- Dec 19, 2023
-
-
Benjamin Franzke authored
Input data is statically provided by EXT:core only, so there is no security issue known right now. This change is a preparation to avoid possible future security issues. Resolves: #102676 Releases: main, 12.4, 11.5 Change-Id: I49a7fdd250e8ce74fdde07ad305cbae7e4af8ec3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82252 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
-
Stefan Bürk authored
With #92289 logic has been decoupled from `ResourceFactory` into the `StorageRepository`. As a side change, native php types have been added to a couple of methods. `StorageRepository->findByUid()` parameter type has been set to integer, which breaks the `null` fallback and retrieving the default storage `uid: 0` in `ResourceFactory` method `getStorageObjectFromCombinedIdentifier()`. Even worse is the fact that `getObjectFromCombinedIdentifier()` does not even try to cope with a invalid identifier provided. This change modifies `getObjectFromCombinedIdentifier()` and `getStorageObjectFromCombinedIdentifier` of `ResourceFactory` to cope with missing storage identifier by falling back to the default storage (`0`) with a shuffle of the exploded values. As a side-effect two PHPStan ignore patterns can be removed from the PHPStan baseline file. Used command(s): Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #102692 Related: #92289 Releases: main, 12.4, 11.5 Change-Id: I8ee9736839f59db7917cb49dd0d62af17ee28cda Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82233 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
-
- Dec 17, 2023
-
-
Georg Ringer authored
If the user permissions contain DB tables which are not available anymore, a notice is turned into an exception. Resolves: #101547 Releases: main, 12.4, 11.5 Change-Id: I98cd8fb74893c31fe8ca6c14e4ee87ddb0e578ae Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82126 Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
- Dec 09, 2023
-
-
Christian Kuhn authored
Something changed with recent phpspec/prophecy release 1.18.0 which now stumbles upon a missing namespace import in a unit test. Import correctly. Resolves: #102636 Relaeses: 11.5 Change-Id: If9015bbaf89bbd77bb59c084260c4bb834447ea8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82155 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
- Dec 01, 2023
-
-
Stefan Bürk authored
New `core-testing-phpXY` images has been build and released. This change update used image version to: * core-testing-php74:2.5 - php 7.4.33 (rebuild only) * core-testing-php80:2.5 - php 8.0.30 (rebuild only) * core-testing-php81:2.8 - php 8.1.26 (patchlevel) * core-testing-php82:1.7 - php 8.2.13 (patchlevel) * core-testing-php83:1.8 - php 8.3.0 (major) [1] https://git.typo3.org/typo3/CI/testing-infrastructure/-/commit/6ead80df3d46bf1f0c2363e8728435b2d2363fba Resolves: #102575 Releases: main, 12.4, 11.5 Change-Id: I85a8b0a97d63fea01c790fd9c7ab5d51536a21b1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82054 Tested-by:
Garvin Hicking <gh@faktor-e.de> Reviewed-by:
-
- Nov 27, 2023
-
-
Christian Kuhn authored
FalMetadataCest changes the title of styleguide 'bus_lane.jpg'. InlineFalCest uses the title to look up details in element information modal and stumbles. Check for the filename only to avoid this side effect. Resolves: #102523 Releases: 11.5 Change-Id: I6b111194e9888690bf630ef24b86ac8947223127 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81971 Reviewed-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com> Tested-by:
Andreas Kienast <a.fernandez@scripting-base.de> Reviewed-by:
-
- Nov 24, 2023
-
-
Benjamin Franzke authored
Bash hashtables are not supported in bash v4, so we rather use a lookup function. Resolves: #102502 Related: #102450 Releases: main, 12.4, 11.5 Change-Id: Id5c875b78ec655e15d225914626769720bbc3a81 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81952 Tested-by:
Benjamin Franzke <ben@bnf.dev> Reviewed-by:
-
- Nov 23, 2023
-
-
Benjamin Franzke authored
Allows to auto-update local images for feature-updates simply by raising them in runTests.sh (like we do for external images as well). That means `runTests.sh -u` is only needed in case patch updates are desired or needed. Resolves: #102450 Releases: main, 12.4, 11.5 Change-Id: Id9bdd679e430d57794e5d9e48f18ea67ed17d46c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81938 Tested-by:
-
Benjamin Franzke authored
Removing all containers will remove their dangling volumes automatically and we can drop the manual cleanup. Parameters have been applied via: sed -i '/CONTAINER_COMMON_PARAMS/!s/\${CONTAINER_BIN} run/& --rm/' \ Build/Scripts/runTests.sh Resolves: #102449 Releases: main, 12.4, 11.5 Change-Id: I77b4166cbad427afef5c87173428433881e9eb85 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81928 Tested-by: -
Stefan Bürk authored
