- Feb 13, 2024
-
-
Oliver Hader authored
Backend form fields of TCA `type=password` should never expose the persisted value - especially, in case the value is explicitly configured not to be hashed (having TCA `hashed=false`). Resolves: #101965 Releases: main, 13.0, 12.4, 11.5 Change-Id: Ie05a708185c621b8a2120ad7851ac4caf180893f Security-Bulletin: TYPO3-CORE-SA-2024-003 Security-References: CVE-2024-25118 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82947 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Benjamin Franzke authored
Resolves: #102799 Releases: main, 13.0, 12.4, 11.5 Change-Id: I673b6fbac853b0a977a5e5833a683c6952a55458 Security-Bulletin: TYPO3-CORE-SA-2024-002 Security-References: CVE-2024-22188 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82946 Tested-by:
-
Oliver Hader authored
The File Abstraction Layer Local Driver did not verify whether a given absolute file path is allowed, and made it possible to access files outside of the project path, and to by-pass the setting in $GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath']. In case lockRootPath is not set, any local file path must be at least located in the base directory of the current project. The lockRootPath setting now supports array values as well. The trailing slash is enforced automatically. Example: * instead of 'lockRootPath=/var/spe' previously matching the paths '/var/specs/' and '/var/specials/, * now both paths need to be declared explicitly, since 'lockRootPath=/var/spe' is evaluated as '/var/spe/' Resolves: #102800 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6561df562c5dbaff1f77d33db24d5f1c6358b198 Security-Bulletin: TYPO3-CORE-SA-2024-001 Security-References: CVE-2023-30451 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82945 Reviewed-by:
-
Benjamin Franzke authored
The autocomplete="off" parameter is ignored by current browsers, autocomplete="new-password" is to be used for disable autocompletion. The explicit request for autocompleting the password is autocomplete="current-password", which is now used in case config TCA autocomplete is set. See following article for more information: * https://web.dev/articles/sign-in-form-best-practices#new-password * https://web.dev/articles/sign-in-form-best-practices#current-password Resolves: #103067 Related: #97104 Releases: main, 12.4 Change-Id: Ice3c7a50020d7e17b14c51dc89c1c8e1700fe9a6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82836 Tested-by:
Benjamin Franzke <ben@bnf.dev> Reviewed-by:
core-ci <typo3@b13.com>
-
Stefan Bürk authored
A new PHPStan version has been releases, which is pulled in automatically in the composerInstallMax nightly test. The higher version allows to remove a ignore pattern from the baseline and a superfluous key unset is detected. This change raises the PHPStan version, removes the superfluous `unset()` and regenerates the baseline to remove the invalid ignore pattern. Used command(s): > Build/Scripts/runTests.sh -s composer \ -- require --dev "phpstan/phpstan":"^1.10.58" > Build/Scripts/runTests.sh \ -s phpstanGenerateBaseline Resolves: #103105 Releases: main, 13.0, 12.4 Change-Id: I689079eaac7f9461084e6a71ff08ef716cf551e4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82933 Reviewed-by:Stefan Bürk <stefan@buerk.tech> Tested-by:
-
- Feb 12, 2024
-
-
Oliver Hader authored
Executed command: composer update composer/composer see https://github.com/advisories/GHSA-7c6p-848j-wh5h Resolves: #103102 Releases: main, 13.0, 12.4, 11.5 Change-Id: Ib3a0baa5c94f0a19b36b8440a30f47f25eab6e65 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82901 Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
Oliver Bartsch authored
This fixes several bugs in FileList: 1. Properly initializing the `searchTerm` ensures it is kept while sorting. 2. Sorting for "filesize" is now working properly, using corresponding collator attribute. 3. Pagination is properly reset on searching. 4. Correct search term is kept on paginating. Resolves: #103053 Releases: main, 12.4 Change-Id: Ibf7dd278d13aed6142286d7408b9380588485801 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82850 Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
-
Sybille Peters authored
Since the linktypes are automatically registered in Linkvalidator, it is no longer quite as easy to replace the "external" linktype. You cannot register another linktype using the same identifier "external", so a different identifier must be used. A minimal example is added to the developer section in the documentation. Resolves: #101673 Related: #96935 Releases: main, 12.4 Change-Id: I9afa1a77fe56675dff2dbc1bacc3635b1b9b36c6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82849 Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
