- Feb 09, 2023
-
-
Jochen Roth authored
Hidden task groups are not shown in the dropdown when editing a task. When a task was saved the selected (hidden) group is lost. This has been fixed by extending the query to include hidden groups. Resolves: #99855 Releases: main, 11.5 Change-Id: I8bd94fd3dfad4d0c19e08e8f91904ec2c2f32367 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77724 Reviewed-by:
Josef Glatz <typo3@josefglatz.at> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
Benjamin Kott authored
With this patch, we are starting to declutter the record list. The search box and Clipboard toggles are now available in the "View" settings of the record list view. This change follows the pattern we already introduced in the file list. For the search box, the level selector is now always visible. Resolves: #99895 Releases: main Change-Id: I55cd65f3eda491d44199d9886610c4d6135acc38 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77793 Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
-
Benni Mack authored
This change removes the default configuration of "typo3Language" in the site language configuration. This served the language key used for rendering translated labels from XLF files. The option is removed from the UI, and if the "typo3Language" is not set in the language configuration, the language is resolved from the locale. In addition, certain values regarding system locales in POSIX format (values such as "C" or "POSIX") are now handled in the Locale class as well. Resolves: #99882 Releases: main Change-Id: Ifeeec5d54984426c792ab59b1af44a01d0cdae5d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77726 Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
-
Franz Holzinger authored
use TYPO3\CMS\Core\Http\ApplicationType; Releases: main, 11.5 Resolves: #99888 Change-Id: Ifd2e9bcb46fb08efba5579e2b2ed45605f31157d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77791 Reviewed-by:
-
Alexander Grein authored
The recursive function pagesToFlatArray make use of the page tree repository on two places, which always instantiates the same object. To improve the performance this patch instantiates the page tree only once and stores it in a protected property. Moreover, it adds another protected property editPageAndDefaultLanguageAccess, which holds the general allowance of a backend user to modify pages and access to the default language. This information is needed in the pagesToFlatArray as well and was requested over and over again. Finally, the array_merge construction inside fetchDataAction and filterDataAction was changed to a more performant solution, by merging it after the loop. Overall, this reduces the request time of a page tree ajax call (data and filter) for around 10%. Resolves: #99852 Releases: main, 11.5 Change-Id: I75e8fca96c3eebec72a00e328c634338191d31c1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77750 Tested-by:
-
Georg Ringer authored
An empty end date of a scheduler task is valid and must be allowed. Resolves: #99175 Resolves: #99878 Releases: main Change-Id: I7dd1fd515a400e83c7eb71894c973817d0bb6261 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/76805 Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
-
Benjamin Kott authored
Add visible fallback to avoid unnessesary layout shift until component is fully loaded. Resolves: #99890 Releases: main Change-Id: Ie3d49a420e5d7bc45cfef611616836482fd3b0b0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77795 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
- Feb 08, 2023
-
-
Benjamin Kott authored
The editable page component now looks and feels like a regular h1 element, and keeps this appereance when edit mode is triggered. The new edit mode blends in and avoids layout shifts as much as possible. Resolves: #99879 Releases: main Change-Id: Ie21ed58a822731a70342247fc13c1a45a00f2504 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77786 Tested-by:
-
Stefan Bürk authored
Use null coalescing operator to guard against undefined array key "templateName" accesss in `\TYPO3\CMS\Form\Controller\FormEditorController`. Resolves: #99870 Releases: main, 11.5 Change-Id: I3ebc40e6caab8c2f5bb32563848e836171c44f7b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77776 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Tested-by:
-
Oliver Klee authored
