- Jul 02, 2015
-
-
Andreas Fernandez authored
Fix invalid syntax for mod_filter on apache 2.4 and mismatching comment endings. Resolves: #66235 Releases: master Change-Id: Id4a67dab8f2fbf4d4bf9e2da4ac1c83d06b93388 Reviewed-on: http://review.typo3.org/40793 Reviewed-by:
Stephan Großberndt <stephan@grossberndt.de> Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
-
- Jul 01, 2015
-
-
Helmut Hummel authored
The baseSetup call for the bootstrap was forgotten during the Application/ Bootstrap refactoring. Add this call to the console application to fix the fatals. Resolves: #67878 Related: #67808 Releases: master Change-Id: Ic6a05b3d605a9f7cbde0b23e9d4417ef2d9c35fe Reviewed-on: http://review.typo3.org/40837 Reviewed-by:
Benjamin Mack <benni@typo3.org> Tested-by:
-
Mathias Brodala authored
The request format needs to be respected when rendering partials, otherwise the same partial cannot be rendered in different formats in the same request. An example is rendering mails in plain text and HTML. Resolves: #60338 Releases: master, 6.2 Change-Id: I118ee0a535d0f06391cd802c10d7c3c5129c2a2c Reviewed-on: http://review.typo3.org/35475 Reviewed-by:
Andreas Fernandez <typo3@scripting-base.de> Tested-by:
-
Bernhard Kraft authored
To make debugging this easier and as a stale lock file really represents an error in the locking mechanism the severity being used for logging stale lockfiles should get raised. This applies to the old locking API only. Change-Id: I94b91d10411e60bfe944445865f5cb630e988701 Resolves: #67227 Releases: master, 6.2 Reviewed-on: http://review.typo3.org/39871 Reviewed-by:
-
Wouter Wolters authored
This commit also removes the sources because they are not maintained anymore. Resolves: #67458 Releases: master, 6.2 Security-Bulletin: TYPO3-CORE-SA-2015-007 Change-Id: I0813656e3617cb7944d0e620aa3e2863cc614d16 Reviewed-on: http://review.typo3.org/40810 Reviewed-by:
Helmut Hummel <helmut.hummel@typo3.org> Tested-by:
-
Nicole Cordes authored
Currently only the backend login is protected with an implement sleep time after login failure. This patch adds a new hook which can be used to implement a protection functionality (e.g. for detecting brute force) and moves the sleep time as default protection in the abstract user authentication class. Resolves: #59231 Releases: master, 6.2 Security-Bulletin: TYPO3-CORE-SA-2015-006 Change-Id: I1fd1ebdc32ce7797651b5ead284dcff1eb511b94 Reviewed-on: http://review.typo3.org/40809 Reviewed-by:
-
Nicole Cordes authored
All users with access to the filelist module are able to display the content of the document root folder by spoofing the url. This patch prevents any rendering from that storage and throws an error. Resolves: #67538 Releases: master, 6.2 Security-Bulletin: TYPO3-CORE-SA-2015-005 Change-Id: I59cc315e913c02001efdad23e2ded7385502c5f2 Reviewed-on: http://review.typo3.org/40808 Reviewed-by:
-
Nicole Cordes authored
If the to be linked text is empty the ContentObjectRenderer chooses an appropriate link text but doesn't encode it properly. As hsc() was abandoned before this patch adds the parseFunc functionality to keep common html tags which might be used by the editor but escapes unknown characters and tags. Resolves: #34107 Releases: master, 6.2 Security-Bulletin: TYPO3-CORE-SA-2015-004 Change-Id: I9730cb81c315a76a8fc0ef184362cabb9a59f2e5 Reviewed-on: http://review.typo3.org/40807 Reviewed-by:
-
Markus Bucher authored
Properly escape user input when showing error messages during file renaming. Resolves: #59211 Releases: master, 6.2 Security-Bulletin: TYPO3-CORE-SA-2015-004 Change-Id: Iffafad7282445d51fa244f3b31e6886b0b0f65b6 Reviewed-on: http://review.typo3.org/40806 Reviewed-by:
-
Helmut Hummel authored
