This change adds further MySQL Server versions to the
`Build/Scripts/runTests.sh` to allow executing local
functional and acceptance tests with these version.

Added versions:

- MySQL 8.1
- MySQL 8.2
- MySQL 8.3

Resolves: #103030
Releases: main, 12.4, 11.5
Change-Id: I578ed524560ae1907ab8a79df7694470f9aa234a
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82785


Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: core-ci <typo3@b13.com>

This change now checks for a records' sys_language_uid field
before doing overlays, and is only doing overlays when
the incoming record has a "sys_language_uid" -1 and was properly
overlaid.

Resolves: #100931
Resolves: #101229
Resolves: #101718
Releases: main, 12.4, 11.5
Change-Id: I73acaf02de950312d1728936a92b6603ff62eb77
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79775


Reviewed-by: Benni Mack <benni@typo3.org>
Tested-by: Benni Mack <benni@typo3.org>
Tested-by: core-ci <typo3@b13.com>
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82775


Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>

The `Build/Scripts/runTests.sh` supports `podman` and `docker`
as container cli binary since quite a while now, albeit docker
has been kept as default if not specified using `-b`.

This change removes the hard default and will now use `podman`
as default. In case `podman` is not available `docker` is used.
As a side-effect, the binary for CI is no longer enforced the
hard way.

PostgreSQL 16 is added as database version.

Resolves: #103018
Releases: main, 12.4, 11.5
Change-Id: Iedcd7cbcd2380adb6781bd8b4f075da86e25c03b
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82767


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: Stefan Bürk <stefan@buerk.tech>

The first argument after processing defined options has been
stored into the variable `TEST_FILE`. This value was passed
to PHPUnit based commands as last argument, defining the test
case to execute (or a subset).

Removing this workaround and directly passing remaining options
to the command makes special arguments like `-e` obsolete and
unblocks more generic command passing.

This change removes this variable and passes all remaining
arguments after option processing directly to the PHPUnit
command and paves the way for future command improvements.

Note:   This makes the `-e` option basically obsolete, but
        is kept for now to minimize muscle memory issues.
        Using it will display a `deprecation` notice at the
        end of the script - so it gets recognized.

Resolves: #102769
Releases: main, 12.4, 11.5
Change-Id: I9a85206330a7e1b58d81dc5a2c97a13831af29a1
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82729


Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Stefan Bürk <stefan@buerk.tech>

When fetching a lot of records from database the memory is nearly
doubled in the fetchAll function. It seems php keeps references or
creates an array copy that could not be garbage collected. Enforcing
a manuell gc_collect_cycles does not help either.

Resolves: #102986
Releases: main, 12.4, 11.5
Change-Id: I2da5f1e0126aa1dc867c8fb3074be4a11491f8f3
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82724


Reviewed-by: Benjamin Franzke <ben@bnf.dev>
Tested-by: Benjamin Franzke <ben@bnf.dev>
Tested-by: core-ci <typo3@b13.com>

There might be no comma in front of an extension
scanner tag. This should not lead to an error as
it's unrelated for this check and will already be
catched by the "validateLastLine" check.

Resolves: #102987
Releases: main, 12.4, 11.5
Change-Id: Icda7cbb1b01ced39ee80311e15bccdfd9318b953
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82718


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Oliver Bartsch <bo@cedev.de>

The `is:pageBrowsing` ViewHelper now receives the `freeIndexUid`
argument.

Resolves: #102950
Releases: 12.4, 11.5
Change-Id: Ia8c6dd2bf5a61676cf9db85ef2623cf76d7dffb9
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82699


Tested-by: core-ci <typo3@b13.com>
Tested-by: Andreas Kienast <a.fernandez@scripting-base.de>
Reviewed-by: Andreas Kienast <a.fernandez@scripting-base.de>

The method resolveResourcePaths() is superfluous because the
PageRenderer resolves path with EXT: later with
getStreamlinedFileName() anyway.
Furthermore this patch resolves open_basedir errors. As a plus,
the form.css gets a version numbered filename now which mitigates
caching issues.