- Feb 11, 2024
-
-
Oliver Bartsch authored
The query for fetching extension versions is extended to also find "outdated" extension versions (review_state = -2). Note: For now, this does not change anything in the EM, since the remote XML does not use the -2 state currently, due to the wrong constraint. This can however now be properly fixed in XML. Resolves: #93082 Releases: main, 12.4, 11.5 Change-Id: I522a2c166c6d1af6e8b2a14de51d63a15c4211d2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82847 Reviewed-by:
-
Torben Hansen authored
The language labels for `noPluginSelected` and `edit` in StandardContentPreviewRenderer can not be resolved, because the extension path is wrong. This change fixes the extension path and additionally streamlines one label output, by using `htmlspecialchars` to escape the generated label similar to the other label output in this class. Additionally a similar wrong extension path in `ExampleLinkType.rst.txt` has been adapted. Resolves: #103095 Related: #100675 Releases: main, 12.4 Change-Id: I4882133025c938fc3b6928b36237e782e9465dcc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82846 Tested-by:
-
- Feb 10, 2024
-
-
Oliver Hader authored
Resolves: #103097 Releases: 12.4, 11.5 Change-Id: I9280a8489cd0b301a1d9c66efc8428bad206cb8c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82890 Reviewed-by:
-
Stefan Bürk authored
New core-testing-* images have been build and published in the TYPO3 testing-infrastructure repository and pulled to the core ci gitlab runner instances. [1][2] This change modifies `Build/Scripts/runTests.sh` to set new image version to ensure the usage for all changes based on this change. For information what changed in the image see the patches in the testing-infrastrucure repository linked below. * core-testing-php81 => 2.11 * core-testing-php82 => 1.10 * core-testing-php83 => 1.11 [1] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/e6719d303eacf2f377e308c800b474b735145d61 [2] https://github.com/advisories/GHSA-7c6p-848j-wh5h Resolves: #103096 Releases: main, 13.0, 12.4, 11.5 Change-Id: If9c5ae00334acc4fa5a1417dcbf9f77d31dff62d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82886 Reviewed-by:
-
- Feb 09, 2024
-
-
Yann authored
An editor can trigger a TypeError exception leading to a 503 error message `trim() expects parameter 1 to be string, null given` in the backend page module by creating `menu_categorized_content` objects with `selected_categories` and then turning them into `menu_section` objects. This change mitigates the type error by using a null-coalesce fallback passing an invalid type to the `trim()` method in `StandardContentPreviewRenderer::generateListForMenuContentTypes()`. Resolves: #103052 Releases: main, 12.4, 11.5 Change-Id: I4c0ecbd20c7cdfee22fa324f6b80391be47a1b88 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82845 Tested-by:
-
Oliver Bartsch authored
The "Export" button in the list module, used to trigger exporting a table does now also respect the `options.impexp.enableExportForNonAdminUser` TSconfig option, preventing a permission exception. The `mod.web_list.noExportRecordsLinks` is no longer used for managing the display of the "Download" button (displayed in the table's header row), but instead a dedicated TSconfig option `mod.web_list.displayRecordDownload` is introduced. Using per-table syntax, it's also possible to manage the "Download" Button for each table individually. Resolves: #99781 Releases: main, 12.4 Change-Id: I8b967218626ecc05dccf4bd7ac441db56a21a753 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82883 Tested-by:
-
Oliver Bartsch authored
The ExtendedFileUtility component provides the file name as argument for the `fileNotDeletedHasReferences` label. This information is now displayed correctly by adding the missing placeholder to the label. Resolves: #103091 Releases: main, 12.4 Change-Id: Ic9e40034bdf4f3d14e874014210e5d22235cd8c8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82843 Tested-by:
-
Thomas Hohn authored
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: https://github.com/Roave/SecurityAdvisories/issues/127#issuecomment-1933647035 [1] https://getcomposer.org/doc/04-schema.md#replace [2] https://github.com/advisories/GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82874 Tested-by:
-
Andreas Kienast authored
In some cases it was missed to enable modal actions again after their execution in the Install Tool. This patch adds the necessary statements to enable said buttons again. Resolves: #101224 Releases: main, 12.4 Change-Id: I793f157302df15912f0506c376d9db2d6041ebcc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82871 Tested-by:
Andreas Kienast <a.fernandez@scripting-base.de> Reviewed-by:
-
Andreas Kienast authored
Executed commands: npm install --save sortablejs@^1.15.2 npm run build Resolves: #103064 Releases: main, 12.4 Change-Id: I34c76bbd6b856c10a7a420d6fe652a47fbf0e095 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82868 Tested-by: -
Benni Mack authored
This change ensures that `?id=` only validates against an integer-interpreted value, disallowing `?id=nonsense23` which previously resolved to "23" In case an invalid `?id=` parameter value is provided throw a page not found error. Resolves: #103057 Releases: main, 12.4 Change-Id: Iaeb3096944b6872b73b056b690bf4f7fabbe9a6b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82867 Tested-by:
-
- Feb 08, 2024
-
-
Benjamin Kott authored
The configured browser capabilities (`chromeOptions`) are passed by `codeception/module-webdriver` to `php-webdriver` as is. php-webdriver expects the PHP constant ChromeOptions::CAPABILITY to be used instead of hardcoding any strings. Therefore php-webdriver 1.15 changed this constants value from `chromeOptions` to `goog:chromeOptions` [1], which means that the option `chromeOptions` is no longer respected and the configured window size (and the headless flag) is ignored. We now use the newer W3C webdriver comaptible `goog:chromeOptions` option and define window size definition via codeception's respective option `window_size` while we are at it. [1] https://github.com/php-webdriver/php-webdriver/commit/235c2aa07 Resolves: #103081 Releases: main, 12.4 Change-Id: Iec345b5ec0226d38b62081aa8c3a51dd3100bdb7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82840 Tested-by:
-
- Feb 07, 2024
-
-
Simon Schaufelberger authored
A new test case is added to cover the case when a TCA definition exists without `ctrl`. The test case has been added to the test extension `blog_example` which is not part of the public extension. Resolves: #103025 Releases: main, 12.4, 11.5 Change-Id: Iccd4428ad544fd6a94ed48ec97264b2945463d04 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82790 Tested-by:
-
Stefan Bürk authored
This change adds a composer command dispatcher to `Build/Scripts/runTests.sh` to allow the execution of any composer command without the hassle to have a proper composer installed on the host system. This also helps for onboarding new contributors not having a proper php and composer ecosystem installed on the host system. For example, to raise dependencies following can now be used: > Build/Scripts/runTests.sh -s composer -- require --dev \ typo3/testing-framework:dev-main Other examples: > Build/Scripts/runTests.sh -s composer -- dumpautoload > Build/Scripts/runTests.sh -s composer -- info | grep "symfony" Resolves: #103045 Releases: main, 12.4, 11.5 Change-Id: I65fa14e2c8d0d1a1204b3bed701d8c3458b6e3bb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82838 Reviewed-by:
-
Stefan Bürk authored
During branching for TYPO3 v13 the GitLab workflow cache keys has been adjusted. However, the generic cache key has been missed. Use the correct one now. Resolves: #103068 Releases: 12.4 Change-Id: I16a5e7e7bfbd9f1ca4c50d8057d1edfaae5b66c1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82831 Tested-by:
-
Andreas Kienast authored
Executed commands: npm install --save-dev sass@^1.17.0 npm run build Resolves: #103065 Releases: main, 12.4 Change-Id: Id8d3ad111a751299266bdc3abe59c54a15df010c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82835 Tested-by:
-
- Feb 06, 2024
-
-
Dimitri König authored
There have been quite a lot of patches around the pagelayout condition, which was introduced in early TYPO3 v11. It was broken in the beginning and got fixed with #98044. Soon after, a major refactoring of the ConditionMatcher has been applied with #100047, which re-introduced bugs regarding the pagelayout TypoScript condition. These have partially fixed with #100764 and #100921. The affected code is a bit messy due to a weird sorted array returned by the 'rootline' methods and classes, which we can't resolve right now. The fix itself revolves a last issue by reversing the rootline again. This was already done in the old backend ConditionMatcher. The frontend ConditionMatcher received the fullRootline, which is already reversed (deepest first). With the introduction of IncludeTreeConditionMatcherVisitor this has been unified, but the array_reverse was forgotten. In addition, the fullRootline from the frontend controller and BackendUtility::getPage...