When authenticating as a frontend user with a previously present anonymous session, the session id is not regenerated which leads to a possible session fixation. This is now fixed by re-generating a new id when a user is just authenticated but no new session id is generated during this process. Resolves: #59258 Releases: master, 6.2 Security-Bulletin: TYPO3-CORE-SA-2015-003 Change-Id: Ia52b17e95cf8074b0f569cf025eab4d041d1677f Reviewed-on: http://review.typo3.org/40805 Reviewed-by:
-
Marc Bastian Heinrichs authored
By forging edit URLs it was possible to edit meta data records of files which were not within a user mount. Implement several hooks to check access to the file and only grant access to a meta data record if the user has access to the file. Resolves: #56644 Releases: master, 6.2 Security-Bulletin: TYPO3-CORE-SA-2015-002 Change-Id: I0f0704af2e7f01d16b9420f9ba4ac1a7846b5270 Reviewed-on: http://review.typo3.org/40804 Reviewed-by:
-
Andreas Fernandez authored
Improve the example .htaccess file by adding rules for caching, MIME types and CORS. Also, the rewrite rules are extended to block access to certain files and folders. Additionally all rules are made compatible for Apache 2.4 as well. Resolves: #23078 Resolves: #66235 Releases: master, 6.2 Change-Id: I629f524b5a209769601f04a74bb7434736058ab8 Reviewed-on: http://review.typo3.org/39254 Reviewed-by:
-
Andreas Fernandez authored
Use single quotes for values in the query executed in WorkspaceService::isOldStyleWorkspaceUsed(). In ANSI SQL, single quotes have to be used for values. Resolves: #67835 Releases: master, 6.2 Change-Id: I5bf598d9acdbc7d2db6d5b8b6f1a4c668fe13ccb Reviewed-on: http://review.typo3.org/40748 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Wouter Wolters <typo3@wouterwolters.nl> Tested-by:
-
Xavier Perseguers authored
Change-Id: I691706710f9bfe3294c59010fa0fd3fdb21f6a3e Releases: master, 6.2 Resolves: #67867 Reviewed-on: http://review.typo3.org/40785 Reviewed-by:
Frederic Gaus <frederic.gaus@flagbit.de> Tested-by:
Xavier Perseguers <xavier@typo3.org> Tested-by:
-
Nicole Cordes authored
If an incompatible extension is trying to be installed, a popup opens with the possibility to skip dependency checks and retry the installation. Currently the skipping is only implemented for system checks (TYPO3 and PHP versions). This patch adds the missing skip method during extension dependency resolving. Resolves: #67863 Releases: master Change-Id: Idbd4bc649a83a8e8a98652ffb8bd8081a7c65192 Reviewed-on: http://review.typo3.org/40775 Reviewed-by:
Florian Weiss <typo3org@leblanc.at> Tested-by:
-
Morton Jonuschat authored
Deprecate MetaType() which always returned an empty meta fieldtype with DBAL and move function to getMetadata(). The signature for getMetadata() includes the field information for the query so that the cached field metatype can be used before resorting to querying the DBMS. Resolves: #67288 Releases: master Change-Id: I57dbd7501c9e7a62f2164fb755f1d1a73da01a05 Reviewed-on: http://review.typo3.org/39941 Reviewed-by:
-
Andreas Fernandez authored
Replace occurences of count() with matching empty() pendants. Resolves: #67778 Releases: master Change-Id: I16c0299db8afda4c0fe406f7465a41d5eee3dd88 Reviewed-on: http://review.typo3.org/40686 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
-
Frederic Gaus authored
Cleanup \TYPO3\CMS\IndexedSearch\Domain\Repository\IndexSearchRepository Resolves: #67857 Releases: master Change-Id: I696b996d0f517a87deec7ba54cff46be5f069571 Reviewed-on: http://review.typo3.org/40768 Reviewed-by:
-
Mathias Brodala authored
Counting the results of the ``QueryResultInterface`` proxy returned by Repository finder methods always executed a ``COUNT query`` even if the results had been fetched or counted already. With this patch the number of results is cached as soon as the result is initialized and/or counted once. Resolves: #67837 Releases: master, 6.2 Change-Id: I98f680372b845f992ad3d436647b0cf5e460b606 Reviewed-on: http://review.typo3.org/40750 Reviewed-by:
-
Wouter Wolters authored