Resolves: #98545
Releases: main, 12.4, 11.5
Change-Id: Ie93b6aa817889281c8f96fd272884f03cab3857e
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82617


Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: core-ci <typo3@b13.com>

New core-testing-* images has been build and published in
the TYPO3 testing-infrastructure repository and pulled to
the core ci gitlab runner instances. [1][2]

This change modifies `Build/Scripts/runTests.sh` to set
new image version to ensure the usage for all changes
based on this change.

For information what changed in the image see the patches
in the testing-infrastrucure repository linked below - at
least for the phpXY images.

* core-testing-php74 => 2.6
* core-testing-php80 => 2.6
* core-testing-php81 => 2.10
* core-testing-php82 => 1.9
* core-testing-php83 => 1.10
* core-testing-js => 1.4
* core-testing-js-chrome => 1.4

[1] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/2fb328622d88d47afd3e8abc9bf6ff32f7ef3db6
[2] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/e1ec0954b823acbab3f37100f8b6d0a03c31f0d8

Resolves: #102886
Releases: main, 12.4, 11.5
Change-Id: I3830a5f53b18e2170c9f973a66007dc3868d99dd
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82554


Tested-by: core-ci <typo3@b13.com>
Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>

Change-Id: I20b54295db619fbfebf1d0958b057e495d2334bc
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82465


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

Change-Id: I46b6548fd7f7e58dfabdc8f7b87871ce55ba61ec
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82464


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

The example value '-t -i' for `transport_sendmail_command` is incorrect,
as an executable is expected to be provided, not just command flags.
Since this option is not needed for SMTP at all, it is dropped from this
example.

Releases: main, 12.4, 11.5
Resolves: #102837
Change-Id: I99569f23339ae68077edf16aaa59873aa84ba24d
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82476


Tested-by: core-ci <typo3@b13.com>
Tested-by: Benjamin Franzke <ben@bnf.dev>
Reviewed-by: Benjamin Franzke <ben@bnf.dev>

The `\TYPO3\CMS\Core\Service\OpcodeCacheService->isClearable()`
method checks for existence of opcache function and if they are
listed in the `disable_functions` configuration.

It seems, that in some environments both methods are missing
and not listed in the disabled methods. Even if this sounds
odd when the opcache extension is installed but both methods are
not available, we add it to the check to avoid the missleading
error message:

	Call to undefined function
	TYPO3\CMS\Core\Service\opcache_reset()

Resolves: #102734
Releases: main, 12.4, 11.5
Change-Id: Icc17a276e8881f502a687db7ca57fc05ecb8981e
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82384


Tested-by: core-ci <typo3@b13.com>
Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>

Additionally prevent a TypeError in case
SHARED.colPos_list is used.

Resolves: #102135
Releases: 11.5
Change-Id: Idcfae6b30bb3c973f39bc7a9b67d0e08d4344d91
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81399


Reviewed-by: Oliver Bartsch <bo@cedev.de>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Stefan Bürk <stefan@buerk.tech>

PHP-CS-Fixer rule `array_indentation` is activated to have
consistent indentation of arrays.

In addition, a full run of php-cs-fixer without
caches shows also affected areas where comments
did not apply properly.

Resolves: #102753
Releases: main, 12.4, 11.5
Change-Id: I759149606c4b042f1ac4329d4f5b7166d591456b
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82335


Tested-by: core-ci <typo3@b13.com>
Tested-by: Benni Mack <benni@typo3.org>
Reviewed-by: Benni Mack <benni@typo3.org>

Update copyright year to 2024

Resolves: #102741
Releases: main, 12.4, 11.5
Change-Id: I1a909b221513b5add387d9680193d8deb4285a04
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82313


Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Oliver Klee <typo3-coding@oliverklee.de>
Reviewed-by: Oliver Bartsch <bo@cedev.de>

New `core-testing-phpXY` images has been build
and released. [1]

This change update used image version to:

* core-testing-php81:2.9 - php 8.1.27 (patchlevel)
* core-testing-php82:1.8 - php 8.2.14 (patchlevel)
* core-testing-php83:1.9 - php 8.3.1  (patchlevel)

[1] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/11f78ce2ac1f38355fdb7d59e1472e62a02ba894

