- Sep 07, 2017
-
-
Susanne Moog authored
Usage of limit > 0 or offset in a count query do not make sense and result in broken pagination in the list module as the returned total count of items is always 0. Reset given offsets/limit for that exact query. Change-Id: I18b1964b860e51256a6d0a5f39fd4c40544bac85 Resolves: #82325 Releases: master, 8.7 Reviewed-on: https://review.typo3.org/53940 Tested-by:
TYPO3com <no-reply@typo3.com> Reviewed-by:
Wouter Wolters <typo3@wouterwolters.nl> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Andreas Fernandez <typo3@scripting-base.de> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
Ralf Zimmermann authored
* Show messages within page module and form engine if the backend user does not have access to the selected form definition. * Show flash messages within page module and form engine if the ext:form configuration is invalid. Resolves: #80678 Resolves: #81113 Releases: master, 8.7 Change-Id: I9646b31ac44752b8871635c8f1a04547872e715d Reviewed-on: https://review.typo3.org/52701 Reviewed-by:
Bjoern Jacob <bjoern.jacob@tritum.de> Tested-by:
Daniel Lorenz <daniel.lorenz@extco.de> Reviewed-by:
Frans Saris <franssaris@gmail.com> Tested-by:
-
Benni Mack authored
Defining all configuration options in TYPO3 Install Tool is now handled via a Yaml file which additionally specifies the "type" of the configuration option, allowing to use further render settings, one of them already introduced for "allowedValues". This moves the "All Configuration" to a more flexible output rendering of dropdowns for a specific type. Resolves: #82312 Releases: master Change-Id: Id23c6a8e57177a68659fe98cbe7278f8744c0c34 Reviewed-on: https://review.typo3.org/53923 Tested-by:
Mona Muzaffar <mona.muzaffar@gmx.de> Tested-by:
Stefan Neufeind <typo3.neufeind@speedpartner.de> Tested-by:
Benni Mack <benni@typo3.org> Tested-by:
-
Claus Due authored
This patch removes the previously introduced runtime cache and early returns from TemplatePaths, both of which were implemented in an attempt to prevent excessive TypoScript parsing - an issue which has since been solved by optimising the TypoScript parsing enough that a cache and early return is no longer necessary (no longer constitutes a significant performance increase). The early return and caching introduced regressions described in the related forge issues. Removing both solves those problems. In addition, the method resolving TypoScript paths is now covered by extensive unit tests confirming everything from merging to sorting of template paths. An average of 8 tests cover the method's lines. Each of the expected behaviors is now declared as specific test. Change-Id: Ia6d505dcec7d77ad7aaeea9094d7d85a58553c63 Resolves: #82196 Resolves: #82181 Related: #79662 Releases: master, 8.7 Reviewed-on: https://review.typo3.org/53917 Tested-by:
Jigal van Hemert <jigal.van.hemert@typo3.org> Tested-by:
-
- Sep 06, 2017
-
-
Benni Mack authored
This brings PHP 7.2 support for guzzle functionality. Verified that guzzle still runs with PHP7.0 (min requirement for us) Resolves: #82313 Releases: master, 8.7 Change-Id: I65b27c41d49dcb8b740b6f276da305df864ff50e Reviewed-on: https://review.typo3.org/53924 Reviewed-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Susanne Moog <susanne.moog@typo3.org> Tested-by:
-
Xavier Perseguers authored
Change-Id: I807a888ac7d977606d94f5ad9ccdfeee07ee61ec Resolves: #82307 Releases: master, 8.7 Reviewed-on: https://review.typo3.org/53915 Tested-by:
Sebastian Fischer <typo3@evoweb.de> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
- Sep 05, 2017
-
-
Sebastian Fischer authored
The parameter $subpartContent of substituteSubpart() can be either string or array. IDEs need to have both present in the comment to not show warnings for given parameters that are correct. Resolves: #82308 Releases: master, 8.7 Change-Id: Ifcceb8dcd5ad8be56695cef161949046ff74c994 Reviewed-on: https://review.typo3.org/53916 Tested-by:
-
Oliver Hader authored
Releases: master, 8.7, 7.6 Change-Id: I167c68d7d04dd4b8c876b1f6f8f939cf3d933478 Reviewed-on: https://review.typo3.org/53905 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de>
-
Benni Mack authored
The constant TYPO3_user_agent is removed as it is not in use anymore since TYPO3 v8. Resolves: #82296 Releases: master Change-Id: I4860e291c1888251be5c64c2c454022f5d51643b Reviewed-on: https://review.typo3.org/53908 Reviewed-by:
-
Tymoteusz Motylewski authored
Functional tests checking TypoScript rendering of tt_content records with FAL images. Releases: master, 8.7, 7.6 Resolves: #82187 Change-Id: I5889ab13183b28dc2ff1ccc2c00c18f01ceacc76 Reviewed-on: https://review.typo3.org/53798 Tested-by:
-
Susanne Moog authored
Some web servers allow and accept pht files as PHP files and execute them. Thus, pht should be part of the default file deny pattern and PHP file extensions. Resolves: #82078 Releases: master, 8.7, 7.6 Security-Commit: d7e19499bfa4bd552d4428a2b9a943005c20c61d Security-Bulletin: TYPO3-CORE-SA-2017-007 Change-Id: Ibadcaa8c32b70b9aec569027862918d0360ec075 Reviewed-on: https://review.typo3.org/53904 Reviewed-by:
-
Susanne Moog authored
TYPO3 does no longer send the concrete TYPO3 version as part of the default User-Agent header when doing requests. Resolves: #82072 Releases: master, 8.7, 7.6 Security-Commit: f5558a5d745f2bafe3c27d5621ef1ce26f3989a9 Security-Bulletin: TYPO3-CORE-SA-2017-006 Change-Id: If9d7745d909e93899e2b405e016518a9284a1006 Reviewed-on: https://review.typo3.org/53903 Reviewed-by:
-
Georg Ringer authored
If a user creates a sys_file_collection record, only those storage records must be shown which are allowed for the user. Resolves: #82029 Releases: master, 8.7, 7.6 Security-Commit: 45cdfccd52a224d8128e537214606848c717d8e7 Security-Bulletin: TYPO3-CORE-SA-2017-005 Change-Id: Iee94cd84f07ee0dc0730fe1ce84d228dad2f75a2 Reviewed-on: https://review.typo3.org/53902 Reviewed-by:
-
Georg Ringer authored
The record title must be properly escaped. Resolves: #81967 Releases: master, 8.7 Security-Commit: bb686f45996424aadd68185871c14bb4544107c2 Security-Bulletin: TYPO3-CORE-SA-2017-004 Change-Id: I71c8bdef21e76fafdae170c6ebd9f0f0834d5b0e Reviewed-on: https://review.typo3.org/53901 Reviewed-by:
-
Benni Mack authored
StandaloneView currently replicates a lot of code which is already present within TemplateView (= Extbase), however, both classes inherit from AbstractTemplateView. In order to see which parts are different (and continue on streamlining fluid) the parts can be placed within AbstractTemplateView. Resolves: #82269 Releases: master Change-Id: I4184a5899b98227cf50f93db6c3ae38812cc86ec Reviewed-on: https://review.typo3.org/53831 Tested-by:
Joerg Boesche <typo3@joergboesche.de> Tested-by:
-
- Sep 04, 2017
-
-
Jörg Bösche authored
The locallang_ttc.xlf has a typo in the key "space_before_class" which is shown in the access list of a page content field. Resolves: #82284 Releases: master, 8.7 Change-Id: Id61c8c7d5c5da11b8f7bb3e55e49d7613e593730 Reviewed-on: https://review.typo3.org/53875 Reviewed-by:
-
Georg Ringer authored
Remove a not needed </td> tag which has not been removed with the refactoring. Resolves: #82279 Releases: master, 8.7, 7.6 Change-Id: I2077e9e0b0119e6b064b0a6d4ebb9c3dc1d848a4 Reviewed-on: https://review.typo3.org/53873 Tested-by:
Henning Liebe <h.liebe@neusta.de> Reviewed-by:
-
- Sep 01, 2017
-
-
Benni Mack authored
Resolves: #82270 Releases: master Change-Id: I37fbb8c1d5199239eaa4cd432fb49d958bc86123 Reviewed-on: https://review.typo3.org/53859 Tested-by:
Frank Naegler <frank.naegler@typo3.org> Reviewed-by:
Daniel Gorges <daniel.gorges@b13.de> Tested-by:
-
Claus Due authored
