- Oct 08, 2024
-
-
Christian Kuhn authored
We worked hard on TypoScriptFrontendController in TYPO3 v13 leaving mainly internal code and usages. A couple of details are still left open, and we can't tackle them in v13 anymore due to time constraints. The most notable area is the main content generation trigger and the *_INT processing. However, all non-internal usages by extensions can be substituted. Usually by using new attributes of the request. The goal is still to get rid of TypoScriptFrontendController in TYPO3 v14. The patch prepares this by declaring TypoScriptFrontendController fully deprecated, even though with some left over internal usages. TYPO3 v14 will see a few preparation patches to reach this goal. The patch polishes a ReST file from 13.0 to add some more "Use this instead" information, and adds a new ReST file declaring TypoScriptFrontendController and $GLOBALS['TSFE'] deprecated. Resolves: #105230 Resolves: #105046 Related: #102621 Related: #104217 Releases: main Change-Id: I0d9ab50e4be9724895f5f2763c0be2ab731cd9f0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86493 Reviewed-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Andreas Kienast <akienast@scripting-base.de> Tested-by:
-
Christian Kuhn authored
Resolves: #105233 Related: #105231 Releases: main Change-Id: Ie8aa214eae6ebe42a4a9c81864e78c65bb1dd437 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86503 Reviewed-by:
-
Christian Kuhn authored
Fourth argument is set but never used and there is no get'er. Resolves: #105236 Related: #103466 Releases: main Change-Id: I81b82b4e1bc55c855f3c914d85747fd8789ba60c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86511 Reviewed-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
Benjamin Franzke authored
The aspects array-key is always set because the capture is not nested and filled in any case. That means: If preg_match was successfull (which is checked before), aspects have been found as well. Executed commands: composer require --dev phpstan/phpstan:^1.12.6 Build/Scripts/runTests.sh -s phpstanGenerateBaseline Resolves: #105226 Releases: main, 12.4 Change-Id: I95f5a12b0b66b88af68bd1a7dc6357699e8a8e9a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86465 Tested-by:
-
Oliver Hader authored
Backend users were able see page tree items without having access: - in case no DB mounts were configured for a particular user and page permissions configured to allow "everybody" - in case DB mounts were pointing to pages, but actually not having any permission configured for these pages (user/group/everybody) It was not possible to manipulate any of the affected pages. Resolves: #104397 Releases: main, 13.3, 12.4, 11.5 Change-Id: I52079c8cef3d78946083403adb23a3e1a706c652 Security-Bulletin: TYPO3-CORE-SA-2024-012 Security-References: CVE-2024-47780 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86501 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Oliver Hader authored
Resolves: #104343 Releases: main, 13.3, 12.4, 11.5 Change-Id: Ie9cd7bec43782282a142ad0911029579442734fd Security-Bulletin: TYPO3-CORE-SA-2024-011 Security-References: CVE-2024-34537 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86500 Tested-by:
-
Andreas Kienast authored
The delete button for sys_notes rendered in the record list is currently nested in a form tag, breaking the user interface. Since this requires a DataHandler call, the button is converted to a Lit component that invokes the `AjaxDataHandler` module. Resolves: #105229 Releases: main Change-Id: I87339d318b94bd2f20d1e24a9bc0270abdfd9ce4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86470 Reviewed-by:
Benjamin Kott <benjamin.kott@outlook.com> Tested-by:
-
Sven Jürgens authored
The API code snippet is related to 'DatePicker' and not to 'AdvancedPassword', probably due to a copy&paste mistake. Releases: main, 12.4, 11.5 Resolves: #105207 Change-Id: Icb57f4f053c8ce86e093bcdfd0f836145c692602 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86435 Tested-by:
Garvin Hicking <gh@faktor-e.de> Tested-by:
Simon Schaufelberger <simonschaufi+typo3@gmail.com> Tested-by:
-
Oliver Bartsch authored
Both ElementInformationController as well as RemoteServer previously booted up FormEngine to fetch relevant fields for being displayed in corresponding views. This is bad in multiple terms: performance, misuse of FormEngine, dependency to PSR-7, etc. Therefore, a new VisibleSchemaFieldsCollector is introduced, which uses the TCA schema to provide the fields to be displayed, depending on the record type, the language context and the current backend user. Resolves: #105185 Releases: main Change-Id: I1e39611db467105ddaf2427dc47c7bd94ef7a915 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86405 Tested-by:
-
Garvin Hicking authored
With a larger refactoring of #96473 type hinting was introduced for `AbstractFormViewHelper->renderHiddenIdentityField()`. The phpdoc annotation previously hinted at the input being of type 'object' (or null), and the type hint was thus set to 'object', too. However, the argument restriction of a ViewHelper like `FormViewHelper` defined an 'object' of type 'mixed', and would thus allow arrays. Arrays do not need a hidden identity field, so returning '' for that would allow the ViewHelper to function properly. With this patch, the type hint is changed to 'mixed' now, so that previous ViewHelper usages with arrays should be restored again and not lead to a type exception. Resolves: #105146 Resolves: #103162 Related: #96473 Releases: main, 12.4 Change-Id: I8a431e8909efb2e8d5ad041c69a0c75b7296c721 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86367 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
-
Benjamin Kott authored
Resolves: #105227 Releases: main Change-Id: I8bf52b22bc08b596d29041a9a8f962019f8edb7a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86468 Reviewed-by:
Benjamin Franzke <ben@bnf.dev> Reviewed-by:
-
Benjamin Kott authored
Resolves: #105222 Releases: main Change-Id: I3fd765bf2450880b3b498ebce6f83589e2c5a15c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86453 Tested-by:
-
- Oct 07, 2024
-
-
Stefan Bürk authored
Resolves: #105196 Releases: main, 13.3, 12.4, 11.5 Change-Id: I681c2d284097e3e0af604f991e12c7e0fbc76472 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86419 Tested-by:
-
Oliver Bartsch authored
The sub types feature of TCA was used for registration of plugins as "list_type". Since it's encouraged to register plugins as CType since a couple of versions already and the deprecation of the "list_type" functionality with #105076 are the sub types now deprecated as well. This special functionality just lead to headaches and should be replaced by using dedicated record types, making configuration much cleaner and more comprehensible. Resolves: #105213 Related: #105076 Releases: main Change-Id: If9ce3f5de7ef69aaf16cf987ebcb62ea50f9a6a6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86425 Reviewed-by:
Torben Hansen <derhansen@gmail.com> Reviewed-by:
-
Benjamin Franzke authored
Resolves: #105218 Related: #105028 Releases: main Change-Id: Id9299db6d9a5dc3529be5dfd0f1fc0d30e8eb3aa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86445 Tested-by:
-
Andreas Kienast authored
The `setup` command asks whether a basic site shall be created when installing TYPO3. The question implies that it defaults to "no" value, but fails to accept "no" as input given by the user. This commit adds a normalizer for that question that converts "no" to an empty string, having the same effect as stepping through the question by providing no input at all. Resolves: #105203 Releases: main, 12.4 Change-Id: Ifcbccfa0c3c17304412112318ffc5bb0f0e87790 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86446 Tested-by:
-
Andreas Kienast authored
The `returnUrl` argument composed for the "Edit this column" view used in the Page module must not be encoded, otherwise the backend will open in itself after invoking the URL. Resolves: #103790 Related: #103345 Releases: main Change-Id: Ide6bdbefb15a7f7ae5a9c05805bcb64676ee7467 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86452 Reviewed-by:
-
Benjamin Kott authored
The CSS property `--typo3-text-color-base` is changed on a per-element basis (e.g. with the class mode theme) and therefore the scrollbar style needs to applied based on the current value of this variable. Resolves: #105223 Releases: main Change-Id: Ib9e6dbd4339ae2f454eef7daf44c8e62a599c682 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86454 Tested-by:
-
Markus Klein authored
Resolves: #105214 Releases: main, 12.4 Change-Id: I9172c5ee7dc691005684043c115e4ee708e25695 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86439 Reviewed-by:
Thomas Hohn <tho@gyldendal.dk> Tested-by:
-
Torben Hansen authored