-
Stefan Bürk authored
Doctrine DBAL 3.8.x comes with further deprecations, but also with the new `QueryBuilder::reset*()` methods as a mitigation for the deprecated generic QueryBuilder methods `resetQueryParams()` and `resetQueryParam()`. See [1] for release notes and [2] for changes from current minimum version towards 3.8.1. Raising the minimum version ensures that extension authors are able to create TYPO3 v12 and v13 compatible code. At least, they can rely on it with the TYPO3 release containing this change for non-Composer and Composer mode. Used command(s): > \ composer req --no-update --no-install \ -d typo3/sysext/redirects \ "doctrine/dbal":"^3.8.1" ; \ composer req --no-update --no-install \ -d typo3/sysext/core \ "doctrine/dbal":"^3.8.1" ; \ composer req --no-update --no-install \ -d typo3/sysext/install \ "doctrine/dbal":"^3.8.1" ; \ composer req -W \ "doctrine/dbal":"^3.8.1" [1] https://github.com/doctrine/dbal/releases/tag/3.8.1 [2] h... -
Andreas Kienast authored
Resolves: #103055 Releases: main, 12.4 Change-Id: If1c9f1dee8952faba5ed65bf54770a51aefdd37d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82832 Tested-by:
-
- Feb 05, 2024
-
-
Andreas Kienast authored
The version was outdated and is removed as it is not needed, since there is no intent to publish the build-folder as-is on npmjs. Resolves: #103039 Releases: main, 12.4 Change-Id: I799e03b00caefea946fb9700a6863ae325551f90 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82783 Reviewed-by:
-
Benni Mack authored
With #100759, f:translate has been changed to use the extbase LocalizationUtility in all scopes. This triggers the ConfigurationManager, which fetches TypoScript setup from the Request attribute. But TS setup is never set in fully cached page content scenarios and there is usually no Fluid view triggered in this scope. The admin panel however renders in "fully cached" as well, which then fails when trying to fetch TS setup. We *do* want extbase to fail in this scenario, since TS is important for extbase configuration and it needs to rely on TS setup being set in Frontend. The patch thus works around the issue in admin panel directly. The situation should resolve later again, when work on LocalizationUtility finished. Resolves: #102638 Related: #100759 Releases: main, 12.4 Change-Id: I5cf8af6593f37299e71b8555b79bf05c0e5e9c09 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82396 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Oliver Bartsch authored
The element browsers, such as file browser, folder browser or the create folder browser are rendering the FileList in the `browse` mode. In this case the context menu component is not loaded. This is correct, since using the context menu inside the modal would lead to various side effects. Because the JS component is not loaded for mentioned reasons, wrapping the icons with the click menu needs to be omitted. This otherwise leads to further side effect, e.g. loading a second folder tree in the create folder browser. Therefore, this change now omits wrapping the icon with then click menu when the Filelist is used in the `browse` mode. Resolves: #103001 Releases: main, 12.4 Change-Id: Ifd4daf5487b5dd9c74553d48cd0c2270b2c4f58b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82742 Reviewed-by:
-
Stefan Bürk authored
This change adds further MySQL Server versions to the `Build/Scripts/runTests.sh` to allow executing local functional and acceptance tests with these version. Added versions: - MySQL 8.1 - MySQL 8.2 - MySQL 8.3 Resolves: #103030 Releases: main, 12.4, 11.5 Change-Id: I578ed524560ae1907ab8a79df7694470f9aa234a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82741 Tested-by:
-
- Feb 04, 2024
-
-
Andreas Kienast authored