The php namespace integrity check uses a symfony finder to determine which files should be checked. The used pattern to ignore extension configuration folder `Configuration` excluded every file, which has `Configuration` in the path or filename. This change avoids using the nifty magic `exclude()` finder method and replace it with a more reliable `notPath()` configuration. Resolves: #102483 Releases: main, 12.4, 11.5 Change-Id: Ic0ae6eaae736b86412f8a430f11ea5b0a8e9dca9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81925 Tested-by:
-
Christian Kuhn authored
This patch is paired with the setup of a new CI [1]. The patch adapts runTests.sh to allow podman as container environment next to docker. New CI relies on podman. Locally, podman can be selected as container environment using the `-b podman` flag to runTests.sh. A "recent" podman version - at least around 4.x - should be used. docker is kept as default for now. The new CI setup comes with a series of improvements to speed up things. This makes the acceptance tests a bit more brittle again. The patch comes with some further stabilizations, and we may add even more with dedicated patches later. [1] https://git.typo3.org/typo3/CI/testing-infrastructure/ Change-Id: I206c1577335bfbefb801eaababa4b713e1edda12 Resolves: #102385 Releases: main, 12.4, 11.5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81792 Reviewed-by:
-
- Nov 21, 2023
-
-
Sybille Peters authored
If deleting content elements which have references to it, a confirm dialog is displayed asking if the element should really be deleted. Usually, the dialog message contains information about existing references (if there are references). This was not the case if the content element is deleted by using the inline delete button in the page module in TYPO3 v11. This behaviour was already improved and streamlined in TYPO3 v12. This is a partial backport of functionality in patch https://review.typo3.org/c/Packages/TYPO3.CMS/+/72001 to backport the most critical functionality improvement. Releases: 11.5 Resolves: #101414 Related: #101411 Related: #92670 Related: #94780 Change-Id: Ie3ecad8f38a862c652baf115719b207820865708 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80116 Tested-by:
-
- Nov 20, 2023
-
-
Oliver Bartsch authored
Add missing typecast to prevent deprecation notice. Resolves: #102396 Releases: 11.5 Change-Id: I49f22bac872b2485cb282ce26121a06e08f87810 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81802 Reviewed-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
-
- Nov 17, 2023
-
-
Nikita Hovratov authored
This has already been fixed upstream as a drive-by change. Resolves: #102388 Related: #97433 Releases: 11.5 Change-Id: Id3f8f541b077d4d3b51bdd794847249b4229768f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81760 Reviewed-by:
Thomas Hohn <tho@gyldendal.dk> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
- Nov 16, 2023
-
-
Benjamin Franzke authored
Backend responses must never be cached. The previously used Cache-Control instruction "must-revalidate" implicitly enabled caching in order to possibly reuse a response. While that could only happen when two requests to the same URL are invoked within one second (because the browsers `If-Modified-Since` header and our `Last-Modified` header match, causing the webserver to issue a 304 response), that is certainly possible in CI setups or fast user clicks. Use `no-store` in order to instruct browsers to not cache and try revalidation at all. Resolves: #102377 Releases: main, 12.4, 11.5 Change-Id: Ic05cad748f824e7a45a1740aca15cd2fc3595a79 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81756 Tested-by:
-
- Nov 14, 2023
-
-
Oliver Hader authored
Change-Id: Icde820cccfe18d323fcd0c208bac450cb83820d4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81739 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Oliver Hader authored
Change-Id: I121b8214fc0edf4cb901e3e5cbcda76c7a958c6a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81738 Reviewed-by:
-
Benjamin Franzke authored
See https://github.com/TYPO3/html-sanitizer/releases/tag/v2.1.4 composer req typo3/html-sanitizer:^2.1.4 composer req typo3/html-sanitizer:^2.1.4 \ -d typo3/sysext/core --no-update Resolves: #102169 Releases: main, 12.4, 11.5 Change-Id: I76edb7ff0dc66d3308d5c0875c2db56ca02addd7 Security-Bulletin: TYPO3-CORE-SA-2023-007 Security-References: CVE-2023-47125 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81732 Reviewed-by:
-
Benjamin Franzke authored
Given that there are two sites `site-a.com` and `site-b.com` in the same TYPO3 installation, it was possible to reuse a session cookie that was generated for `site-a.com` in `site-b.com`. Since there are scenarios, where this is the expected behavior – when sharing sessions across sub domains, so that an explicit cookieDomain needs to be configured – user sessions IDs are now signed with a combination of encryption key and desired cookie domain, so that a cookie can only be used on the domain that the cookie was created for. For compatiblity with possible 3rd party authenticators, legacy tokens will be accepted (but not created by TYPO3 core itself). Resolves: #100885 Releases: main, 12.4, 11.5 Change-Id: I0d1c314c6e206ac12604ba6f859af78b958651dd Security-Bulletin: TYPO3-CORE-SA-2023-006 Security-References: CVE-2023-47127 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81731 Tested-by:
-
- Nov 13, 2023
-
-
Christian Kuhn authored
We're in the process of establishing a new core CI. This has more power and is better optimized. The resulting runtime changes reveal various flaky acceptance tests. Most have been problematic before already, but not as bad. The patch adds various guards to acceptance tests to reduce flakiness. Resolves: #102363 Releases: main, 12.4, 11.5 Change-Id: Iff2c79411b39fffe659c78a8e889f8a804939bc4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81722 Tested-by:
-
Sybille Peters authored
TCA fields of type 'slug' can be configured with the property generatorOptions. Particularly, the short form of using a simple array for the fields instead of a nested array is a common source of confusion and the initially introduced changelog had incorrect examples. The changelog is improved as follows - Fix the examples. The examples 2 and 3 showed incorrect results - Use the multidimensional array in the source snippet - Clarify that ['nav_title', 'title'] is the same as [['nav_title'], ['title']], but not the same as [['nav_title', 'title']] Resolves: #89390 Releases: main, 12.4, 11.5 Change-Id: Ib1944c2a1eb9e2a69a0f169f316208cf46f9be84 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81727 Tested-by:
-
- Nov 10, 2023
-
-
Thomas Hohn authored
If a HMAC cannot be `json_decode`d (possibly due to old saved pages or other outdated content), now a proper exception is thrown instead of issuing a PHP warning. Resolves: #97337 Releases: main, 12.4, 11.5 Change-Id: I12f5633a85508bf4099d72e474c24b5a0100498c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81719 Tested-by:
-
- Nov 07, 2023
-
-
Benjamin Franzke authored
With #99503 `cObjGet()` was implemented as a wrapper around the strictly typed cObjGetSeparated method, effectively enforcing the first argument to be an array, while previously non array values were returned as an empty string. Resolves: #102328 Related: #99503 Releases: main, 12.4, 11.5 Change-Id: I7c04307f14da5a93e12672b36de163071dad7359 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81662 Tested-by:
-
- Nov 06, 2023
-
-
Fabio Norbutat authored
Invalid char encoding has slipped into an yaml example snippet for ext:dashboard. This change use the correct quoting to fix this. Releases: main, 12.4, 11.5 Resolves: #102319 Change-Id: I3dd2fd7a1aec51ad3f1ace7c6b914371e9e12342 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81657 Tested-by:
-
Jonas Eberle authored
This adds a line break between concatenated "inline" JavaScripts in order to keep JavaScript without trailing ';' valid. Resolves: #99503 Releases: main, 12.4, 11.5 Change-Id: Icf902679c715687c5be2e5f572526608ce31f882 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81686 Reviewed-by:
-
- Nov 05, 2023
-
-
Justus Moroni authored
Resolves: #102192 Releases: main, 12.4, 11.5 Change-Id: I0cc48e27d32b6d6164d9d580121968610a9333b9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81655 Tested-by:
-
- Nov 02, 2023
-
-
Achim Fritz authored
To prevents sql errors when inherit from SuggestWizardDefaultReceiver and adding a JOIN statement, the fields are now prefixed with the table name. Resolves: #102298 Releases: main, 12.4, 11.5 Change-Id: I608bd30df1b878aec8dbf611e70049c1be88778a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81651 Tested-by:
-
- Oct 30, 2023
-
-
Christian Kuhn authored
Minor CGL streamlinings from latest php-cs-fixer. > composer req --dev friendsofphp/php-cs-fixer:^3.37.1 > Build/Scripts/runTests.sh -s cgl Resolves: #102285 Releases: main, 12.4, 11.5 Change-Id: I0cc1fe3c0f81f62a49df00d62d57ef3c593c57df Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81611 Tested-by:
-
- Oct 27, 2023
-
-
Garvin Hicking authored
The `EXT:felogin/Classes/Service/RecoveryService.php` makes use of the local $uriBuilder instance building links, however it does not `reset()` it's state before building a URL. It seems this only creates an issue when used in conjunction with `EXT:vhs` (possibly due to adapted fluid/object caching behavior?). Fixing this by resetting the instance as recommended via https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ExtensionArchitecture/Extbase/Reference/UriBuilder.html should take care of this, even though uriBuilder should be a singleton only operating within the scope of a single ActionController. Resolves: #102203 Releases: main, 12.4, 11.5 Change-Id: Idb6089c4b43b6d3352fbbbbeedfa63770959def0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81589 Tested-by:
-
- Oct 26, 2023
-
-
