- Sep 13, 2022
-
-
Torben Hansen authored
When a TYPO3 backend user performs a password reset request, a password reset link including an expiration time is sent to the user. The expiration time is included in HMAC calculation of the saved password reset hash, but it is never evaluated if the expiration time is exceeded. This change adds the missing validity check for the expiration time included in the password reset link. Resolves: #97998 Releases: main, 11.5, 10.4 Change-Id: I8a1730faf6489e5c5eebb44ff4f82606785bd637 Security-Bulletin: TYPO3-CORE-SA-2022-008 Security-References: CVE-2022-36106 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75705 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Oliver Hader authored
Observing response time during user authentication can be used to distinguish between existing and non-existing user accounts. This change introduces `MimicServiceInterface::mimicAuthUser` - to be implemented by 3rd party authentication services - which simulates corresponding times regular processing would usually take. Resolves: #98217 Releases: main, 11.5, 10.4 Change-Id: I143ae0d3877dffe6f2decbb3f0cf8c9d9cb6ca0b Security-Bulletin: TYPO3-CORE-SA-2022-007 Security-References: CVE-2022-36105 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75704 Tested-by:
-
- Sep 07, 2022
-
-
Stephan Großberndt authored
README.md and CONTRIBUTING.md use the current repository links with this change. The change also includes several minor edits. Resolves: #98260 Releases: main, 11.5, 10.4 Change-Id: I77d4741df4134ae0babec2415cd8f5345592e29e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75634 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Stephan Großberndt <stephan.grossberndt@typo3.org> Reviewed-by:
-
- Sep 05, 2022
-
-
Josef Glatz authored
All values are default values except the redirectTTL value. Releases: main, 11.5, 10.4 Resolves: #98238 Change-Id: Ifef0b35445828aa4b82084b5a4216174b9ad3e89 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75577 Tested-by:
-
- Aug 16, 2022
-
-
Benni Mack authored
Backend modules which use absolute paths (which do not exist) should not raise an exception / error when using versionNumberInFilename checks. This happens e.g. with EXT:solr backend modules since #97939 was fixed. In the long-term extensions should define proper paths, so they also work in TYPO3 installations within a subfolder but for the time being, this change helps to solve the problem. Resolves: #98152 Related: #98106 Related: #97939 Releases: main, 11.5, 10.4 Change-Id: I071f2e63d4423d157f0f060a1295cb145474ee9d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75494 Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
- Aug 12, 2022
-
-
Christian Kuhn authored
This reverts commit 8c724b77. Reason for revert: The commit-msg hook now tends to throw away the message. Fully loosing a commit message is worse than a funny exit code. We revert for now and eventually come up with a different solution later. Change-Id: If1fdc93487e32f4be4f32ffd200005f746a50bee Reverts: #98094 Resolves: #98094 Releases: main, 11.5, 10.4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75453 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
-
Benjamin Kott authored
While trying to restore the full desktop functionality aka mouse and keyboard behavior on a touch-device we came to the conclusion that it feels unintuitive. On touch devices, you have by design fewer input options and differentiators than with dedicated input devices like a mouse. It feels best to disable the drag and drop behavior and enable a smooth scrolling and navigation experience. Resolves: #91755 Resolves: #86946 Resolves: #93960 Releases: main, 11.5, 10.4 Change-Id: Ic08d06283cbb2331ff49983bd7d18b446f8bd76a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75431 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
-
- Aug 11, 2022
-
-
Benni Mack authored
With the fix of using versioned numbered filenames for the TYPO3 Backend, a use-case "absolutely referenced, but relative to public path file" did break for Frontend inclusions of CSS or JS files. This is now overcome by only using the original bugfix in the TYPO3 Backend. Resolves: #98106 Related: #97939 Releases: main, 11.5, 10.4 Change-Id: Iff6251bd95e1c0a93a6f5538b9f560e55ba80b0c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75369 Tested-by:
-
- Aug 07, 2022
-
-
Simon Schaufelberger authored
Resolves: #98094 Releases: main, 11.5, 10.4 Change-Id: If84f67d6ac91aeaa47849067e21bef6b13854f3c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75360 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
-
- Aug 05, 2022
-
-
Simon Schaufelberger authored