This patch improves the performance of TemplatePaths in two ways: * GeneralUtility::removeDotsFromTS() is called on a far smaller array instead of all TypoScript. * Fallback paths are allowed to be cached in the runtime cache which avoids re-reading TypoScript when no paths are configured in TS. Saves several thousand calls to removeDotsFromTs which in turn saves several tens of thousands of calls to in_array. Change-Id: Ib8aef69dc9136d355441ac05f21fe391e524eacc Resolves: #82232 Releases: master, 8.7 Reviewed-on: https://review.typo3.org/53824 Tested-by:
Wolfgang Klinger <wolfgang@wazum.com> Reviewed-by:
-
Justus Leon Moroni authored
The TranslationService uses the additional key 'error' in its translations of the validation errors. See https://github.com/TYPO3/TYPO3.CMS/blob/master/typo3/sysext/form/Classes/Service/TranslationService.php#L428. Releases: master,8.7 Resolves: #82264 Change-Id: Id00b60de0bf1b2b882f583f538be9bc8e40c010f Reviewed-on: https://review.typo3.org/53851 Reviewed-by:
Ralf Zimmermann <ralf.zimmermann@tritum.de> Tested-by:
-
- Aug 31, 2017
-
-
Benni Mack authored
Uses PSR-7 instead of plain echo() and die - and shutdown the install tool properly (except for redirects currently). In the future, we should introduce proper PSR-7 response objects for certain responses (JSON, Redirect) but this will happen in a separate step. Resolves: #82268 Releases: master Change-Id: If8124f975936f6205f45009d30d979204765d8d1 Reviewed-on: https://review.typo3.org/53856 Tested-by:
-
Benni Mack authored
A new option $GLOBALS['TYPO3_CONF_VARS']['SYS']['systemMaintainers'] is introduced, which contains a list of Backend User uids. It is then possible to restrict access to backend modules to system maintainers - most importantly the four Install Tool modules. When this option is not set in LocalConfiguration.php, then all admins are system maintainers, same goes for accessing TYPO3 in Development context. This is the first step to remove the necessary "enter your intall tool password" when accessing the install tool from within TYPO3 Backend. Resolves: #82266 Releases: master Change-Id: If0026748ede694394b4e7f39788a650816160146 Reviewed-on: https://review.typo3.org/53830 Reviewed-by:
-
Christian Kuhn authored
The master version of this 8.7 patch just removes last mentions of suhosin from the codebase. Change-Id: If003a8db37660662c65290a1e1bf25ef61375b80 Resolves: #82267 Related: #82257 Releases: master, 8.7 Reviewed-on: https://review.typo3.org/53858 Reviewed-by:
-
Benni Mack authored
The PHP request flow logic for authentication against the install tool password is moved into a new class called AuthenticationService. Additionally, all logic which is only needed inside the StepController is moved from the AbstractController into the StepController or the recovery request handler. ToolController and AjaxController are now free of session handling completely. Resolves: #82265 Releases: master Change-Id: Ib75c920877da81d7d859feaa5e6cbbcf4f0fd2cf Reviewed-on: https://review.typo3.org/53837 Tested-by:
-
Christian Kuhn authored
The install tool brought its own "status message" class structure since the 6.2 refactoring. This is used at many places in the install tool for message handling. The core has a very similar class construct "Messaging" with only little dependencies, too. To simplify a later separation of 'install tool' and 'installer' the internal status message class structure is removed and transitioned to the core Messaging structure. to get rid of just another special thing the install tool does. The ext:core FlashMessage and FlashMessageQueue now both implement the \JsonSerialize interface. This allows direct json_encode() calls on these objects, helpful for instance for ajax responses. In ext:install "Environment checks" suhosin specific checks have been removed since the project is dead and only has a pre-alpha php 7.0 fork, so probably nobody is using that with the given core PHP constraints anymore. Change-Id: Ifecd3cd4889d8db5aaf3e87f317c98be706ae82b Resolves: #82257 Releases: master Reviewed-on: https://review.typo3.org/53835 Tested-by:
-
Benni Mack authored
The left-over signals in EXT:install/ext_localconf.php belong to EXT:core (uses classes from EXT:core anyways) and since both extensions are required at any time (part of minimal system) this is just a separation cleanup. Resolves: #82241 Releases: master Change-Id: I9ec93ada9b4985ced285276fa5c33b851ec0be8f Reviewed-on: https://review.typo3.org/53836 Tested-by:
Jan Helke <typo3@helke.de> Tested-by:
-
Mathias Brodala authored
Resolves: #82175 Releases: master, 8.7 Change-Id: I4b70b2a662b1818171bb180f88f8d40a48ee91ed Reviewed-on: https://review.typo3.org/53788 Reviewed-by:
-
Fabian Thommen authored
Releases: master Resolves: #82194 Change-Id: I6bb00c14dc331ec362614d00e48bf169da7cd572 Reviewed-on: https://review.typo3.org/53799 Tested-by:
Sidoine Ghomsi Nokam <s.ghomsinokam@neusta.de> Reviewed-by:
Sascha Rademacher <sascha.rademacher+typo3@gmail.com> Reviewed-by:
-
Susanne Moog authored
PHP already converts strings representing 8-bit integers to int - so there are no numeric array keys that are of type string that ArrayUtility should reorder. Change-Id: Ieff77f4b1b8d6cbadba73dad06e9ec02d8748e85 Resolves: #82201 Releases: master Reviewed-on: https://review.typo3.org/53805 Tested-by:
Jan Stockfisch <jan.stockfisch@googlemail.com> Reviewed-by:
-
Daniel Siepmann authored
Within the docs, an incorrect identifier is used for a custom finisher. This has been fixed and is in line with the example code above. Releases: master,8.7 Resolves: #82234 Change-Id: I41881f825e7961f4945805360683c3189f2f9fcb Reviewed-on: https://review.typo3.org/53825 Reviewed-by:
-
Ralf Zimmermann authored
Use the configured finisher identifier for translation keys instead of the finisher class name. Resolves: #81591 Releases: master, 8.7 Change-Id: Ib78e942121b4b6e299ae394c30261603760444f7 Reviewed-on: https://review.typo3.org/53363 Tested-by:
Denis Mir <mir.denis@googlemail.com> Tested-by:
-
Christian Kuhn authored
Brings a bug fix in frontend functional test parsing. Change-Id: I3e95f4ee12069bbbfc225fb5045793273eff6f95 Resolves: #82256 Releases: master, 8.7 Reviewed-on: https://review.typo3.org/53840 Tested-by:
-
- Aug 30, 2017
-
-
Ludwig Rafelsberger authored
Releases: master,8.7 Resolves: #82239 Change-Id: I90d4ecdb4917c567a652a7bf5d24b55b39d646fd Reviewed-on: https://review.typo3.org/53833 Reviewed-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Tested-by:
-
Benni Mack authored
In order to get the controllers free of security checks, the logic of authentication/session handling is moved from various controllers into the RequestHandler and the Application. Additionally, a second RequestHandler (RecoveryRequestHandler) is introduced which acts as a fallback if TYPO3 is not installed yet, or the installation is broken (e.g. missing PackageStates.php). This brings a cleaner dispatching mechanism, having the RecoveryRequestHandler (which can handle any request) dealing with the StepController, and the regular RequestHandler (with higher priority) for handling the maintenance functionality for running installations. Resolves: #82238 Releases: master Change-Id: I906ab3f15479bbe70202608f6bd7838cc22d9e3a Reviewed-on: https://review.typo3.org/53800 Tested-by:
-
- Aug 29, 2017
-
-
Claus Due authored
This patch updates the composer Fluid dependency to version 2.4.0 and above. Fixes multiple bugs and performance issues - and adds a few new features. Full list of changes: https://github.com/TYPO3/Fluid/compare/2.3.4...2.4.0 Change-Id: I2d16c6c95ecb6c985da772736d066d8e10da8761 Resolves: #82230 Releases: master Reviewed-on: https://review.typo3.org/53823 Tested-by:
-
Christian Kuhn authored
