are mostly unnecessary. Even in places, where they might be slightly helpful if defined at the beginning of a function, the benefit doesn't excuse the existence. Resolves: #94528 Releases: master Change-Id: I6071bb0bc96472a4b4b7f679bfabbacfb761f472 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69805 Tested-by:
-
Andreas Fernandez authored
With the upgrade to Bootstrap 5, the CSS classes for setting a tab's state need to get applied to the anchor element, which was not the case for the CE wizard filter. This patch fixes the behavior by applying the classes to the correct elements. Resolves: #94512 Releases: master Change-Id: I034e12d7cc7553aeb89c33d063efffb6651fc40d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69766 Tested-by:
-
- Jul 11, 2021
-
-
Oliver Bartsch authored
Since the page title field is labeled by "Page X:", instead of the field label (as it's the case for the doktype), a placeholder is now added, making the expected value clear to the user. Resolves: #94525 Releases: master, 10.4 Change-Id: I1c10a0ca5e0954aa5584561e1e4247003a61e61d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69803 Tested-by:
-
- Jul 10, 2021
-
-
Oliver Bartsch authored
To further improve the FileList and to ease the use for editors, the context menu for files has been extended by a new option, which allows editing of the files' metadata. Resolves: #94524 Releases: master Change-Id: I8a3772a544a906c660ceac26703886a4649c1e88 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69802 Tested-by:
-
- Jul 09, 2021
-
-
Benni Mack authored
To prevent confusion between the EXT:impexp functionality and the recordlists' own export functionality, latter is renamed to "download". Resolves: #94511 Releases: master Change-Id: I5e101e04da00c52fe176beaf764de41c0fac9245 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69794 Tested-by:
-
Andreas Fernandez authored
An administrator is now able to abort the confirmation of an selected upgrade wizard without the need to close and re-open the modal. Resolves: #94515 Releases: master, 10.4 Change-Id: I0c7d63a13a4f0f63844ee28be09dec203dd9c5ac Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69768 Tested-by:
Frank Nägler <frank.naegler@typo3.com> Tested-by:
-
Benni Mack authored
This change moves the "Display Thumbnails" selection above the File List table, which then unifies this selection with the File Selector (IRRE File Selection). In addition, the only leftover option (Show clipboard) is now also a switch checkbox, and also applied in the view for the RecordList. All docheader buttons in the File Listing now show the appropriate text to make it easier to understand what the user clicks. Resolves: #94517 Releases: master Change-Id: I4ef02ba4aba008ae86b7452695a5590f2846a296 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69770 Tested-by:
-
Daniel Haupt authored
The check that the file is in one of the temporary folders has been removed, as this check is already done in the unlink method of the GeneralUtility. This patch specifically addresses composer based installations. Resolves: #94500 Releases: master, 10.4, 9.5 Change-Id: I0a38f5ef3da3494ca38310033f63cc591931fb63 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69754 Tested-by:
-
Benni Mack authored
The update wizard should make sure that the level field is migrated from integer to varchar otherwise a BE login is not possible. The Database Schema Upgrade can handle new fields properly, but for existing installations the existing "level" field is an integer and would not allow new log messages to the database. For this reason, this workaround is added. Resolves: #94460 Releases: master Change-Id: I0ccb43239970030b50c2e59e288b0d830dbc2024 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69684 Tested-by:
-
Oliver Bartsch authored
The ImageService->getImageFromSourceString() tries to retrieve a FileInterface from a given source string, e.g. with the "EXT:" prefix. However, because the used ResourceFactory->retrieveFileOrFolderObject() method can also return a FolderInterface or NULL, this must be handled to prevent a TypeError. Therefore, the final $image value is now checked for being a FileInterface. Otherwise NULL is returned, which is then handled with a custom exception in the calling `getImage()` method. Resolves: #94495 Releases: master, 10.4 Change-Id: I95836fd3c1701cc8c9b9e07c5b8e10a7fb9ee9cc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69729 Tested-by:
Geert Boetzkes <geert.boetzkes@beech.it> Reviewed-by:
-
Nikita Hovratov authored