Executed commands: npm install --save \ @lit/reactive-element@^2.0.4 \ lit@^3.1.2 \ lit-element@^4.0.4 \ lit-html@^3.1.2 npm run build Resolves: #103024 Releases: main, 12.4 Change-Id: Iec49465ce10b9da4cd2a05bcc13c09dd49508ef0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82770 Reviewed-by:
-
- Feb 03, 2024
-
-
Stefan Bürk authored
TYPO3 uses a composer package [1] to import locales along with translations and a custom script has been added to create and update included translation files. This change updates the language files with the last updates and requires the package with the current highest version as minimum. Used command(s): > composer req --dev \ "sokil/php-isocodes-db-i18n":"^4.0.19" > php Build/Scripts/updateIsoDatabase.php [1] sokil/php-isocodes-db-i18n Resolves: #103027 Related: #100659 Releases: main, 12.4 Change-Id: I2839113ed3894cec58b41c85abd59039cab00725 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82774 Tested-by: -
Stefan Bürk authored
The `Symfony\Component\Translation\Dumper\XliffFileDumper` is extended to add processing workflowes needed to update the xliff files based on the ISO Database with `Build/Scripts/updateIsoDatabase.php`. Symfony 7 added method types and return types, and therefore the extended method `dump()` needs a compatible return type. The corresponding `:void` return type is added now. Resolves: #103026 Releases: main, 12.4 Change-Id: Id39dbbab9cccffc0b0900267bdc411187623f6fb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82740 Tested-by:
-
- Feb 02, 2024
-
-
Andreas Kienast authored
Executed commands: npm install --save \ @codemirror/autocomplete@^6.12.0 \ @codemirror/lang-html@^6.4.8 \ @codemirror/language@^6.10.1 \ @codemirror/lint@^6.5.0 \ @codemirror/view@^6.23.1 \ @lezer/common@^1.2.1 \ @lezer/lr@^1.4.0 npm run build Resolves: #103023 Releases: main, 12.4 Change-Id: I4b21ebc335f3bc3483a957e0c6c48d62e0e4f622 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82769 Tested-by: -
Albrecht Köhnlein authored
The methods `logicalAnd()` and `logicalOr()` allow any number of constraints as parameters. The outdated PHPdoc comment still said "two". Resolves: #103007 Releases: main, 12.4 Change-Id: I582eb3f1c17fb3149a49a15649469794ce386149 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82739 Reviewed-by:
-
Stefan Bürk authored
The `Build/Scripts/runTests.sh` supports `podman` and `docker` as container cli binary since quite a while now, albeit docker has been kept as default if not specified using `-b`. This change removes the hard default and will now use `podman` as default. In case `podman` is not available `docker` is used. As a side-effect, the binary for CI is no longer enforced the hard way. PostgreSQL 16 is added as database version. Resolves: #103018 Releases: main, 12.4, 11.5 Change-Id: Iedcd7cbcd2380adb6781bd8b4f075da86e25c03b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82766 Tested-by:
-
- Feb 01, 2024
-
-
Oliver Bartsch authored
There is no valid reason to force a minimum amount of 5 records to be displayed in the list view. Therefore, the range is reset to 0 - 10000, as it was before #92103. Resolves: #103011 Related: #92103 Releases: main, 12.4 Change-Id: Icd22e6a77dc554774dcde6a6a3dc3c2a799d2d7d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82738 Tested-by:
-
Stefan Bürk authored
Used command(s): > composer req --dev \ "typo3/testing-framework":"^8.0.9" [1] https://github.com/TYPO3/testing-framework/releases/tag/8.0.9 Resolves: #103010 Releases: 12.4 Change-Id: Ic0b592ba160c958833a75b17481141a65bf566b6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82756 Tested-by: -
Albrecht Köhnlein authored
In case modules do not provide a "shortDescription" the module card is now rendered without title in the "About" module Resolves: #103005 Releases: main, 12.4 Change-Id: Ic383df283eb7c3e3e175862f808ea731531ccfff Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82737 Tested-by:
-