The database analyzer buttons "Run again" and "Apply" are now disabled when a scan is in progress. This prevents multiple ajax calls in parallel which lead to duplicate output. Change-Id: I28df15e2c7169960e0889aed903bbd72034f07cc Resolves: #82152 Related: #76084 Releases: master Reviewed-on: https://review.typo3.org/53821 Reviewed-by:
-
Benni Mack authored
The CmsVariableProvider within EXT:fluid extends a Fluid core class with the same functionality and can be removed. A class alias ensures that the PHP class is still available. Resolves: #82229 Releases: master Change-Id: I71eb7beaf0684631d9c7e857bbed91f08b75d47c Reviewed-on: https://review.typo3.org/53227 Tested-by:
Claus Due <claus@phpmind.net> Tested-by:
-
Anders Kostending authored
Update CKEditor to the lastest version that fixes a lot of bugs. Release notes: https://ckeditor.com/release-notes Fixes: * Added Advanced Content Filter integration with the Justify plugin. * [Chrome] Fixed: Clicking the scrollbar throws an Uncaught TypeError: element.is is not a functionerror. * Fixed: Widgets cannot be properly pasted into a table cell. * Fixed: Internal cke_table-faked-selection-table class is visible in the Stylesheet Classes field of the Table Properties dialog. * [Edge] Fixed: Error thrown when pressing the Select All button in Source Mode. * Fixed: Double slash in the path to stylesheet needed by the Table Selection plugin. * Fixed: Unnecessary dependency on the Editor Toolbar plugin inside the Notification plugin. * Fixed: Error thrown into the browser console after opening the Styles Combo plugin menu in the editor without any selection. * Fixed: Double click does not open the dialog for modifying anchors inserted via the Link plugin. * [IE8-9] Fixed: Clicking inside an empty read-only editor throws an error. * [IE10] Fixed: Clicking below a single horizontal rule throws an error. * Fixed: The range.cloneContents method selects the whole element when the selection starts at the beginning of that element. * Fixed: The range.extractContents method returns an incorrect result when multiple nodes are selected. * Fixed: The elementPath.contains method incorrectly excludes the last element instead of root when the fromTop parameter is set to true. * Fixed: SCAYT leaves underlined word after the CKEditor Replace dialog corrects it. * Added the CKEDITOR.dom.nodeList.toArray method which returns an array representation of a node list. Resolves: #82143 Releases: master, 8.7 Change-Id: I6f6037e48d768e4a2887c799c1791f3201ce40c8 Reviewed-on: https://review.typo3.org/53751 Reviewed-by:
Kasper Ligaard <kasperligaard+typo3.org@gmail.com> Tested-by:
-
Johannes Schlier authored
The trigger values can be hardcoded here, as the previous filtering only gives us fields for which we want to hide the explanation and show the input field. Previuosly each time a new link field was created (as an IRRE element for example) the input and explanation fields were triggered. This created confusion with editors and also broke the trigger button, so that fields that were in the explanation mode could not be triggered back to input mode. Resolves: #82179 Releases: master, 8.7 Change-Id: Ic92129c6cdafe5fab19fbc76b9e9b7713b9e8736 Reviewed-on: https://review.typo3.org/53790 Reviewed-by:
Anja Leichsenring <anja.leichsenring@typo3.com> Tested-by:
-
Christian Kuhn authored
Fix "Find imagemagick / graphicsmagic in specific direcory" input field in image preset handling. The preset handling is still a bit ugly and does not integrate too well into the ajax based handling all other cards use. This needs a bigger refactoring and is not done with this patch. For now, submitting a path to the image preset path input field reloads the view and executes the path test, so the functionality is there, it's just a bit ugly to use. Change-Id: I2da1680b44ff34df05aecc4eb589a293bb8d72c2 Resolves: #82188 Related: #76084 Releases: master Reviewed-on: https://review.typo3.org/53822 Tested-by:
-