Since the persisted file is stored with a sanitized filename, it must be replaced with a sanitized file name as well, otherwise an error occurs that the source with the un-sanitized file name could not be found. Resolves: #98005 Releases: main, 11.5, 10.4 Change-Id: I9b38316f7a25a281521bff787956dcd6373249d0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75356 Tested-by:
-
Stefan Bürk authored
Quite some issues with docker-compose v2 have been fixed We'll now try to use it again and remove a v1 restriction in `Build/Scripts/runTests.sh`. Resolves: #98086 Releases: main, 11.5, 10.4 Change-Id: I7e4ff82df374db33ba42db0e0d1483f6320ba9ea Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75354 Tested-by:
-
- Aug 01, 2022
-
-
Benni Mack authored
When using routing and custom enhancers to find out what page translation was exactly used to build special logic for Page resolving, the two language-related properties "sys_language_uid" and "l18n_cfg" are now loaded (and thus, added to the "_page" property of a Route) as well. This is useful as l10n_parent is already loaded anyways. Resolves: #98042 Releases: main, 11.5, 10.4 Change-Id: I23f964d5d22f27a9affebfeae87906d9549efda0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75230 Tested-by:
-
- Jul 30, 2022
-
-
Nikita Hovratov authored
In a scenario, where a backend user has two entry points, in which the second one intersects the first one (is a direct sub-page), pages were shown multiple times. The reason behind this was, that inside PageTreeRepository->groupAndSortPages() every page was added regardless if it was already added in a previous run. This is the case, when the same pages are found in different depth levels. E.g. 1 - Home (DB mount 1) 2 - Page 1 2 - Page 2 (DB mount 2) 3 - Subpage 1 // will be added for level 2 and 3 3 - Subpage 2 To prevent this, a guard clause was added, which checks whether the page was already added by comparing the uid value. Resolves: #96512 Resolves: #97774 Related: #96367 Releases: main, 11.5, 10.4 Change-Id: I65439011b894f05faef9cb507d905b3d7d3b709f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75224 Tested-by: -
Stefan Bürk authored
Using database queries without deterministic sorting definition may lead to unreliabe resultsets in some dbms type and version, which also may change over time. Thus it's good practice to have proper defined sorting for queries, at least if result relies on a constant and reliable result sorting. With #96512 and #97774 additional tests has been added, which showed the unreliable of these database queries, blocking the bugfix backport to TYPO3 v10.4. This patch adds sorting definition to two db queries in `\TYPO3\CMS\Backend\Tree\Repository\PageTreeRepository` to ensure consistent results in a deterministic manner and make it possible to provide the related bugfix for TYPO3 v10.4. Resolves: #98056 Related: #96512 Related: #97774 Releases: main, 11.5, 10.4 Change-Id: I8a1bf3b93bcfcaec4c3de3ea6321db62847d0c21 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75336 Tested-by:
-
- Jul 29, 2022
-
-
Oliver Hader authored
A serialization issue has been fixed in symfony/mime 4.4.16 / 5.1.8 which has to be used as minimum version. https://github.com/symfony/symfony/commit/fd99eb26d893390b45c214f4884fea090f1c1178 Resolves: #98052 Releases: 10.4 Change-Id: Ie444aee39685b2f72fc77171fa56040db6a7cf7c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75330 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
- Jul 28, 2022
-
-
Ralf Zimmermann authored
In preparation for patchset https://review.typo3.org/c/Packages/TYPO3.CMS/+/70460/, functional tests are introduced to test the caching behavior of EXT:form. Resolves: #97049 Related: #93887 Releases: main, 11.5, 10.4 Change-Id: Ief1c8d90371d6003512f88a064c2d82e51502590 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75326 Tested-by:
-
- Jul 26, 2022
-
-
Christian Kuhn authored
Casual raise of v6 typo3/testing-framework. > composer req --dev mikey179/vfsstream:^1.6.11 > composer req --dev typo3/testing-framework:^6.16.6 Change-Id: I4761948bd8827ab4638f280d5b69403d300afcb1 Resolves: #98026 Releases: main, 11.5, 10.4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75294 Tested-by:
-
- Jul 24, 2022
-
-
Christian Kuhn authored
The issue has been resolved in sysbox, we don't need the patch level pin anymore. Resolves: #98015 Related: #97570 Releases: main, 11.5, 10.4 Change-Id: I1a2080ec3e8609350c9975bad8f65e69513d5f48 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75222 Tested-by:
-
- Jul 15, 2022
-
-
Christian Kuhn authored