Christian Kuhn authored
This may be triggered by invalid FlexForm values that does not contain a 'data' key for whatever reason. Resolves: #100733 Releases: main, 12.4, 11.5 Change-Id: I96924d65af56fd7cf2bb2a97fd4591b3c81f934f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81586 Tested-by:
-
Kay Strobach authored
Avoid the migration of empty flexforms, which caused the wizard to fail. Resolves: #97761 Releases: 11.5 Change-Id: I9240becb81ddca22432e8ba55038978f30fcc449 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/76529 Reviewed-by:
-
- Oct 25, 2023
-
-
Markus Klein authored
A record may not have a t3ver_state, hence accessing this value must be safeguarded. Resolves: #102251 Releases: 12.4, 11.5 Change-Id: Ia2050171276891e08d2e84e750cfa894a7f3291f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81555 Tested-by:
-
Benjamin Franzke authored
Enable all current PER-CS2.0 rules in order to reflect our current state of coding style. This was missed in #102240 because pre merge didn't perform a full CGL run when @PER was switched to @PER-CS1.0. Resolves: #102247 Related: #102240 Releases: main, 12.4, 11.5 Change-Id: I0e1c833ad99c4e06767dee8a2c4bcb2bdee6eb68 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81542 Reviewed-by:
-
- Oct 24, 2023
-
-
Benjamin Franzke authored
PER-CS2.0 was added as clone of PER-CS1.0 in php-cs-fixer v3.27 in order to implement the new rules that are defined in PER Coding Style 2.0 [1]. The alias PER already points to PER-CS2.0 although the current set of rules are not implemented yet. [2] There is only one rule (single_line_empty_body) that is done by now and more will follow, so we rather pin to PER-CS1.0 for now (and enable single_line_empty_body which we already migrated to) in order to prevent having coding style changes with every php-cs-fixer raise. We rather wait until the 2.0 preset has been finished and is on par with the upstream php-fig definitions and then switch with one change. [1] https://www.php-fig.org/per/coding-style/ [2] https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/issues/7247 Resolves: #102240 Related: #102236 Releases: main, 12.4, 11.5 Change-Id: I33377e4e5016f1e5cc8ab08a9e71a933dcd41d93 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81539 Tested-by:
-
Christian Kuhn authored
It's time to update to latest changes of php-cs-fixer to align with current community rules. This brings a rather huge series of changes, main changes due to single_line_empty_body rule which now formats empty class and method body curly braces into a single line, plus changes from function_declaration rule which tends to avoid more whitespaces. The change has a slight impact on phpstan, we regenerate baseline. To reduce backport headaches, this change is backported to v12 and v11. > composer req --dev friendsofphp/php-cs-fixer:^3.35.1 > Build/Scripts/runTests.sh -s cgl > Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #102236 Releases: main, 12.4, 11.5 Change-Id: Iea45b10667951672b2194033216c49f580799f55 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81514 Reviewed-by:
-
- Oct 23, 2023
-
-
Christian Kuhn authored
When a page with a content element that has images assigned is copied in workspaces, a PHP array access error is raised since sys_file_reference TCA has no sortby ctrl. Add an appropriate null fallback. Resolves: #102231 Releases: main, 12.4, 11.5 Change-Id: I453a612a62a359156c8be2e087d1d121f1b9c3ea Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81467 Tested-by:
-
- Oct 20, 2023
-
-
Simon Schaufelberger authored
Most fixes relate to indefinite article usage "an vs a" and some typos. Resolves: #102074 Releases: main, 12.4, 11.5 Change-Id: Ief07759697828d94edde8902a912719f82b2b798 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81487 Tested-by:
-
- Oct 19, 2023
-
-
Simon Praetorius authored
It is already possible to use the "value" argument together with "property" in form ViewHelpers. This should be reflected in the ViewHelper documentation. One possible use case is a form to edit a user. For the password field you would want to define property="password", but also value="" to not expose the current password hash to the form. Resolves: #102206 Releases: main, 12.4, 11.5 Change-Id: I3c7b1a201e38ccef84efcc863075043cf461dd20 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81478 Tested-by:
Simon Praetorius <simon@praetorius.me> Reviewed-by:
-
- Oct 18, 2023
-
-
Markus Klein authored
`$TCA['ctrl']['title']` is optional and may not be set. Resolves: #102195 Releases: main, 12.4, 11.5 Change-Id: I38a5aa921515f48b2e35a0ebdb8bcdce646b5bd6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81458 Tested-by:
-
- Oct 17, 2023
-
-
Markus Klein authored
'transOrigPointerField' may not be set for a table Resolves: #102190 Releases: main, 12.4, 11.5 Change-Id: I79febf5d99774b5e22d03f42f9088c00fa98dfc4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81453 Reviewed-by:
-