Resolves: #67847 Releases: master Change-Id: Ia76a7166a7da9b1663acd8cd40edb6fe040f0f67 Reviewed-on: http://review.typo3.org/40763 Reviewed-by:
-
Frederic Gaus authored
Resolves: #67861 Releases: master Change-Id: I18531f6ef4d9541e9ef1163c3b4703f6b37bc84c Reviewed-on: http://review.typo3.org/40769 Reviewed-by:
-
- Jun 30, 2015
-
-
Benjamin Mack authored
As the autoloader is now always present through the bootstrap and Composer class loader, the fallback of manually requiring classes can be removed. Resolves: #36061 Releases: master Change-Id: I299232630a0390688bd683b64e5d31c422baa444 Reviewed-on: http://review.typo3.org/40759 Reviewed-by:
-
Wouter Wolters authored
Resolves: #67849 Releases: master Change-Id: I9b532c45322bad3e9d776326a3d9aa9257325175 Reviewed-on: http://review.typo3.org/40764 Reviewed-by:
-
Benjamin Mack authored
In an effort to move away from TYPO3_MODE and global code an instance that acts as an entry point has been introduced. The Application class which serves as a wrapper for setting up the Bootstrap and calling the request has been introduced. Additionally, new Applications (like typo3_console) can benefit from the flexible way of registering RequestHandlers on their own while still using the bootstrap or only parts of it. Resolves: #67808 Releases: master Change-Id: I20c92d0bc8df5d50d76922a8dfe1cbd898e6f1dd Reviewed-on: http://review.typo3.org/40493 Reviewed-by:
-
Romain L authored
workspace The SYS_LASTCHANGED field was updated whenever which workspace was loaded, leading to SYS_LASTCHANGED being updated while no content was published yet. This patch changes this behavior by updating SYS_LASTCHANGED only if page is viewed from the live workspace or no workspace at all. Resolves: #42158 Releases: master Change-Id: I09aca547a7b22ba1699f521ea7609053991fed4c Reviewed-on: http://review.typo3.org/40259 Reviewed-by:
Jan Helke <typo3@helke.de> Reviewed-by:
-
Andreas Fernandez authored
Resolves: #67784 Releases: master Change-Id: I65b01b82692a981eee1c0d3cc6d6d161f9d80daf Reviewed-on: http://review.typo3.org/40691 Reviewed-by:
-
Gilles FOUET authored
For menus of type "list" the option showAccessRestrictedPages is now taken into account as well and the enableFields omit the fe_group contraint if the option is set. Resolves: #16840 Releases: master, 6.2 Change-Id: I4203bf0087367781ecee15fe3aa42deea8d34039 Reviewed-on: http://review.typo3.org/40315 Reviewed-by:
Daniel Maier <dani-maier@gmx.de> Tested-by:
-
Wouter Wolters authored
Add a missing "AND" concatenation to fix a SQL error. Resolves: #67834 Releases: master Change-Id: Ide173f13d9142b05db625648bf1ce995749ff233 Reviewed-on: http://review.typo3.org/40760 Reviewed-by:
-
Philipp Gampe authored
Since TYPO3 4.7 'stdWrap.cache' is available. This stores the rendered string into the cache_hash via the caching framework and retrieves it on successive renderings. However stdWrap kicks in too late for many cObjects, e.g. COA. Moving the 'cache.' logic into the central render method avoids the rendering of the cObject, thus gaining a major speed improvement if a cache entry already exists for a cObject. Custom cObjects and USER objects utilizing the 'cache.' property need adoption. This change allows to make effective use of page section caching to share the same generated HTML across many pages without regeneration. It provides the same power as Magento block caching. Additionally the properties key, lifetime and tags get stdWrap support. Resolves: #64200 Releases: master Change-Id: Ic0776082e09c70e03a9b432b41207031b4f2efa6 Reviewed-on: http://review.typo3.org/35915 Reviewed-by:
Stefan Neufeind <typo3.neufeind@speedpartner.de> Reviewed-by:
-
Benjamin Mack authored
Resolves: #18486 Releases: master Change-Id: Iba2514001570428e50eb55a75cee793ff7a409fb Reviewed-on: http://review.typo3.org/40751 Reviewed-by:
-
Tim Schreiner authored