Used commands: > composer req doctrine/dbal:^3.6.0 > composer req doctrine/dbal:^3.6.0 --no-update -d typo3/sysext/core/ > composer req doctrine/dbal:^3.6.0 --no-update -d typo3/sysext/install/ > composer req doctrine/dbal:^3.6.0 --no-update -d typo3/sysext/redirects/ > ./Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #99875 Releases: main Change-Id: I8105e999a1f0766170da44125f0f21e32ac91e82 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77783 Tested-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
-
Benjamin Kott authored
Ensure toolbar dropdowns are fully visible if space is available. Resolves: #99862 Releases: main Change-Id: I05272f6a02fa5fd3e808753d47c46cfdb66663b6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77736 Tested-by:
-
Benjamin Kott authored
Enable record icons for better orientation and correct display of tree lines. Moving the additional edit button to the end of the table because has the same functionality as clicking the item. The form styling was adjusted and does not look out of place anymore. Resolves: #99871 Releases: main Change-Id: Id26f83b85728c8407b5107582fcd6e2ddbc78f22 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77774 Tested-by:
-
- Feb 07, 2023
-
-
Benjamin Kott authored
Executed commands: npm install @typo3/icons@^3.5.0 npm run build Version 3.5.0 onwards the icons for add and remove have been renamed to plus and minus. While an alias exists to ensure that integrations keep working, we are using the new identifiers in core from now on. Element selection icons are now available and used. Resovles: #99869 Releases: main Change-Id: Ied8dbc17e4fe10d24849af4973ab96dadc16ef17 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77773 Tested-by:
-
linawolf authored
Merge right after releasing TYPO3 v12.2 Resolves: #99814 Releases: main Change-Id: I973fe516bc72f177c2d7d70bc82ecbe8a1ada104 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77689 Tested-by:
-
Benni Mack authored
Change-Id: Ie632b791d59866eddbe3e22f654fb261b7e02f6b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77747 Tested-by:
-
Benni Mack authored
Change-Id: I716386d2d91ecd2f463e4500b592498cade9dea2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77746 Reviewed-by:
-
Oliver Hader authored
This reverts commit d38764ff. Reason for revert: Release script pushed to wrong branch Change-Id: I17778c7f3e0fd7f56a8e22725b7ff02ee0149064 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77754 Tested-by:
-
Oliver Hader authored
Change-Id: I93476c966ba30ade007c8f5ada514ef3c286fad1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77740 Reviewed-by:
-
Benjamin Franzke authored
As already started in #88304 (but only for NormalizedParams) and later reverted in #89312 (because of cgi-bin problems), PATH_INFO is no longer considered as a preferable SCRIPT_NAME alternative. All known server configurations set SCRIPT_NAME these days to a proper value when cgi.fix_pathinfo is set. The fallback to PATH_INFO has been introduced with the initial revision of TYPO3 and isn't needed at all nowadays, it's actually wrong, as a REQUEST_URI like /index.php/foo/bar would incorrectly be interpreted as $scriptName == "/foo/bar", which let's all calculations on $scriptName fail and even leads to XSS where values derived from $scriptName are printed without being escaped. Also any ORIG_SCRIPT_NAME evaluation is dropped, as this variable contains the SCRIPT_NAME that was set by the webserver configuration before PHP applied cgi.fix_pathinfo. Using ORIG_SCRIPT_NAME effectively meant bypassing PHP's pathinfo fix. It usually contains the cgi-wrapper paths, which is why PATH_INFO was used to overrule wrong ORIG_SCRIPT_NAME values. GeneralUtility::getIndpEnv('PATH_INFO') is adapted to trust the servers PATH_INFO information, now that we no longer allow servers to send SCRIPT_NAME as PATH_INFO (we enforce cgi.fix_pathinfo=1 for CGI installations). The normalized SCRIPT_NAME is now adapted to be encoded as a URL path by default, as all TYPO3 usages expect this to be an URL path. Note that $_SERVER['SCRIPT_NAME'] refers to the servers file system path, not the URL encoded value. This SCRIPT_NAME sanitization actually enables: a) TYPO3 to be run in a subfolder that contains characters that need URL encoding e.g. `/test:site/` – url encoded that'd be `/test3Asite/`. b) prevention of XSS in case third party extensions missed to escape any URL that is derived from SCRIPT_NAME (while making sure that properly escaped output is not double escaped) Resolves: #99651 Related: #88304 Related: #89312 Releases: main, 11.5, 10.4 Change-Id: Ief95253d764665db5182a15ce8ffd02ea02ee61e Security-Bulletin: TYPO3-CORE-SA-2023-001 Security-References: CVE-2023-24814 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77739 Tested-by: -
