- May 27, 2016
-
-
Wouter Wolters authored
Resolves: #15415 Releases: master Change-Id: Iac92d6d36e2a84b069fa7c4a17d2dc567d952309 Reviewed-on: https://review.typo3.org/48301 Reviewed-by:
Morton Jonuschat <m.jonuschat@mojocode.de> Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
-
Elmar Hinz authored
The PHP char() function only works reliably with ASCII codes independent of the actual char set. See http://php.net/manual/en/function.chr.php Releases: master Resolves: #76315 Change-Id: Ia87b95239fc4678f297571704f031003f84a5759 Reviewed-on: https://review.typo3.org/48306 Reviewed-by:
Wouter Wolters <typo3@wouterwolters.nl> Tested-by:
-
Morton Jonuschat authored
Instead of passing the simple value "1" to QueryGenerator->getTreeList() use a page permission clause created using $BE_USER->getPagePermsClause() when determining the recursive storage pids. Passing the unprocessed value "1" causes invalid SQL statements and does not perform any access checks. Releases: master, 7.6 Resolves: #75912 Change-Id: I6edadd627c0a9c01a78c3cb55805455fed710d14 Reviewed-on: https://review.typo3.org/48220 Reviewed-by:
-
Andreas Fernandez authored
It's possible to open some backend modules (e.g. RTE or EditDocumentController) in a new tab. However, the configuration for popups is missing in such case, causing e.g. opening the "Insert image" wizard of RTE is not possible anymore. Place configuration inline in TYPO3.settings to not have this problem of missing configuration. Resolves: #76285 Releases: master Change-Id: I1405dd90e4e00fc709d504af2ed0a936a6374fce Reviewed-on: https://review.typo3.org/48276 Reviewed-by:
Andreas Fernandez <typo3@scripting-base.de> Tested-by:
Frank Naegler <frank.naegler@typo3.org> Tested-by:
-
- May 26, 2016
-
-
Georg Ringer authored
Due to the wrong approach of RemoveXSS it is not 100% safe and does not keep its promise. Resolves: #76164 Releases: master Change-Id: I8aa0a05f7866041f392441fa852bae5a7c202142 Reviewed-on: https://review.typo3.org/48102 Reviewed-by:
Nicole Cordes <typo3@cordes.co> Tested-by:
-
Markus Klein authored
Resolves: #76303 Releases: master, 7.6 Change-Id: Ia03f62ccc1c7c989a4284de36ac814758c63d288 Reviewed-on: https://review.typo3.org/48290 Tested-by:
Riccardo De Contardi <erredeco@gmail.com> Reviewed-by:
Stephan Großberndt <stephan@grossberndt.de> Reviewed-by:
Gianluigi Martino <gmartino27@gmail.com> Tested-by:
-
Helmut Hummel authored
Fluid variables must never be used in JavaScript context. Instead they should be put into data attributes, which can be accessed from JavaScript easily. Resolves: #76304 Releases: master Change-Id: I16c0d6b265ad446d73cbe285be7653d1a8ebcfd2 Reviewed-on: https://review.typo3.org/48291 Reviewed-by:
-
Helmut Hummel authored
When adding visibility information in DebuggerUtility it was not respected that this utility can also be used to output in cli. Add the missing condition and output HTML only if requested. Additionally when the property has nested objects, the visibility info must be right after the property not after every nested object. Also prettify object type output on command line on the go. Resolves: #76301 Related: #76008 Releases: master Change-Id: If82192bf9d1fb0ca1dc843242167d01b1a915f6e Reviewed-on: https://review.typo3.org/48287 Reviewed-by:
Elmar Hinz <t3elmar@gmail.com> Reviewed-by:
-
- May 25, 2016
-
-
Georg Ringer authored
By using the <code>-tag, the output of paths is improved: - XCLASS usage - Path to ENABLE_INSTALL_TOOL - Path to deprecation log Resolves: #76288 Releases: master, 7.6 Change-Id: I591009cd52ba1dec6d25ff135e76b7b536b84193 Reviewed-on: https://review.typo3.org/48282 Reviewed-by:
Jigal van Hemert <jigal.van.hemert@typo3.org> Tested-by:
-
Jigal van Hemert authored
The URI is HSC'd by default. Using the output unformatted produces a correct URI for use inside JS. Resolves: #76289 Releases: master Change-Id: Iec7b9aaa0a26ec9acfe6ba49924373965a989a2f Reviewed-on: https://review.typo3.org/48283 Reviewed-by:
-
Markus Klein authored
Resolves: #76296 Releases: master Change-Id: I039e031ff6f46c94d474c35c43de372cfc5b0fc2 Reviewed-on: https://review.typo3.org/48286 Reviewed-by:
-
- May 24, 2016
-
-
Markus Klein authored
The patch for #70463 introduced a regression which caused added elements to include HTML markup. Resolves: #76286 Releases: master, 7.6 Change-Id: I596602b03fd65f2e8d95171c2f2f79ff57006f14 Reviewed-on: https://review.typo3.org/48277 Reviewed-by:
Johannes Kasberger <johannes.kasberger@reelworx.at> Tested-by:
-
Helmut Hummel authored
Resolves: #76150 Releases: master Change-Id: Ia51ec33ba4aacabc884292d4a9508ce0d2c4cd9d Reviewed-on: https://review.typo3.org/48078 Reviewed-by:
-
Wouter Wolters authored
With the introduction of Doctrine DBAL the obsolete settings of all upgrade wizards related to TYPO3 CMS 7 are added again. Remove them now again. Resolves: #76258 Related: #75454 Releases: master Change-Id: Ib86591525724b2fd189038a04dfa645815f4fe55 Reviewed-on: https://review.typo3.org/48238 Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
Marvin Dettinger authored
Resolves: #76098 Releases: master, 7.6 Change-Id: I4ceb644328671cd3355340d6b6991d60e88b265a Reviewed-on: https://review.typo3.org/48046 Reviewed-by:
Christoph Kratz <ckr@rtp.ch> Tested-by:
Marvin Dettinger <mde@rtp.ch> Tested-by:
-
Helmut Hummel authored
Resolves: #76278 Releases: master, 8.1, 7.6, 6.2 Change-Id: Iedb71737ab3b69f2873292ea1cab165e0ec21cec Reviewed-on: https://review.typo3.org/48265 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Frans Saris <franssaris@gmail.com> Tested-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Tested-by:
Jan Helke <typo3@helke.de> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Helmut Hummel <helmut.hummel@typo3.org> Tested-by:
-
Helmut Hummel authored
Instead of only checking for valid request arguments by using a hmac, we now check the complete request including action, controller and vendor to avoid spoofing these arguments and bypassing other security checks during forwarding to the referring action. Additionally, ReferringRequest is now separate from regular Request. The meaning of properties starting with "@" is only valid for processing a referring request. To avoid mixed concerns in using the same Request implementation for regular requests and referring requests, they are separated now. Resolves: #76231 Resolves: #76256 Releases: master, 7.6, 6.2 Security-Commit: 3562e177f1720e62cab84232dcc67c580a3cc3db Security-Bulletin: TYPO3-CORE-SA-2016-013 Change-Id: Ic94e11341df98c1326dc73c92a5c9e061a64cc9e Reviewed-on: https://review.typo3.org/48258 Reviewed-by:
-
- May 18, 2016
-
-
Andreas Fernandez authored
Using `children()` to get the option tags from the select fields will fail if the select field contains `optgroup` tags (e.g. rendered by a hook). This patch replaces `children()` with `find()` to cover this edge case. Resolves: #76097 Releases: master, 7.6 Change-Id: Ib80f422d465d9e48232b1820e524a01a97eb94e6 Reviewed-on: https://review.typo3.org/48044 Reviewed-by:
Daniel Goerz <ervaude@gmail.com> Reviewed-by:
-
Andreas Fernandez authored