Historically, plugins were commonly registered as subtypes of the content element `list` by using the `list_type` field. In this setup, `CType` was set to `list` for all plugins, while the actual plugin key was defined in the `list_type` field. This approach however led to several problems: * Different plugins required different fields in the backend form, resulting in complex and often convoluted TCA configurations to manage form behavior. * The existence of the `list_type` made a separate layer of content element definitions in the TypoScript necessary. * The use of `list_type` did not provide any significant benefits and made permission handling and other backend processes more cumbersome. The recommended way to create plugins is to use dedicated `CType` content elements for each plugin. Several popular TER extensions have already migrated from `list_type` to `CType` plugins. In order to unify content element registration and to remove various `list_type` related core hacks, the plugin content element and plugin subtypes have therefore been deprecated. The deprecation introduces the new `AbstractListTypeToCTypeUpdate` update wizard, which 3rd party extension authors can extend in order to add a update wizard to custom extension, which performs the required record and backend user permission migration. To prevent hundreds of functional tests showing a deprecation warning, several fixture extensions have been adapted, so plugins are configured as `CType`. Resolves: #105076 Releases: main Change-Id: I82532377cf5764ad90b55aa0ff3e16b4bea74a3d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86253 Tested-by:
-
Christian Kuhn authored
The @import syntax has been introduced with TYPO3 v9. With the TypoScript parser rewrite in v12, some last todos have been ruled out in this area. There are some good reasons to finally phase out `<INCLUDE_TYPOSCRIPT:`, the deprecation ReST gives further information. The patch adds an active trigger_error() when the parser hits a `<INCLUDE_TYPOSCRIPT:` statement and marks all related handling code as deprecated. Resolves: #105171 Related: #96614 Related: #101807 Related: #97816 Related: #103439 Releases: main Change-Id: Ic5b25afc99e16054016beac57c1f115f11b015c8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86386 Reviewed-by:
-
Benni Mack authored
This change adds a new method called "ExtensionManagementUtility::addRecordType()" which allows developers to add custom types for any TCA table which supports types. An "extended" tab is added automatically, if it does not exist yet. This change aims to reduce accessing and modifying $GLOBALS[TCA] in Configuration/TCA/Overrides as much as possible. Resolves: #104931 Releases: main Change-Id: I8963d08d514f0d24ffccaa2653c6ec382a49cff7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85852 Reviewed-by:
-
Benjamin Franzke authored
The pointer field may not be supplied if a custom frontend template submits a search request. Resolves: #104734 Related: #102945 Releases: main Change-Id: I993efe55b270ff7530b33cacfbdc032125f47875 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86449 Tested-by:
-
Benni Mack authored
When setting mod.web_layout.localization.enableTranslate = 1 or mod.web_layout.localization.enableCopy = 1 a casting to bool is now done properly. This is a regression fix from a cleanup in v13. Resolves: #104851 Related: #103345 Releases: main Change-Id: Ifb0e4d87fb7bfe64d8c21c51fc275d7fe745aff1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86448 Reviewed-by:
-
Benjamin Franzke authored
To prevent inconsistent per-element color-transitions during a color-scheme or theme change, the per-element transitions are now disabled for the time-frame where the color-scheme or theme attribute is changed and a view transition is applied now. This instructs the browser to take a screenshot before and after the view transition and animate between. For browsers which do not support view transitions (firefox) or for users that prefer reduced motion we apply the changes immediately (with transitions disabled). Resolves: #105177 Releases: main Change-Id: I37e27b6ddcdc54ff3e944b5c33b2797a0b033c69 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86397 Tested-by:
-
Ayke Halder authored
Using `<f:image src="EXT:example/Resources/Public/Images/test.svg" />` to include an image in a symlinked composer mode installation failed with: 'Unable to render image tag in "pages:123": File /symlink/_assets/abcdef0[…]/Images/test.svg does not exist.' The file exists and is directly accessible via: https://example.org/symlink/_assets/abcdef0[…]/Images/test.svg Files referenced by `EXT:` are internally resolved using the fallback storage 0. To successfully resolve the file path TYPO3 must internally use the relative instance path starting with `_assets`: `_assets/abcdef0[…]/Images/test.svg` instead of the full request path starting with `subfolder/_assets`: `subfolder/_assets/abcdef0[…]/Images/test.svg` Symlinks are typically used when having TYPO3 installed or linked in a subfolder of the web server. This issue also occurs in TYPO3 v11 with composer-mode and using typo3/cms-composer-installers:^4 Resolves: #103157 Releases: main, 12.4 Change-Id: I60f435b430011836bd18c565c9d9b06b14fece94 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83043 Tested-by:
-
- Oct 05, 2024
-
