- Jan 16, 2020
-
-
Oliver Hader authored
Enable experimental checking of serialized Phar meta-data against PHP objects. This would consider a Phar archive malicious in case not only scalar values are found. A custom low-level Phar\Reader is used in order to avoid using PHP's Phar object which would trigger the initial vulnerability. Resolves: #90010 Releases: master Change-Id: Ifda811fab44bdbb8f4858d18e392e0f321dbf1be Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62760 Tested-by:
TYPO3com <noreply@typo3.com> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
Susanne Moog <look@susi.dev> Reviewed-by:
-
Daniel Siepmann authored
Prevent PHP TypeError when creating request from globals containing numeric keys. Resolves: #89980 Releases: master Change-Id: I4c22891a0a341b11cb6c9a42923dadeb45a07524 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62736 Tested-by:
Felix P. <f.pachowsky@neusta.de> Tested-by:
Alexander Schnitzler <review.typo3.org@alexanderschnitzler.de> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
Benni Mack authored
The permission access module allows for AJAX calls to dynamically updating page permissions on the fly, where DataHandler is used. When using the form to do a more customizable change, plain SQL was used previously to update the pages. This circumvented the change to also update any translated pages (which DataHandler does by default). This wasn't a problem until TYPO3 v9.0, where pages_language_overlay was merged with "pages", where the permissions of translated pages should reflect the changes of the default language page. The change updates the PermissionController->updateAction to call DataHandler for the changes as well. Resolves: #89838 Resolves: #88311 Releases: master, 9.5 Change-Id: I9e56b279ddcbb43ee7bb11b330c288b12a0e7439 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62930 Tested-by:
Jörg Bösche <typo3@joergboesche.de> Tested-by:
Daniel Goerz <daniel.goerz@posteo.de> Reviewed-by:
-
NGUYEN Duc Quan authored
Adding the possibility to enable/disable filelist localization Resolves: #90114 Releases: master Change-Id: I42529e035a1325ff41cf7584db73b268ddc58ac1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62922 Tested-by:
-
Sebastian Mazza authored
Resolves: #86917 Releases: master, 9.5 Change-Id: I740c839635143fef2ec33b9b7dd2c6b84f843007 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/61696 Tested-by:
Sascha Rademacher <sascha.rademacher+typo3@gmail.com> Tested-by:
-
Daniel Siepmann authored
When fetching items from foreign table, they might be sorted based on foreign table configured sorting. In such case the foreign table name is prefixed to prevent ambiguous column name. Resolves: #90127 Related: #70677 Releases: master, 9.5 Change-Id: Iebda2bd417481ae01b1265dd9be31b67af89991d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62929 Reviewed-by:
Tobi Kretschmann <tobi@tobishome.de> Tested-by:
-
Susanne Moog authored
The DebugExceptionHandler will display full error messages and stack traces and should not be used in production. To mitigate the information disclosure, a new status report has been introduced: - if display errors is set to 1 (-> uses DebugExceptionHandler setting) and context is Production an Error is displayed - if display errors is set to 1 (-> uses DebugExceptionHandler setting) and context is Development a Warning is displayed - if the production exception handler setting is configured to use the DebugExceptionHandler an Error is displayed Resolves: #89978 Releases: master Change-Id: I0f4eb357cf2c0a8012ed2e12a8c9f63073d3a19c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62735 Tested-by:
-
Felix Althaus authored
Menu entries in both open documents and recent documents list of the opendocs extension were htmlspecialchar‘ed twice. One level of escaping was removed. Resolves: #89553 Releases: master Change-Id: Id04f8742e3b91ad3ce8618f4d49f2d4e12b93d71 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62161 Tested-by:
-
Susanne Moog authored
Preview functionality was only implemented in the Admin Panel. Previewing itself (as in being able to preview pages with access or user restrictions) should also work without having the admin panel installed and open. The basic process is now like this: - Backend generates preview URLs for pages with access restrictions -- starttime, endtime, fe groups --> parameters ADMCMD_simUser and ADMCMD_simTime are appended to the FE URL - Frontend PreviewSimulator Middleware uses these parameters to modify the current Context - Adminpanel - if installed and open - takes given parameters as settings for preview date/time/group - when user changes those, they are overwritten Technical Changes: - BackendUtility: Enable link generation for a specified context - DateTimeAspect: Add new property to aspect to mirror SIM_ACCESS_TIME global - PageRepository: Use new DateTimeAspect context property for enable fields - AdminPanel: Set $_GET params in settings if given, remove $_GET vars if user saves admin panel settings (to allow user to change date/time in AdminPanel) Resolves: #86653 Releases: master, 9.5 Change-Id: I3a2302845461e9c18f9349438e10f1c059a85e48 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/59927 Tested-by:
-
Chris Müller authored
The debugging of the yaml configuration of the form extension can be hard. To ease this task the configuration is available in the configuration module of the lowlevel extension. Resolves: #90052 Releases: master Change-Id: I0bfbae26d2f84f4e90766b9dab6e609f029e9c69 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62816 Tested-by:
Guido Schmechel <guido.schmechel@brandung.de> Tested-by:
Steffen Frese <steffenf14@gmail.com> Tested-by:
-
Benni Mack authored
OpenSSL was only needed for EXT:rsaauth, so a check in the installer / system maintenance should be avoided. It is now rather a suggestion. Resolves: #83643 Releases: master, 9.5 Change-Id: If62b7fc1ddc211083fa8b4f793019e61cf2046eb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62918 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
-
Oliver Hader authored
Range from '01' to '03' correctly leads to ['01','02','03']. The prefix mechanism is however applied for a range from '0' to '11'. This should only happen when explicitly having used '00' to '11'. Resolves: #90123 Releases: master, 9.5 Change-Id: I90672c4d94cb97d61fe45f8d6e1382b8be3b49b7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62920 Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
-
Daniel Goerz authored
Editors without access to the default language can no longer see those options in the context menu for page records that would lead to error messages due to missing language access. Additionally the list menu doc header and edit button for translated pages in the list menu are adapted to respect missing access rights to the default language as well. Resolves: #75130 Releases: master, 9.5 Change-Id: I686d29a90ed0ee428f9c2eeb68815f4122705de3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62915 Tested-by:
Henning Liebe <h.liebe@neusta.de> Tested-by:
-
Benni Mack authored
Current Backend User Authentication sends header() which is not appended to the headers of the PSR-7 response and cannot be tested or validated properly. This is mainly due to legacy reasons as AbstractUserAuthentication sends these headers. When using TYPO3 in a scenario to do sub-requests within one PHP process, it is not possible to properly evaluate these Response headers. To enable this, the BackendUserAuthenticator middlewares now apply the headers to the Response object. Resolves: #89911 Releases: master Change-Id: Id22ca1a65e52f101d3775fbe79ea0ef1622e9fa9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62593 Tested-by:
-
Benni Mack authored
The description that the extension key should be used - instead of the plugin identifier is wrong, and is now adapted. Resolves: #90113 Releases: master, 9.5 Change-Id: I4928dba4255d46bf72e0a0b45e5ff3360ae718ac Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62921 Tested-by:
-
- Jan 15, 2020
-
-
Benni Mack authored
In order to link to mountpoints with Site Handling, the RootlineUtility needs to receive the MountPoint parameter, to correctly deal with mountpoint-related subpages. Mount Points are based on the assumption that the "context" (the original site environment) is kept. For this to work, the slug of the mount page (doktype=7) is prefixed to the URL, but the common prefix of the subpages is trimmed with the value of the mounted page (= pointer record). The MP parameter is then added to PageArguments within the PageArguments as "routeArgument" (= safe and clean argument) where TYPO3 is dealing with this feature again in the same fashion it as before. Various side-effects when dealing with mount points from other domains still exist (= different language setup, or non-existing sites). Feature Set: * Multi-language setup (= when language setup is the same) with slugs * Recursive mount points * No MP parameter available in URLs anymore (at all) * Multi-site setup (= when language setup is the same) If a subpage of a mount page does not inherit the slug of the mounted page, then the slug of the subpage is added in full afterwards. Resolves: #86331 Resolves: #87473 Resolves: #89039 Releases: master, 9.5 Change-Id: I58f41eb325a07cc0c4a0dfeab1164eb8c58c7314 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62878 Tested-by:
Daniel Siepmann <coding@daniel-siepmann.de> Tested-by:
-
Kevin Appelt authored
The xsl file to create a layout for a XML sitemap can now be configured on three levels: 1. for all sitemaps 2. for all sitemaps of a certain sitemapType 3. for a specific sitemap The value is inherited until it is overwritten. If no value is specified at all, EXT:seo/Resources/Public/CSS/Sitemap.xsl is used as default like before. Resolves: #88147 Releases: master Change-Id: I1c5212a1c9fe4226100de8f4bd0f84d70b89fcf5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62121 Tested-by:
Richard Haeser <richard@maxserv.com> Tested-by:
-
Benni Mack authored
With the system-wide configuration option $GLOBALS['TYPO3_CONF_VARS']['FE']['checkFeUserPid'] set to false, EXT:felogin now allows to still render the form, instead of throwing a runtime exception before. Resolves: #84269 Releases: master, 9.5 Change-Id: Id0f0692d33e423929d41b9cdd5401b72cfdf77b0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62916 Tested-by:
-
Daniel Goerz authored
Resolves: #90122 Relates: #90115 Releases: master, 9.5 Change-Id: I418352c212a2626cb584fcda3ba4bef31e7181d4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62917 Tested-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Tested-by:
Oliver Hader <oliver.hader@typo3.org>
-
Susanne Moog authored
Releases: master Resolves: #90117 Change-Id: Ibaea450aff1b81fe9e4415e6c3900cad908e02f8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62869 Tested-by:
-
Benni Mack authored
If the static route value is using additionalParams, they should be added to the page that is fetched. The patch parses the "parameters" key (&my=value&key=1) into additional parameters of the PageRouter. Resolves: #87087 Releases: master, 9.5 Change-Id: I8688e891d1b6bfda3a546eb13812bbb80dfea1c1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62891 Tested-by:
-
Tymoteusz Motylewski authored
Kinyarwanda is an official language of Rwanda, which is now supported natively in TYPO3 for any kind of labels with the ISO-839-1 code "rw". Resolves: #90115 Releases: master, 9.5 Change-Id: I6958c44de03aa2397e409dc2e3d086bbf2fc46c8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62913 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Benni Mack authored
Processed images are built based on a processing configuration, which could contain values for width/height and other properties which are integers (like width: 250, but width: 250c is also allowed). Pure numeric (int) values are converted to real integers so the processing configuration is always the same when querying the database for existing processed files. Resolves: #80942 Releases: master, 9.5 Change-Id: Ie72b3ebfe126e3ffbc7bc856e4ed03069c48fbd7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62912 Tested-by:
-
Benni Mack authored
Extension Manager Utility classes are optimized for further clean ups: - "ext_icon" in package array is renamed to "icon" with an absolute path - unneeded icon information is removed - EmConfUtility has optimized signature for handing in the extension key - Minor optimizations in naming of arguments in FileHandlingUtility - Dumping an extension.zip to the browser is now within the ActionController - Various public properties are now protected As this is just another incremental way to streamline Extension Manager code, please note that e.g. strict types will follow in follow up patches. Resolves: #90033 Releases: master Change-Id: I6d53d850f4307581a82d6d7ec3933c9592573f23 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62783 Tested-by:
-
Susanne Moog authored
As Windows uses for example "D:" as path prefix the log file writer fails to recognize it as valid local file path and skips creation of the log file. To allow usage on Windows, isAbsPath is now used to check the file path - if it is a valid absPath it is handled in the same way as all other local files. Resolves: #90116 Releases: master, 9.5 Change-Id: I499eb4cba4b89f8ed6a8f280e9bb8493fa3de0f9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62914 Tested-by:
-
Daniel Goerz authored
Resolves: #87155 Releases: master, 9.5 Change-Id: I58595468242e645fe5d0322d84aab80611dbac3e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62863 Tested-by:
-
Georg Ringer authored
The link to the documentation of an extension, which has been added with #89458, is now displayed in the list of "Installed Extensions" as well. Resolves: #89640 Releases: master Change-Id: I00d33fb88d8c0b5ff1c03607f13bba60a67cdad8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62295 Tested-by:
-
Christoph Lehmann authored