The message in the extension manager that notices about installing a conflicting extension contains HTML. As all output is encoded by default, the HTML is obviously also encoded. Wrap the text in `f:format.raw` to decode the HTML and get a functional list again. Resolves: #76214 Releases: master Change-Id: I0b31b907d95679b528a2dc8422cd41c497fe8ec3 Reviewed-on: https://review.typo3.org/48202 Reviewed-by:
-
Tomita Militaru authored
Removes the htmlspecialchars from the rendering of page content titles / tooltips. Resolves: #76149 Releases: master, 7.6 Change-Id: Ia5ad3df56101fe3962e4a5814df53dabdf5a4bbc Reviewed-on: https://review.typo3.org/48106 Reviewed-by:
-
Helmut Hummel authored
Instead of calling the driver registry on every request, we can cache the TCA addition, by putting the call into overrides. Resolves: #76102 Releases: 7.6, master Change-Id: I8cfc72f0e7dbb133eecc754fd3cb774637a0d4bf Reviewed-on: https://review.typo3.org/48047 Reviewed-by:
-
- May 17, 2016
-
-
Oliver Hader authored
Issue #75022 reported problems with libxml and operations on compressed file streams. The work around for that patch showed drawbacks with memory consumption. That's why the push parser is used as default now. Resolves: #75721 Related: #75022 Releases: master, 7.6, 6.2 Change-Id: I6daadd4b375634cf45272bb249e4bfa083f03646 Reviewed-on: https://review.typo3.org/48189 Reviewed-by:
-
Markus Klein authored
Uploaded files must be moved with the specific PHP function, otherwise permissions may be wrong. Resolves: #76205 Releases: master, 7.6 Change-Id: Ic96e6b8927ed5d21131952004805fa72fb8b6857 Reviewed-on: https://review.typo3.org/48181 Reviewed-by:
-
Oliver Hader authored
This reverts commit 3d449f91. This change did not completely solve the libxml issue and introduced additional trouble on memory consumption with the current pull parsers. Related: #75022 Releases: master, 7.6, 6.2 Change-Id: I42454d61ab444860fc53b29715df69e65a2f0475 Reviewed-on: https://review.typo3.org/48182 Reviewed-by:
-
- May 16, 2016
-
-
Andreas Fernandez authored
The exceptions show now the affected class that does not implement the required interface. Where possible, the FQCN in the exception message string was replaced with the shorter ::class syntax. Resolves: #76187 Releases: master, 7.6 Change-Id: Id2c290a0cf29bdec5da504a8959996bb747f1c27 Reviewed-on: https://review.typo3.org/48115 Reviewed-by:
-
Adrian Mot authored
- Use expectedException() and expectedExceptionCode() instead of deprecated setExpectedException() - Fix a couple of incomplete tests in core/Http section, add some and slightly refactor a bit Resolves: #76159 Releases: master Change-Id: I3333f94494ce76601a61e4b5286cfef982867f8f Reviewed-on: https://review.typo3.org/48091 Reviewed-by:
Adrian Mot <adrian.mot@gmail.com> Tested-by:
-
- May 12, 2016
-
-
Wouter Wolters authored
Resolves: #76173 Releases: master Change-Id: I2a273c0e3ab4d4fad7db11ebad84fe00ca4493a1 Reviewed-on: https://review.typo3.org/48108 Reviewed-by:
-
Adam Marcinkowski authored
* Add fixture with categories * Add test to check if categories are visible in list module * Add test to check if category is editable Releases: master Resolves: #76162 Change-Id: Ia518e059d23238f52f79224acffccd21bf8aaa88 Reviewed-on: https://review.typo3.org/48096 Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Tomita Militaru authored
Adds support in the media field for opensource formats: * ogg * flac * opus Resolves: #76072 Releases: master Change-Id: Ie17e1572a5eeb8d4b8954158e4a62e0b54ec6e86 Reviewed-on: https://review.typo3.org/48086 Reviewed-by:
Sebastian Fischer <typo3@evoweb.de> Reviewed-by:
-
Andreas Fernandez authored
The original patch introduced some regressions which are fixed now: - Deletion of multiple items works correctly now - Inserting items by the Element Browser does not throw an error anymore Resolves: #76071 Releases: master, 7.6 Change-Id: Ie16a1d404c2f12e6c952dc5022caff08ec6af171 Reviewed-on: https://review.typo3.org/48062 Reviewed-by:
Tomita Militaru <militarutomita@gmail.com> Reviewed-by:
-
Adrian Mot authored
This patch adds a constrain to compatibility7 extension in order to avoid conflicts with compatibility6 Resolves: #76099 Releases: master Change-Id: Icaf2781b31581380df97a856129a9e28dbd77bdb Reviewed-on: https://review.typo3.org/48052 Reviewed-by:
-
Nikola Stojiljkovic authored
Includes: * Added testing of persistence * Added tests for datetime fields * Prevent random timeouts from affecting the test results * Added displaying of modal with error message instead of an alert on trying to save a form with validation errors The tests are stable using Selenium with Firefox. Using phantomjs gives erratic results due to "QIODevice::write (QTcpSocket): device not open" bug which randomly pops up. Resolves: #76122 Releases: master Change-Id: Ia0c06fc4dbd83e2373d33bb07c48559894fc3ec5 Reviewed-on: https://review.typo3.org/48068 Reviewed-by:
-
Nicole Cordes authored
This follow up ensures the initialization of the value. Resolves: #76124 Releases: master Change-Id: Ie9981971e97d740df1df8545eb2bbd2dae0b465e Reviewed-on: https://review.typo3.org/48084 Reviewed-by:
Nikola Stojiljković <nikola.stojiljkovic@essentialdots.com> Tested-by:
-
Tomita Militaru authored
Removes extra space from between ! and important override from rtehtmlarea CSS. Resolves: #75958 Releases: master Change-Id: If19ff8cc80c11fe650c12e914a07d5b6938a8ab8 Reviewed-on: https://review.typo3.org/48100 Reviewed-by:
-
Tomita Militaru authored
Replaces old TYPO3 Forge link regarding skip default arguments feature in Extbase to TYPO3 Wiki. Resolves: #75909 Releases: master Change-Id: If4d6cce26c22d296af3404c283a39b6851314394 Reviewed-on: https://review.typo3.org/48105 Reviewed-by:
-
Tomita Militaru authored
Adds property visibility information to DebuggerUtility::var_dump after each property in the dump. Resolves: #76008 Releases: master Change-Id: I196bfd45dbd70a52fa4cf29ec1ed24bbcdef2aee Reviewed-on: https://review.typo3.org/48087 Reviewed-by:
-
Nicole Cordes authored
Convert spaces to tabs. Resolves: #76136 Releases: master Change-Id: Ic17bfd0d54b38c1a80ee51d065ce8e3fe4d19efa Reviewed-on: https://review.typo3.org/48099 Reviewed-by:
-
Gianluigi Martino authored
The click area of the update button in extension manager was to small. The click handler is now assigned to the whole button. Change-Id: I8b2103dcbde5dcc37a7968780719abca384528a1 Resolves: #76136 Releases: master, 7.6 Reviewed-on: https://review.typo3.org/48092 Tested-by:
-
Nicole Cordes authored
This patch prevents escaping the output of the RenderChildrenViewHelper. Resolves: #76112 Releases: master Change-Id: I6cbb95c99b7bfc9d14b563edae33129080fc32ec Reviewed-on: https://review.typo3.org/48059 Reviewed-by:
-
- May 11, 2016
-
-
Anja Leichsenring authored
When installing TYPO3 in a cloud environment, the 50 character limit is not high enough. Therefor it is raised to 255 chars, what most protocols define as the max limit. Releases: master, 7.6 Resolves: #76132 Change-Id: I59383911e791b635fc80cb6b6b3c76d4433c8e0d Reviewed-on: https://review.typo3.org/48070 Reviewed-by:
-