The validation is already done in the FormEngineValidation on load. In the method loadDataAfter the tree nodes are not yet loaded for whatever reason and thus the validation always fails if having minitems set. Resolves: #94466 Releases: master Change-Id: I47b0c3bcbb64887239ba30b1a56fbc5681072120 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69731 Tested-by:
-
Jochen Roth authored
Docs panel will open on click and show its content again and add tests for all cards in this module to make sure it is and will stay fully functional. Resolves: #94472 Releases: master Change-Id: I6a30e64b3b2a4988550b6f18e50dc1ca51cc3f22 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69688 Tested-by:
-
Oliver Hader authored
Page Module partial `PageLayout/Record/Preview` tries to render optional `PageLayout/Record/{item.record.CType}/Preview` and falls back to a raw representation if that custom partial does not exist. In case `CType` is empty, this resolves to `PageLayout/Record//Preview` which is actually using `PageLayout/Record/Preview.html` again - that's the partial again that initiated the process - which will after some seconds crash due to an endless loop of that partial. In order to make things explicit, the defaults are now located in their dedicated namespace `RecordDefault` to avoid ambiguity. * `PageLayout/Record/Preview` -> `PageLayout/RecordDefault/Preview` * `PageLayout/Record/Header` -> `PageLayout/RecordDefault/Header` * `PageLayout/Record/Footer` -> `PageLayout/RecordDefault/Footer` Resolves: #94343 Releases: 10.4, master Change-Id: I0c0385a9d89561de2395fc81124e471ee9fed8dd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69493 Tested-by: -
Oliver Hader authored
To reduce the amount of inline JavaScript corresponding `window.open` occurrences are removed from TYPO3 backend user interface: * Backend Login refresh handling + tests checking for arbitrary inline JavaScript were removed * ViewPage page preview * FormEngine + "open in new window" button in top right bar + close behavior when editing form in new window Resolves: #91815 Releases: master Change-Id: I39c9c0350a0bdcf22b12bb6dba8fee8e9a03e315 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65050 Tested-by:
-
Oliver Bartsch authored
Since #92826, our own RenderingContext implementation, available in our view helpers, contains the getRequest() method, which was introduced to reduce the usages of ControllerContext. In this patch, the majority of the view helpers was changed to now access the request from RenderingContext. Unfortunately, by this time, the extbase Request was still not PSR-7 compatible. Therefore, some view helpers still had to access $GLOBALS[TYPO3_REQUEST]. Since #94428, the extbase Request finally implements the PSR-7 ServerRequestInterface, which now allows us to replace the global access in the remaining view helpers. Resolves: #94497 Related: #92826 Related: #94428 Releases: master Change-Id: I29080cf7fd27fb6e454ae2dee5867f60ae69dd8b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69733 Tested-by:
-
Jochen Roth authored
After reset user preferences in settings module the Configuration Module shows undefined array key warning. An empty array has been added as fallback to workaround this issue and improved scrollTo behavior when the user opens a node in the configuration tree. Also extended tests to cover such issues in the future. Resolves: #94487 Releases: master Change-Id: I3e907a2618765d314ff1ad8bcab74f1af46765c0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69724 Tested-by:
crell <larry@garfieldtech.com> Reviewed-by:
-
- Jul 08, 2021
-
-
Patryk Miedziaszczyk authored
Basic test for Indexed Search backend module checking main modes are loading properly. Releases: master Resolves: #94467 Change-Id: I6a0276ba0b881e57ee256793e584f60312406b5b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69763 Tested-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Tested-by:
-
Oliver Bartsch authored
In #87974 the special _PATH_ field was added to FileList, to be displayed on the search result view. To be consistent, this special field is now also processed on building the directory listing, while it currently has no visual effect, since the _PATH_ field is only dynamically added to in a search context. Resolves: #94505 Releases: master Change-Id: I100ab601dcf28f7acdb9bf999cf08cfa350ffd4f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69760 Tested-by:
-
Benni Mack authored
The File List now creates links through the UriBuilder, allowing to use actions (such as rename) while then keeping search parameter, or pagination parameters properly. In addition, some code is now cleaned up and streamlined (e.g. the styling of the buttons in the "multi-clipboard mode" is now correct). Resolves: #94506 Releases: master Change-Id: I0cf7dde9e94738b124818de724ec5e47dc1a8ac0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69761 Tested-by:
-
Jochen Roth authored
Add fallback for undefined array keys to make "DB Check" compatible with PHP8. Also basic tests have been added to check each page in the module. Resolves: #94498 Releases: master Change-Id: I98a598d0e809077cd89e7620efe31a498b3fbfa1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69759 Tested-by:
-
Oliver Bartsch authored
Currently, the Backend module File > FileList has two main views: * The list view * The search result view Both are handled via an Extbase controller, even though no pure Extbase-related feature (validation, type-converting, persistence) is used. Instead, the list view is generated by a PHP-based code "FileList" (similar to DatabaseRecordList), where as the search result view is built on top of Fluid. The latter approach hinders flexibility, and also leads to inconsistencies, due to the nature of using two different approaches. Most notable: - The search result view looks different than the list view, also no additional icons are possible. - The search result view has a clipboard, but does not allow to expand. - The search result view does not respect the listing limit, nor is the pagination displayed. - The search result view changes the module headline to "Search: <word>", removing the context on which folder the search was performed. However, the search result view works with the SearchDemand object which is a clean way to put the query requirements into the File List to render the found files. Therefore, this patch merges both Search Result Fluid view and PHP-based view back into one, more flexible and consistent, view. This also means, FileListController is not longer registered as an Extbase backend module and some internal ViewHelpers and classes were removed. The main benefits: * Exchanging features between DatabaseRecordList and FileList are easier to achieve * Hooks for additional icons also work in the search result view * Numeric Clipboards also work in the search result view * Buttons in each found file row look the same now * The current folder is now also displayed in search result view * Bookmarking also works properly now and additionally also takes a possible searchTerm into account * The search results are now paginated, respecting the listing limit * Invalid folders do not longer lead to an exception in the search result view Resolves: #87974 Resolves: #89867 Resolves: #92247 Resolves: #92747 Resolves: #93185 Releases: master Change-Id: I259fe7f63ef8ea69f6bdf0c787330f4338d4bd5a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69718 Tested-by:
-
- Jul 07, 2021
-
-
Benni Mack authored
Using the TranslationConfigurationProvider API returns an array of available languages for a given site (and on pid=0 returns the available translations as well), brings back the Language Switcher when editing sys_file_metadata records. Resolves: #93033 Releases: master Change-Id: Ia727d1ce326462629d7864d381187595a1da2502 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69721 Tested-by:
-
Benjamin Franzke authored
As identified in #94491, ImageService may be used in installtool context and is therefore now defined as lowlevel service via a service provider, to ensure its dependencies are always available in install tool contexts. Resolves: #94493 Related: #94491 Related: #89892 Releases: master Change-Id: I76934bb48336adb654a82ec23a9b6a1584c5ced9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69727 Tested-by:
-
- Jul 06, 2021
-
-
Daniel Siepmann authored
Add missing pagination example to feature rst. Only paginator is not enough to actually create a new pagination. Relates: #89603 Releases: master, 10.4 Change-Id: Ie6852b76fb79f131d3b8553640ef29ab60e072de Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69723 Tested-by:
-
Oliver Bartsch authored
The ImageViewHelper is used in install tool context, when sending the "login successful" or "login failed" email, while using the SystemEmail layout. Since DI is not fully available in install tool context, the ImageService can not be injected in the view helper. Resolves: #94491 Releases: master Change-Id: I7eb4e0dda0738346032cf550119c3503523df0eb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69726 Tested-by:
Benjamin Franzke <bfr@qbus.de> Reviewed-by:
-
Jochen Roth authored
The button "save and close" is removed because "save" button does exactly the same thing. To streamline behavior the save button also returns to edit file view instead of returning file list view. On top of that add a test to cover such redirect issues in the future. Resolves: #94481 Resolves: #91840 Releases: master Change-Id: I5656cdbdc31444f632e05577c34cee50daed71e5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69717 Tested-by:
-