Resolves: #102729
Releases: main, 12.4, 11.5
Change-Id: I991061445e28a358c1aeadebf3213d87394d04ad
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82250


Tested-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: core-ci <typo3@b13.com>

Resolves: #102713
Releases: main, 12.4, 11.5
Change-Id: I18c841d9085221f4b6ff826600965b159af7971b
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82246


Tested-by: core-ci <typo3@b13.com>
Tested-by: Nikita Hovratov <nikita.h@live.de>
Reviewed-by: Nikita Hovratov <nikita.h@live.de>

Resolves: #102383
Releases: main, 12.4, 11.5
Change-Id: Iced9d71874a51ee321857b662fa157ca2c2c0307
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82239


Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Oliver Bartsch <bo@cedev.de>

The TYPO3 core `runTests.sh` contains the `-u` option to
update the images and remove dangling images. Providing
an image name and a `--filter` option is not supported
by podman:
 > Error: cannot specify an image and a filter(s)
 and has not been discovered yet in the TYPO3
core implementation yet.

Both container runtimes `docker` and `podman` support filtering images
using the `reference` filter option. Therefore, this change modifies
the dangling image removal to use multiple filters

To verify that filtering with two `--filter` options can be used with
podman and docker, the following commands can be executed to list the
set of local non-dangling images.

Note: This example uses `dangling=false` instead of
	  `dangling=true` (as in `runTests.sh`), since we expect
      most developers don't have dangling images yet.

> podman images \
    --filter "reference=ghcr.io/typo3/core-testing-*" \
    --filter "dangling=false" --format "{{.ID}}"

> docker images \
    --filter "reference=ghcr.io/typo3/core-testing-*" \
    --filter "dangling=false" --format "{{.ID}}"

Resolves: #102697
Releases: main, 12.4, 11.5
Change-Id: I717d1aa229bdfb73c63aa5b2d46e1aff665544cb
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82236


Tested-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>

Input data is statically provided by EXT:core only, so there is no
security issue known right now. This change is a preparation to avoid
possible future security issues.

Resolves: #102676
Releases: main, 12.4, 11.5
Change-Id: I49a7fdd250e8ce74fdde07ad305cbae7e4af8ec3
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82252


Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Oliver Bartsch <bo@cedev.de>

With #92289 logic has been decoupled from `ResourceFactory`
into the `StorageRepository`. As a side change, native php
types have been added to a couple of methods.

`StorageRepository->findByUid()` parameter type has been set
to integer, which breaks the `null` fallback and retrieving
the default storage `uid: 0` in `ResourceFactory` method
`getStorageObjectFromCombinedIdentifier()`. Even worse is
the fact that `getObjectFromCombinedIdentifier()` does not
even try to cope with a invalid identifier provided.

This change modifies `getObjectFromCombinedIdentifier()` and
`getStorageObjectFromCombinedIdentifier` of `ResourceFactory`
to cope with missing storage identifier by falling back to
the default storage (`0`) with a shuffle of the exploded values.

As a side-effect two PHPStan ignore patterns can be removed
from the PHPStan baseline file.

Used command(s):

  Build/Scripts/runTests.sh -s phpstanGenerateBaseline

Resolves: #102692
Related: #92289
Releases: main, 12.4, 11.5
Change-Id: I8ee9736839f59db7917cb49dd0d62af17ee28cda
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82233


Tested-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>

If the user permissions contain DB tables which are not available
anymore, a notice is turned into an exception.

Resolves: #101547
Releases: main, 12.4, 11.5
Change-Id: I98cd8fb74893c31fe8ca6c14e4ee87ddb0e578ae
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82126


Tested-by: core-ci <typo3@b13.com>
Tested-by: Benni Mack <benni@typo3.org>
Reviewed-by: Benni Mack <benni@typo3.org>

Something changed with recent phpspec/prophecy release
1.18.0 which now stumbles upon a missing namespace
import in a unit test. Import correctly.

Resolves: #102636
Relaeses: 11.5
Change-Id: If9015bbaf89bbd77bb59c084260c4bb834447ea8
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82155


Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>

New `core-testing-phpXY` images has been build
and released.