Benjamin Franzke authored
Make clear that the early-bail out for empty pageArguments is done to prevent setting `disableCaches` to `true`. Also makes that that the $pageNotFoundOnCacheHashError condition is really tied to pageArguments being non-empty. Prevents us from refactoring that code and missing this bit. Resolves: #99860 Related: #99859 Releases: main, 11.5, 10.4 Change-Id: I98ffa3dffe76a37970784979a2c4f2a9a64aa5bf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77735 Tested-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
-
linawolf authored
Resolves: #99780 Releases: main Change-Id: I5e40fb8b6470c929001da06a8d1a7a7dbcaec0db Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77688 Reviewed-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Lina Wolf <112@linawolf.de> Tested-by:
-
Oliver Hader authored
If $GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['enforceValidation'] is enabled and the HTTP request only contains the `?id` query parameter, caching for the page is disabled - which should be avoided. Resolves: #99859 Releases: main, 11.5, 10.4 Change-Id: I14a81f5a2ec3ecabedd1abf0756a3ee32e7af4e4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77728 Reviewed-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
-
- Feb 06, 2023
-
-
Christian Kuhn authored
A broken boolean toggle introduced with #99282 prevents page cache hits in FE under various conditions. Resolves: #99857 Related: #99282 Releases: main Change-Id: I49066f10bb27c872ebfa9ebce52d76f9cd46f05c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77727 Tested-by:
Jochen <rothjochen@gmail.com> Reviewed-by:
Christoph Lehmann <christoph.lehmann@networkteam.com>
-
Christian Kuhn authored
This reverts commit b8151562. Reason for revert: Adding stdWrap to TS top-level 'config' object gives headaches with fully-cached page access. ContentObjectRenderer is not available in this context, so COR->stdWrap() fails. Change-Id: I895ea267da31845660dd07b6f8cfe50d0c5cef69 Resolves: #99858 Related: #99340 Releases: main Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77583 Tested-by:
-
Annett Jähnichen authored
To provide a streamlined look&feel of record tables in the record list, their table header's background color now matches those of panels, e.g. the "Clipboard" at the very bottom. For the same reason, a box-shadow is applied. To achieve a better visual separation, the table margin is increased. Resolves: #99727 Releases: main Change-Id: I7a64a6c2e3373f956a506630741628b20729b7a4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77611 Tested-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com> Tested-by:
-
Christian Kuhn authored
With the first rewrite of the install tool in 2013, Check.php came with a class comment the class shouldn't have *any* dependencies at all. It of course didn't take long until this was violated. Ten years later, the comment is totally outdated and adapted with the patch a bit to be less awkward. Resolves: #99848 Releases: main Change-Id: I8d1fd5358c5dbacaa063494cb3d2702aa2bb3142 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77715 Reviewed-by:
-
Christian Kuhn authored
The comment in ext:install/Resources/Private/Php/install.php has been established with the very first rewrite of the install tool in 2013. After a series of further rewrites and adaptions it is nowadays pretty much completely outdated and fits no good purpose anymore. Let's get rid of it. Resolves: #99850 Releases: main Change-Id: Id778b6f4cfaa23c725d2b61ef8e9b43c86a2db23 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77716 Tested-by:
-
Markus Klein authored
Extbase does not ask the database anymore for relations, where the uid in the database field is zero. This prevents SQL queries with where-parts like `uid IN (0)`. Since this is done when reconstituting models from the database, depending on the amount of relations of a model, the number of saved queries is huge. Resolves: #99505 Releases: main, 11.5 Change-Id: If3b6c2756674eeb43a66b59a13e44011c9845cd5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77316 Reviewed-by:
Stephan Großberndt <stephan.grossberndt@typo3.org> Reviewed-by:
Stefan Froemken <froemken@gmail.com> Tested-by:
-
Benni Mack authored
When no cHash is given but GET parameters are handed in which _would_ require cHash parameters, these are now properly evaluated during the frontend request. As this has a security impact, a new option called $GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['enforceValidation'] is introduced, which then skips the "requireCacheHashPresenceParameters" option. The latter is an include list, but cache Hash calculation should rather be based on the exclude list such as "excludedParameters" and "cachedParametersWhiteList". If the new option is set, but some properties such as tx_solr[q] should be allowed, then this needs to be added to the excludedList ("excludedParameters") by extension authors. A new test "SlugSiteWithoutRequiredCHashRequestTest" is added which works with a disabled feature flag compared to "SlugSiteRequestTest" which has the feature flag enabled. Resolves: #95297 Releases: main, 11.5, 10.4 Change-Id: Ib72c6a34602e77d8c2044ad2e826c0474ebd2326 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77206 Reviewed-by: -
Max Kellermann authored
Various libraries incorporated by TYPO3 use the "token_get_all" function, crashing PHP execution if the "tokenizer" extension is not loaded. The system environment pre-check now checks the presence of the PHP extension. Also, Composer now requires the presence of the `ext-tokenizer` module. Releases: main Resolves: #99842 Change-Id: I57cb6244d8eb3d8364eae5d23430370e60fd9658 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77711 Reviewed-by:
Markus Klein <markus.klein@typo3.org> Reviewed-by:
-
Jochen Roth authored
Additional warning about password set via cli has been added. Also the logic was changed to always prompt for password (db password and admin user password) if not set via variable/option. Resolves: #99836 Releases: main Change-Id: Ic47e100ecb328ac62b58296bc00feff9a84213aa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77707 Reviewed-by:
-
Andreas Fernandez authored
The class `TYPO3\CMS\Backend\Template\Components\Buttons\GenericButton` accidentally applied the wrong CSS classes on the rendered button. This bugfix now applies the correct classes for buttons and provides setter and getter methods for classes. Resolves: #99841 Related: #99806 Releases: main Change-Id: I3125a1208481da3d488b50847978171ca0b1f2bb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77710 Tested-by:
Benjamin Kott <benjamin.kott@outlook.com> Tested-by:
-
Christian Kuhn authored
The "Included PageTsConfig" view is structurally similar to "Included TypoScript": Include trees are shown, conditions can be toggled. Resolves: #99827 Related: #97816 Related: #99563 Related: #99576 Releases: main Change-Id: I1149bef0ad1f2d2564ca7f45ad83825f73fa4e5b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77699 Tested-by:
-
Benjamin Kott authored
This patch streamlines the behavior of template buttons. For this, we sort all classes to match the same order. To be more flexible for the usage of `DropDownButton` we now also allow the hiding of the label text, but there must be a label text or an icon assigned. We are introducing a `GenericButton` to cover more complex situations while ensuring a unified output. Adjust the `typo3-copy-to-clipboard` element to work like a normal button element that allows keyboard navigation. Resolves: #99806 Releases: main Change-Id: Ic6e7d9036097bfd87493e51e5e128ab895af1731 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77680 Reviewed-by:
-
Stefan Bürk authored
With #97451 some hooks has been removed, and replaced with new PSR-14 events. In the commit message and rst-file one removed hook has been written wrong, which may be the reason why it has been undetected that a `ext:redirects` has used that removed hook. This change implements the now the PSR-14 event to complete the transition and restore the auto-chain information modal after page slug changes. The removed hook name in the corresponding breaking rst-file and the extension scanner matcher definition are changed to the correct name of the removed hook. Resolves: #99835 Related: #97451 Releases: main Change-Id: I537397d3849af099da4e32bb1782407aa0ee1be0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77706 Reviewed-by:
-
- Feb 05, 2023
-
-
Torben Hansen authored
The current arrow icon in position map elements is very small and may be hard to identify as an arrow. This patch replaces the icon with a better version of an arrow icon. Resolves: #99829 Releases: main Signed-off-by:
Torben Hansen <derhansen@gmail.com> Change-Id: If3a51d133afd8ed2bdb83b75bf5d4bcf264afad8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77701 Tested-by:
-
Nikita Hovratov authored
FlexForm was using the old Bootstrap "panel" classes for its sheet tab content. Since the Bootstrap 5 update, the underlying "box-shadow" CSS property became visible. This is now fixed by simply using the "form-section" class like everywhere else for FormEngine container. In addition, the negative margin hack for this specific case can now be removed. Note: The Tabs.html template is still used in the deprecated ModuleTemplate->getDynamicTabMenu() method. As the markup has changed, it could look a bit different compared to TYPO3 v11, in case custom CSS was applied, which is very unlikely. Resolves: #99816 Releases: main Change-Id: I74b67fba421569669cbe3bf073097f6a18006acb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77691 Tested-by:
-
Stefan Bürk authored
`doctrine/annotations` v2 removed autoloading related methods in their `\Doctrine\Common\Annotations\AnnotationRegistry` class. With #99832 this dependency has been allowed in 1.x and 2.x, which now pulls in the version with removed methods. With #82869 `doctrine/annotations` has been added as dependency along with this autoloader register call. Versions have been raised since then multiple times. The standing 1.13.x version marked these autoloading methods as deprecated, recommending to rely on global autoloader. That means that the used composer autoloader should be sufficient, especially as it only provided a callback to the already used global autoloader. This change removes the no longer needed autoloader registration call from `\TYPO3\CMS\Core\Core\Bootstrap`. Resolves: #99833 Related: #99832 Related: #82869 Releases: main Change-Id: I4fb33e3bdb2b5e6bb2953d5f336030ca406fd175 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77705 Reviewed-by:
-
Benni Mack authored
Various dependencies which have released major versions (to be compatible to further upstream packages) are now raised: * doctrine/annotations (allowing both 1.13 + 2) * doctrine/event-manager (For DBAL v4 compatibility) * doctrine/lexer (v2 + v3 instead of v1) * egulias/email-validator (4.0) using lexer Core `TYPO3\CMS\Core\Database\Schema\Parser\Parser` has got proper native types and return types to match deprecated array access on tokens returned by raised `doctrine/lexer` - which is used internal. That solved some phpstan ignore patterns as side-change. Used commands: * composer req "doctrine/annotations:^1.13.3 || ^2.0" "doctrine/event-manager:^2.0" "doctrine/lexer:^2.0 || ^3.0" "egulias/email-validator:^4.0" -W * composer req "doctrine/annotations:^1.13.3 || ^2.0" "doctrine/event-manager:^2.0" "doctrine/lexer:^2.0 || ^3.0" "egulias/email-validator:^4.0" -W -d typo3/sysext/core --no-update * Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #99832 Releases: main Change-Id: I8acc42933014f5d6711f2a6442499d7070a68a0b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77704 Reviewed-by:
-
- Feb 04, 2023
-
-
Benni Mack authored
This change introduces the combination of the newly added Locale class and SiteLanguage, allowing to work more with the objects than with strings as before. We're also adding an internal "POSIX" formatted logic to the Locale object, so the setLocale() calls can still work as before. This patch basically provides a bridge between the previously used POSIX format ("de_AT.utf-8") and the BCP-47 definition of language tags which is the base for the Locale class. However, both formats can now be used (in site configuration), and are properly formatted in setLocale() or in HTTP response headers in Frontend, which was a limitation before. Resolves: #99812 Releases: main Change-Id: Iee62e537f7dd334d614e4922cb7a0dd7222c379d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77685 Tested-by:
-