Currently an ORDER BY clause is needed in foreign_table_where to get a sorting. This makes it obsolete in favor of the default tables sorting through default_sortby. This concerns TCA's select and tree fields. Resolves: #70677 Releases: master,9.5 Change-Id: I259211f7812bfa39e9744e71265577524911082d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/61474 Tested-by:
-
Benni Mack authored
Due to the rector refactoring a line unset($currentTag) was removed, resulting in text-elements with <p>something <a href="...">links</a>.</p> did not detect a proper closing tag, resulting in broken HTML in the output. Additional tests properly check for this logic now. Resolves: #90111 Related: #89807 Releases: master Change-Id: I256dc42e3ff44548d43122d1984264ebaab40015 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62889 Tested-by:
-
Susanne Moog authored
Resolves: #90112 Releases: master Change-Id: Iddccd7525992428142e7daff6c44a206f20e435b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62888 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
-
Benni Mack authored
With this change applied, a TYPO3 installation having the global "disableNoCacheParameter" option activated will still disable the cache if set via TypoScript `config.no_cache = 1`. However, the GET parameter is still not evaluated when having the option activated. Resolves: #87227 Releases: master, 9.5 Change-Id: Id33bd3aa9c8d042deffadeb19d8d64d52fad3371 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62835 Reviewed-by:
-
- Jan 14, 2020
-
-
Alexander Stehlik authored
The --task option (short -i) can now be provided multiple times to the scheduler command. The given task UIDs are executed or stopped sequentially. Example call: ./bin/typo3 scheduler:run --task 3 --task 2 Additionally some debug output is added when the -v or -vv flags are provided. Resolves: #87451 Releases: master Change-Id: I6e1555c456d8c0f35395ca40c0a303628ddf5acf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/59452 Tested-by:
-
Guido Schmechel authored
The capture group in the redirect target are now replaced, so redirects with regular expressions are working referencing the original URL. Resolves: #89799 Releases: master, 9.5 Change-Id: Ib624e6c7b40dd09ec090e72339ad9aae1211cc4e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62781 Tested-by:
-
Markus Klein authored
Extend the function signature of BackendUserAuthentication::isInWebMount to allow the uid of a page or the full page record. This saves another database lookup for the page. Resolves: #90105 Releases: master, 9.5 Change-Id: Id246967b7a8237dbe8939126acf21fede6dda756 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62868 Reviewed-by:
-
Jonas Eberle authored
This patch defines "opening in a new window" as links having an attribute `target` that is not either empty, `_self`, `_top` or `_parent`. Resolves: #89771 Relates: #89757 Relates: #89044 Relates: #78488 Releases: master Change-Id: I23f775f728b9ddfb25acd306b653cbfbb6eeba51 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62430 Tested-by:
-
Benni Mack authored
Nine new PSR-14 events are introduced which replace the existing Extbase Signals in Persistence and MVC area. Resolves: #89870 Releases: master Change-Id: I6c56fc0562ba8c02899d5de07e39443167e6311a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62528 Tested-by:
-
Daniel Goerz authored
The patch also adds tests for the behavior with $GLOBALS['TYPO3_CONF_VARS']['FE']['hidePagesIfNotTranslatedByDefault'] enabled. Resolves: #90109 Releases: master, 9.5 Change-Id: I920f81c80aaa17ca0d6ba815fe2a6e1aa7232ffb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62880 Tested-by:
-
Markus Klein authored
The function is already caching the result for individual pages. Still it is called for a lot of pages, so even more speed can be gained by also re-using the database statement. Specifically the page-tree rendering time reduces a lot with this. Resolves: #90104 Releases: master, 9.5 Change-Id: I35308e163cd93b22c12ecf743759b2f19e2a7ad9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62867 Tested-by:
-
Alexander Schnitzler authored
The introduced tests are prepatory work to have a high coverage before refactoring property mapper related code parts. Releases: master Resolves: #89896 Change-Id: I83cf025a63ea7c0b38b55c0173ca305f423d8a2e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62567 Tested-by:
-
Benni Mack authored
In order to continue sorting out various places when UserTSconfig should be used, and how to properly use caching and condition matching, compiling of UserTSconfig is now centralized into one method. In addition, this patch actually now caches the UserTSconfig again, in the "hash" cache, which wasn't the case before in v10.0+. Resolves: #89755 Releases: master Change-Id: Icf6e8d7a199fb234336b4bd557627d254ff4e6e3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62419 Tested-by:
-