Creating a version overlay of a record that has flexform sections and moving or deleting some of these sections at the same time fails in DataHandler due to a wrong uid lookup for the section command array. The patch fixes this scenario in the DataHandler flexform processing code and leaves an according explanation comment. Note this v10 backport contains the fix only and skips the functional tests that have been added with main. Resolves: #73761 Releases: main, 11.5, 10.4 Change-Id: Ib1c910c59a2ebfe9b7545cabb258f44bac2cd273 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75195 Tested-by:
-
- Jul 14, 2022
-
-
linawolf authored
The reference "Inside TYPO3" is not available anymore since TYPO3 8.7. The sentences are quite useless anyway. Releases: main, 11.5, 10.4 Resolves: #97913 Change-Id: I2d496726db8b22de667d230a99f7d17341fd309d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75157 Tested-by:
Sybille Peters <sypets@gmx.de> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
Oliver Bartsch authored
In case GU::createVersionNumberedFilename() receives a file with an absolute path, no back path should be resolved since the resolved path will always be invalid, which led to no version number got added to the filename anymore. This is now fixed by checking for the path being absolute. Resolves: #97939 Releases: main, 11.5, 10.4 Change-Id: I5bb0150fa27b8c9c1af2aa99bd8baacd55889245 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75142 Tested-by:
-
- Jul 13, 2022
-
-
Stefan Bürk authored
Docblock annotations with more then one space between a wildcard character `*` and the annotation start character `@` was not found. Additionally, annotation identifiers did not regonize hyphens as valid identifier character, thus cutting of e.g. phpstan annoations. This patch now properly finds annotions with multi-space separations and annotation identifiers containing hyphens. Additionally, two phpstan specific annotations are allowed. > https://phpstan.org/writing-php-code/phpdoc-types#local-type-aliases Summarized contained tasks: > find multi-space separated annotations e.g. `* @<AnnotationIdentifier>` > properly extract full annotation identifier containing hyphens e.g. `* @annoation-identifier-with-hyphen` > add `@phpstan-type` and `@phpstan-import-type` as allowed annotation, but only on class level, and not on class-property or class-method level Resolves: #97917 Resolves: #97918 Resolves: #97919 Releases: main, 11.5, 10.4 Change-Id: Iab69ffd87d407088f1237168e19b67a8dc846c8f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75138 Tested-by:
-
- Jul 12, 2022
-
-
Oliver Hader authored
Change-Id: Ib693cdbcba4ebf4a3b68387ed963e5e9ff23c204 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75119 Tested-by:
-
Oliver Hader authored
Change-Id: I33b054bd03a7c1661fa05e09bb22e7f58cf1fa3e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75118 Tested-by:
-
Frank Naegler authored
Since TYPO3 version 10.4, the custom page type is not restricted to any range of numbers. This limitation no longer exists, and any number is allowed. The ElementBrowserPageTreeView just now also respect this and allows to link to other any doktype beside: - PageRepository::DOKTYPE_RECYCLER - PageRepository::DOKTYPE_SYSFOLDER Resolves: #97626 Releases: main, 11.5, 10.4 Change-Id: Iffc3f705f74cc7516464fdb00adb456141657948 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75133 Tested-by:
-
- Jul 10, 2022
-
-
linawolf authored
Releases: main, 11.5, 10.4 Resolves: #97885 Change-Id: Ib274d3d85f1311f100afe8e12167ebc6eaab21db Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75066 Tested-by:
-
- Jul 08, 2022
-
-
dsteinborn authored
"msclkid" is the Click ID parameter of Microsoft / Bing which should be excluded from cHash generation. Resolves: #97870 Releases: main, 11.5, 10.4 Change-Id: I9c625e559cb2c7cf031466730ea4eab2e376f9ff Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75064 Tested-by:
-
Oliver Hader authored
Escaping SQL `LIKE` wildcards is only provided via `QueryBuilder::escapeLikeWildcards()`, but would be useful as `Connection::escapeLikeWildcards()` as well (without having the demand to create another `QueryBuilder` instance). With this patch, both methods are available: * `QueryBuilder::escapeLikeWildcards()`, and * `Connection::escapeLikeWildcards()` Resolves: #97878 Releases: main, 11.5, 10.4 Change-Id: Ia8968dee944300949c6bb2be5b15e2d02a589d25 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75061 Tested-by:
-
- Jul 07, 2022
-
-
Simon Schaufelberger authored
With this patch, the page link (requesting a dedicated paginated page) in the redirects module bottom pagination is now working again. This is done by selecting all pagination forms and adding the submit event to them. Resolves: #94661 Releases: 10.4 Change-Id: I484aacb1f92d95c296a95a594602935551086aff Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74975 Tested-by:
-
Lina Wolf authored
Releases: main, 11.5, 10.4 Resolves: #97867 Change-Id: I5948ff1ab539d6f90da9034fdd05c104ea344c25 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75057 Tested-by:
-
- Jul 06, 2022
-
-
Florian Rival authored
Use new Symfony TypoScript condition syntax instead of outdated syntax. Releases: main,11.5,10.4 Resolves: #97847 Change-Id: Ib0711c2ed871762415b022159a3c6c4b5e688a10 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75054 Tested-by:
Björn Jacob <bjoern.jacob@tritum.de> Tested-by:
-
- Jul 02, 2022
-
-
Oliver Hader authored
When changing values in the form editor inspector, their header content is updated and overridden - as a result the corresponding type icon in the header suddenly disappears. Resolves: #97841 Releases: main, 11.5, 10.4 Change-Id: I18bbd668a16a5b350a14cfa565fb5b96ab205fe8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75011 Tested-by:
waldhacker <hello@waldhacker.dev> Tested-by:
-
- Jun 30, 2022
-
-
Elias Häußler authored
With #96478, the default value for overridden finisher options in FormEngine was set to the translated label "[Empty]" in case the finisher option was empty. Since applying labels to values does not really make sense here, the original option value is now set as default value in FormEngine, ignoring the generated label. Resolves: #97781 Resolves: #97557 Resolves: #96830 Related: #96478 Releases: 10.4 Change-Id: Ice236994485374a3e5399926df901da15cb8d991 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74999 Tested-by:
-
- Jun 28, 2022
-
-
agendartobias authored
config.typolinkLinkAccessRestrictedPages_addParams works only with redirectMode getpost. Releases: main, 11.5, 10.4 Resolves: #97370 Change-Id: I43fc29558eb1d282b4f5939fa115f5350cbede38 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74940 Tested-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
-
- Jun 27, 2022
-
-
Larry Garfield authored
The search results page currently may show the "pages" indicator in the title when there are no page numbers to show. This patch changes it to only show pagination information if there is information to show. Resolves: #96796 Releases: main, 11.5, 10.4 Change-Id: I8c1600a7eb732ed018c22bc02b0e689eb39a081c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74939 Tested-by:
-
- Jun 23, 2022
-
-
linawolf authored
Add changelog entry to https://review.typo3.org/c/Packages/TYPO3.CMS/+/74902 - Restrict export functionality to allowed users Resolves: #97771 Releases: main, 11.5, 10.4 Change-Id: I98252b73aa5b14a8cfe5d26559711123e17ced15 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74977 Tested-by:
Nikita Hovratov <nikita.h@live.de> Reviewed-by:
-
- Jun 22, 2022
-
-
Andreas Fernandez authored
The maintainers of the package guzzlehttp/guzzle released a new version 6.5.8 that fixes two security issues: * CURLOPT_HTTPAUTH option not cleared on change of origin [1] * Change in port should be considered a change in origin [2] Executed commands: composer require \ guzzlehttp/guzzle:^6.5.8 \ -W composer require \ -d typo3/sysext/core \ guzzlehttp/guzzle:^6.5.8 \ --no-update [1] https://github.com/guzzle/guzzle/security/advisories/GHSA-25mq-v84q-4j7r [2] https://github.com/guzzle/guzzle/security/advisories/GHSA-q559-8m2m-g699 Resolves: #97802 Releases: main, 11.5, 10.4 Change-Id: Ia49f75f8ed078beb43ba42f89efdd8e68ee146c5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74973 Tested-by:
-
- Jun 19, 2022
-
-
Robert Kärner authored
The patch for issue #97144 explicitly set a white background for all modules to improve scroll performance. It introduced a regression, changing EXT:dashboard's background from light gray to white as well. This patch resolves the regression by applying the gray background to the new element. Resolves: #97713 Related: #97144 Releases: 10.4 Change-Id: I411b817a7d020a144c43d4382574c7a5d21e554e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74921 Tested-by:
-
Stefan Bürk authored
This patch adjustes invalid namespaces uses in some files to ensure PSR-4 loading compatibility. Resolves: #97793 Releases: main, 11.5, 10.4 Change-Id: Ib8e0a1fd2b0c6493a7cda9d4360abec90b80ade4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74956 Tested-by:
-
- Jun 15, 2022
-
-
Josua Vogel authored
Guard invalid argument type exception by using null coalescing operator in `\TYPO3\CMS\Form\Domain\Finishers\FinisherVariableProvider`. Resolves: #97699 Releases: main, 11.5, 10.4 Change-Id: I6312fb35d52857004e0467a20e215fc4095e0037 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74932 Reviewed-by:
-