Add a missing "AND" concatenation to fix a SQL error. Resolves: #67834 Releases: master, 6.2 Change-Id: I557ee19754462200a6baf52fd5b590c9b21eb21c Reviewed-on: http://review.typo3.org/40749 Reviewed-by:
David Greiner <hallo@davidgreiner.de> Reviewed-by:
Mathias Brodala <mbrodala@pagemachine.de> Reviewed-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Reviewed-by:
-
Felix Kopp authored
Introduce annotation for table column fields "descriptionColumn". Is added in TCA > ctrl for tables. Optional setting. Defined table column that holds description / guidance for editors and admins within backend. Description should only displayed in the backend. Adds descriptionColumn to records that already hold internal description. This patch does not add new description table columns. Resolves: #67603 Related: #67550 Related: #67578 Releases: master Change-Id: Ib081e5f14b9cbbcabbbad0d45a7a90274cd3dc09 Reviewed-on: http://review.typo3.org/40449 Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Laurent Cherpit authored
sanitizeLocalUrl() fails to compare returnUrl value if the TCA column of a field type "select" contains configuration keys like "itemListStyle" or "selectedListStyle". In "AddController", using RemoveXSS on request_uri before assigning the returnUrl parameter, the comparaison of the params of returnUrl will match on the backlink generation used to close the editForm. If returnUrl contains string with "style" in it, it will be processed in the same manner by sanitizeLocalUrl. So the backlink of the editForm will not be dummy.php. Change-Id: I5f3282766fe6cf9cae24f70d7f979ce4be004d5f Resolves: #48096 Releases: master Reviewed-on: http://review.typo3.org/20680 Reviewed-by:
-
Xavier Perseguers authored
Change-Id: If9cf05b0d6d98a6aa3e07dc50ab8c96750183613 Resolves: #67814 Releases: master Reviewed-on: http://review.typo3.org/40724 Reviewed-by:
-
Felix Kopp authored
With the new field it is possible to give a short description about a user. Change-Id: I5ffbc0112d1f12099ccd544ceda600367ce51611 Resolves: #67578 Releases: master Reviewed-on: http://review.typo3.org/40379 Reviewed-by:
-
- Jun 29, 2015
-
-
Thorsten Kahler authored
RedisBackend denies identifiers and tags allowed in all other implementations of caching backends. This change allows all identifiers and tags which can be casted to string. Specifically it adds a check for objects having a __toString method. Change-Id: Id5cc372f6a00c68d9e44a1eb8bb38c8a3679f2a7 Resolves: #51031 Releases: master Reviewed-on: http://review.typo3.org/23191 Reviewed-by:
-
Alexander Stehlik authored
This patch introduces a functional test that makes sure that the exclude field mechanism works correctly with inline elements. Since the problem was already solved by the FormEngine rewrite no functional changes are made. The actual bugfix will be added in the TYPO3 6.2 backport. Resolves: #47359 Releases: master, 6.2 Change-Id: I5a7a2de16d767f854b4d3f89d599deec28266092 Reviewed-on: http://review.typo3.org/20026 Reviewed-by:
-
Andreas Fernandez authored
Resolves: #67785 Releases: master Change-Id: I488a505fa811b76e216a3397bf4f1458d4f098df Reviewed-on: http://review.typo3.org/40692 Reviewed-by:
Daniel Goerz <ervaude@gmail.com> Reviewed-by:
-
Andreas Fernandez authored
Replace occurences of count() with matching empty() pendants. Resolves: #67781 Releases: master Change-Id: I4279ab12911ff7aa82c42e5a8bc2875c6e41f299 Reviewed-on: http://review.typo3.org/40689 Reviewed-by:
-
Christian Kuhn authored
The two README.txt files within typo3/ext and typo3/sysext do not provide crucial information that can't be found elsewhere and are dropped now. As a side effect, typo3/ext folder does no longer exist with new packages - the "global" system functionality is kept. A .rst file hints about this missing folder. Resolves: #67824 Releases: master Change-Id: Idc3c408f135a8be3ee2db43e4835a1c6b39436da Reviewed-on: http://review.typo3.org/40733 Reviewed-by:
-