This change update used image version to:

* core-testing-php74:2.5 - php 7.4.33 (rebuild only)
* core-testing-php80:2.5 - php 8.0.30 (rebuild only)
* core-testing-php81:2.8 - php 8.1.26 (patchlevel)
* core-testing-php82:1.7 - php 8.2.13 (patchlevel)
* core-testing-php83:1.8 - php 8.3.0  (major)

[1] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/6ead80df3d46bf1f0c2363e8728435b2d2363fba

Resolves: #102575
Releases: main, 12.4, 11.5
Change-Id: I85a8b0a97d63fea01c790fd9c7ab5d51536a21b1
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82054


Tested-by: core-ci <typo3@b13.com>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Garvin Hicking <gh@faktor-e.de>
Reviewed-by: Garvin Hicking <gh@faktor-e.de>

FalMetadataCest changes the title of styleguide
'bus_lane.jpg'. InlineFalCest uses the title to
look up details in element information modal and
stumbles. Check for the filename only to avoid
this side effect.

Resolves: #102523
Releases: 11.5
Change-Id: I6b111194e9888690bf630ef24b86ac8947223127
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81971


Reviewed-by: Jasmina Ließmann <minapokhalo+typo3@gmail.com>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Jasmina Ließmann <minapokhalo+typo3@gmail.com>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Andreas Kienast <a.fernandez@scripting-base.de>
Reviewed-by: Andreas Kienast <a.fernandez@scripting-base.de>

Bash hashtables are not supported in bash v4,
so we rather use a lookup function.

Resolves: #102502
Related: #102450
Releases: main, 12.4, 11.5
Change-Id: Id5c875b78ec655e15d225914626769720bbc3a81
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81952


Tested-by: core-ci <typo3@b13.com>
Tested-by: Benjamin Franzke <ben@bnf.dev>
Reviewed-by: Benjamin Franzke <ben@bnf.dev>

Allows to auto-update local images for feature-updates
simply by raising them in runTests.sh (like we do for
external images as well).

That means `runTests.sh -u` is only needed in case
patch updates are desired or needed.

Resolves: #102450
Releases: main, 12.4, 11.5
Change-Id: Id9bdd679e430d57794e5d9e48f18ea67ed17d46c
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81938


Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>

Removing all containers will remove their dangling volumes
automatically and we can drop the manual cleanup.

Parameters have been applied via:
  sed -i '/CONTAINER_COMMON_PARAMS/!s/\${CONTAINER_BIN} run/& --rm/' \
    Build/Scripts/runTests.sh

Resolves: #102449
Releases: main, 12.4, 11.5
Change-Id: I77b4166cbad427afef5c87173428433881e9eb85
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81928


Tested-by: core-ci <typo3@b13.com>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>

The php namespace integrity check uses a symfony
finder to determine which files should be checked.
The used pattern to ignore extension configuration
folder `Configuration` excluded every file,  which
has `Configuration` in the path or filename.

This change avoids using the nifty magic `exclude()`
finder method and replace it with a more reliable
`notPath()` configuration.

Resolves: #102483
Releases: main, 12.4, 11.5
Change-Id: Ic0ae6eaae736b86412f8a430f11ea5b0a8e9dca9
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81925


Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>

This patch is paired with the setup of a new CI [1].

The patch adapts runTests.sh to allow podman as
container environment next to docker. New CI relies
on podman.

Locally, podman can be selected as container environment
using the `-b podman` flag to runTests.sh. A "recent"
podman version - at least around 4.x - should be used.
docker is kept as default for now.

The new CI setup comes with a series of improvements
to speed up things. This makes the acceptance tests
a bit more brittle again. The patch comes with some
further stabilizations, and we may add even more with
dedicated patches later.

[1] https://git.typo3.org/typo3/CI/testing-infrastructure/

Change-Id: I206c1577335bfbefb801eaababa4b713e1edda12
Resolves: #102385
Releases: main, 12.4, 11.5
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81792


Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>

If deleting content elements which have references
to it, a confirm dialog is displayed asking if the
element should really be deleted. Usually, the
dialog message contains information about existing
references (if there are references).