-
Markus Klein authored
The "site name" is missing in the Install Tool header, add the missing view variable. Resolves: #105199 Releases: main, 12.4 Change-Id: Ie063b2c1d9064da2e8ac570ca2179053ef3df4f7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86421 Tested-by:
-
Benjamin Franzke authored
Uses correct `base` and `locale` assignments in site configuration. Resolves: #105202 Releases: main, 12.4, 11.5 Change-Id: I872a61574f5858fd6b6269bb829bbdb43f2a56eb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86426 Tested-by:
-
- Oct 04, 2024
-
-
Rémy DANIEL authored
Releases: main, 12.4 Resolves: #105198 Change-Id: I512147b5e17d20c31498caee634eb6d29c816c16 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86420 Reviewed-by:
Chris Müller <typo3@brotkrueml.dev> Reviewed-by:
-
Oliver Hader authored
This change addresses a known security issue in CKEditor5: https://github.com/ckeditor/ckeditor5/releases/tag/v43.1.1 Executed commands: npm --prefix overrides/ckeditor5 version 43.1.1 npm install --save ./overrides/ckeditor5 $( grep @ckeditor/ package.json | \ grep -v @ckeditor/ckeditor5-dev-utils | \ grep -v @ckeditor/ckeditor5-inspector | \ sed 's/^[^"]*"\([^"]*\)".*/\1@43.1.1/' \ ) npm run build Resolves: #105180 Releases: main, 12.4 Security-References: CVE-2024-45613 Change-Id: Iab3f49cefe30223694a83a834d8ce3ea7d816920 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86400 Reviewed-by:
-
Oliver Bartsch authored
This adds the SearchableSchemaFieldsCollector, as a centralized service for fetching search fields for a given table from the Tca Schema. By centralizing this functionality, it will be possible to replace the corresponding "ctrl" option in the future with a new field related option, such as `searchable`. Resolves: #105181 Releases: main Change-Id: I8ac6cdcfa46f29ddb66828c480991f0da53ca732 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86402 Reviewed-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Guido Schmechel <guido.schmechel@brandung.de> Tested-by:
-
Oliver Bartsch authored
Components providing functionality for the page view (page module) are now using the TCASchema instead of accessing $GLOBALS['TCA']. Resolves: #105106 Releases: main Change-Id: If93d4a7e70b58cbd22012807a16e92d127080c76 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86299 Tested-by:
-
Benjamin Franzke authored
In order to load extension statics and global TypoScript, the extbase configuration manager provides a fake sys_template row if no real sys_template row has been found. Since sites with sets do not require sys_template rows to be existent, this heuristic overlayed a fake sys_template record on top of the site set provided TypoScript. The site set TypoScript was actually still loaded, but cleared by the clear flag of the fake sys_template record, which means that all set-provided TypoScript was silently discarded and only global TypoScript was loaded. The extbase backend configuration manager is now made aware of site sets to avoid adding a fake sys_template row if it is used in a site context where sets are configured. With #103580 and #103556 the default TypoScript of EXT:form has been excluded from site-set provided TypoScript with the intention to only load it if the typo3/form set is actually loaded. This was not correct: a) module.tx_form is not contained in the typo3/form set at all, and therefore still needs to be provided – or moved into the set, but that's current not possible because of b) b) module.tx_form TypoScript is (currently) needed globally, as the EXT:form backend module is not scoped to sites. That means we can not rely on the possibility that typo3/form set has been included in a site. (remember EXT:form will use the TypoScript from the "first" found root page, that means there is no guarantee that the set is loaded) Therefore EXT:form backend TypoScript is now marked as default TypoScript, not just for sys_template, but also for site sets. Releases: main Resolves: #104150 Resolves: #105189 Resolves: #105192 Change-Id: I64e0e5a306e1129f8b5e7f48e77f1ca0ca862caf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86413 Reviewed-by: -
Benjamin Franzke authored
* Fix positioning in inline contents. Inline icon-alignment is done with the `vertical-align: -22%` hack. It was introduced for icons by #69005, reintroduced for the icon element in #97876 and was then removed again in #99879 (possibly because of conflicts with block-usage). * Fix evaluation of icon-opacity-disabled, which was ignored because a semicolon was missing between the variable declaration and `display: inline-block` * Avoid unneeded icon-unify redefinition via variants. That's only used to hide an implicit condition to shadow size=default. But that case can rather be expressed using a fallback in the var() expression. * Ensure that global CSS properties are taken into account by avoiding a redefinition via :host() and using var() fallbacks instead. Resolves: #101684 Resolves: #104895 Related: #97876 Related: #99879 Releases: main, 12.4 Change-Id: I37236f2ca7211c0555db7039014adf6e93d2ece2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75419 Reviewed-by:
-
Oliver Bartsch authored
Resolves: #105193 Releases: main Change-Id: Iec1583628bad0eca9fe5afbf1eaeff9ea8003302 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86415 Tested-by:
Jasmina Ließmann <minapokhalo+typo3@gmail.com> Tested-by:
-
- Oct 03, 2024
-
-
Benjamin Franzke authored
Cope with the situation that a KeyboardEvent is not guaranteed to provide a `key` property in the event struct. `key` will be undefined if a input value is filled from a autocomplete list in google chrome. Releases: main Resolves: #104389 Change-Id: I7e3d557a1026398c44b3511ec5495bfd188d19b5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/85257 Tested-by:
-
Simon Praetorius authored
The patch-level release contains two small fixes: https://github.com/TYPO3/Fluid/releases/tag/4.0.1 Executed commands: > composer req typo3fluid/fluid:^4.0.1 > composer req -d typo3/sysext/adminpanel --no-update \ typo3fluid/fluid:^4.0.1 > composer req -d typo3/sysext/core --no-update \ typo3fluid/fluid:^4.0.1 > composer req -d typo3/sysext/fluid --no-update \ typo3fluid/fluid:^4.0.1 > composer req -d typo3/sysext/redirects --no-update \ typo3fluid/fluid:^4.0.1 Resolves: #105187 Releases: main Change-Id: I8d4f74f138ecb8bfbe8ea0456ba24cef05d02418 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86406 Tested-by:
Simon Praetorius <simon@praetorius.me> Tested-by:
Jochen Roth <rothjochen@gmail.com> Reviewed-by:
-
Sébastien Delcroix authored
In scheduler module, tasks can be gathered in groups. Each group, including the one for unassigned tasks, displays them in a table that can be collapsed. Groups can also be reordered. Groups collapsed states and order are saved in UC. Prior to this patch, collapsed states were wrongly saved because the saved key for each table was based on the index of the group, which can change depending on the groups order. Now the saved key is using the group id which stays unique, except for the unassigned tasks group which is always the first one (equivalent to group id "0"). Resolves: #101167 Releases: main, 12.4 Change-Id: I78a1524891b5857329266c8b67eac503a56e97aa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86270 Tested-by:
-
Sébastien Delcroix authored
The bottom margin of a table is set to 0 if it's a direct child of .table-fit. In the "Detailed statistics" view of Indexing module, due to the "typo3-indexed-search-statistics" custom element wrapping the table, this one is not a direct child anymore. This patch moves the custom element one level upper and adapts the Javascript accordingly so the "Words found on this page" table can stay sortable. Resolves: #104775 Releases: main Change-Id: I876f39091d4e3229071357b778100052ed2c9a93 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86249 Reviewed-by:
-
Sébastien Delcroix authored
Since introduction of "tile view" mode for filelist module in v12, the progress bars were non longer visible when uploading files in an empty folder, because the visibility of the empty parent (filelist) table no longer toggles. For v12, it was due to a wrong class selector (`.t3-filelist-table-container` has been renamed to `.t3-filelist-container`). For main, in addition to this change, jQuery has been removed and during this, the behaviour of the uploading files progress has changed. Now the table that will contain the uploading files progress is created "on the fly" and then set to hidden until upload starts. It works fine for "tile view" but not for "list view" because this table exists even if the folder is empty and does not have a "hidden" attribute that serves visibility toggling. This patch fixes these two cases separately regarding the branch : * for v12 : just adapts the class selector * for main : only render the table if folder is not empty Consequently, the uploading files progress in empty folder is now displayed in the same container for both "view" modes. And in "list view" in a folder containing items, the progress is displayed in the existing filelist. This patch also fixes the hiding of the info container when the upload starts. Resolves: #105025 Releases: main, 12.4 Change-Id: I446d204a8d428afddff93a2f18bf9150f4631196 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/86340 Tested-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
-