This was not the case if the content element is deleted
by using the inline delete button in the page module
in TYPO3 v11.

This behaviour was already improved and streamlined
in TYPO3 v12.

This is a partial backport of functionality in patch
https://review.typo3.org/c/Packages/TYPO3.CMS/+/72001
to backport the most critical functionality
improvement.

Releases: 11.5
Resolves: #101414
Related: #101411
Related: #92670
Related: #94780
Change-Id: Ie3ecad8f38a862c652baf115719b207820865708
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80116


Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Garvin Hicking <gh@faktor-e.de>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Garvin Hicking <gh@faktor-e.de>

Add missing typecast to prevent deprecation notice.

Resolves: #102396
Releases: 11.5
Change-Id: I49f22bac872b2485cb282ce26121a06e08f87810
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81802


Reviewed-by: Nikita Hovratov <nikita.h@live.de>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Nikita Hovratov <nikita.h@live.de>

This has already been fixed upstream as a drive-by change.

Resolves: #102388
Related: #97433
Releases: 11.5
Change-Id: Id3f8f541b077d4d3b51bdd794847249b4229768f
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81760


Reviewed-by: Thomas Hohn <tho@gyldendal.dk>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de>
Reviewed-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: core-ci <typo3@b13.com>

Backend responses must never be cached. The previously used
Cache-Control instruction "must-revalidate" implicitly enabled
caching in order to possibly reuse a response. While that
could only happen when two requests to the same URL are
invoked within one second (because the browsers
`If-Modified-Since` header and our `Last-Modified` header
match, causing the webserver to issue a 304 response),
that is certainly possible in CI setups or fast user clicks.

Use `no-store` in order to instruct browsers to not cache
and try revalidation at all.

Resolves: #102377
Releases: main, 12.4, 11.5
Change-Id: Ic05cad748f824e7a45a1740aca15cd2fc3595a79
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81756


Tested-by: core-ci <typo3@b13.com>
Tested-by: Benjamin Franzke <ben@bnf.dev>
Reviewed-by: Benjamin Franzke <ben@bnf.dev>

Change-Id: Icde820cccfe18d323fcd0c208bac450cb83820d4
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81739


Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

Change-Id: I121b8214fc0edf4cb901e3e5cbcda76c7a958c6a
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81738


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

See https://github.com/TYPO3/html-sanitizer/releases/tag/v2.1.4

composer req typo3/html-sanitizer:^2.1.4
composer req typo3/html-sanitizer:^2.1.4 \
   -d typo3/sysext/core --no-update

Resolves: #102169
Releases: main, 12.4, 11.5
Change-Id: I76edb7ff0dc66d3308d5c0875c2db56ca02addd7
Security-Bulletin: TYPO3-CORE-SA-2023-007
Security-References: CVE-2023-47125
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81732


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

Given that there are two sites `site-a.com` and `site-b.com` in
the same TYPO3 installation, it was possible to reuse a session
cookie that was generated for `site-a.com` in `site-b.com`.

Since there are scenarios, where this is the expected behavior
– when sharing sessions across sub domains, so that an explicit
cookieDomain needs to be configured – user sessions IDs are now
signed with a combination of encryption key and desired cookie
domain, so that a cookie can only be used on the domain that the
cookie was created for.

For compatiblity with possible 3rd party authenticators, legacy
tokens will be accepted (but not created by TYPO3 core itself).

Resolves: #100885
Releases: main, 12.4, 11.5
Change-Id: I0d1c314c6e206ac12604ba6f859af78b958651dd
Security-Bulletin: TYPO3-CORE-SA-2023-006
Security-References: CVE-2023-47127
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81731


Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

We're in the process of establishing a new
core CI. This has more power and is better
optimized.
The resulting runtime changes reveal various
flaky acceptance tests. Most have been
problematic before already, but not as bad.
The patch adds various guards to acceptance
tests to reduce flakiness.

Resolves: #102363
Releases: main, 12.4, 11.5
Change-Id: Iff2c79411b39fffe659c78a8e889f8a804939bc4
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81722


Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>