- Jan 20, 2022
-
-
Oliver Bartsch authored
When previewing pages a null pointer exception is triggered in the frontend RequestHandler, in case $GLOBALS['LANG'] does not exist. This is the case when no user object exists (or is not a FrontendBackendUserAuthentication). This is now fixed by creating the LanguageService with the corresponding factory and no longer relying on $GLOBALS['LANG']. Additionally, another possible null pointer is fixed in the factory, since createFromUserPreferences() allows NULL for the first parameter "$user" but previously did not check the provided value before accessing. Resolves: #96590 Releases: main, 11.5, 10.4 Change-Id: I160a9dae9131973d681b392ee713d1fadcb9a24b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/73095 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
-
- Jan 17, 2022
-
-
Christian Kuhn authored
The created reports.xml when running acceptance tests is used for nothing in CI and just uploaded as artifact along with the other reports. When ac tests fail, the generally useful file is reports.html together with the screenshots. Creating the xml file is skipped now. Users who still want to create the xml file when running the acceptanc test suite can do so by adding the "extra" argument to runTests.sh: > Build/Scripts/runTests.sh -s acceptance -e '--xml reports.xml' Resolves: #96557 Releases: main, 11.5, 10.4 Change-Id: Ic385e307bb48702bc9269e42960fc76f1aa0be41 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/73050 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
-
- Jan 13, 2022
-
-
Elias Häußler authored
Doctrine uses mixed type for most of their method arguments in QueryBuilder. Since TYPO3 core uses variadic arguments for some methods in the wrapping QueryBuilder, argument types have been streamlined to match the ones in the concrete QueryBuilder instance from Doctrine. Resolves: #96507 Related: #96457 Releases: main, 11.5, 10.4 Change-Id: I834240f764feac7af9fba7db0d45aaf4927abb2e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/73010 Tested-by:
-
- Jan 11, 2022
-
-
Oliver Hader authored
The change for issue #94357 introduced handling for `event/` URLs, and accidentally modified handling for `video/` URLs as well. As a result, the `video/` IDs were incorrectly resolved containing a leading slash. Resolves: #96509 Releases: main, 11.5, 10.4 Change-Id: I5623ff59dac44a699877e4e5a2e91707f72a407e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72969 Tested-by:
Jigal van Hemert <jigal.van.hemert@typo3.org> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Oliver Hader authored
Change-Id: I9afad25a88555d3a89610b63ab0afd21e1284304 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72957 Tested-by:
-
Oliver Hader authored
Change-Id: I52bd2fc97d0e1a24ad393bc6b2fb4597fb5f73be Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72956 Tested-by:
-
- Jan 10, 2022
-
-
Andreas Fernandez authored
The maintainer of the `colors` package decided to rampage and released a bonkers version, see [1] and [2], causing an implosion of the npm eco system. Albeit TYPO3 uses this as a transitive dependency only, we're going to be safe and enforce this package to version 1.4.0, the current known to-be-stable version. [1] https://github.com/Marak/colors.js/issues/285 [2] https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/ Resolves: #96499 Releases: main, 11.5, 10.4 Change-Id: Ic8ad9105c9a9bc45bb2519547bb044be672db27c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72931 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
-
Oliver Hader authored
Update to CKEditor v4.17.1 which addressed browser compatibility issues and known security vulnerabilities: https://ckeditor.com/cke4/release-notes Commands: rm -r typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib cd Build yarn add 'ckeditor4@^4.17.1' yarn build Resolves: #96494 Releases: main, 11.5, 10.4 Change-Id: I87039f5a5d1fe7488f6d4c5d0c36e90421d4c93e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72930 Tested-by:
-
Benjamin Franzke authored
Some browsers (reported were Safari and Firefox) are not able to load the file tree when invoking the module the first time. This is because the iframe src is initially set to about:blank and ModuleMenu calls both, iframe.setAttribute('src', …) and iframe.contentWindow.location.reload(). This seems to cause browsers to abort load as the current URL is being reloaded. This is actually a result of a refactoring in #52877 where the condition navUrl != currentUrl previously correctly issued a `setUrl()` call but afterwards was swapped to call `refresh()` instead (or rather additionally). Releases: 10.4 Resolves: #96475 Resolves: #92556 Related: #52877 Change-Id: Ib20c05e0ca6ed1de62cabf86b6a46a3399636fab Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72932 Tested-by: -
Oliver Hader authored
Update to @claviska/jquery-minicolors v2.3.6 which addressed known security vulnerabilities: https://security.snyk.io/vuln/SNYK-JS-CLAVISKAJQUERYMINICOLORS-1930824 https://github.com/claviska/jquery-minicolors/releases/tag/2.3.6 Commands: cd Build yarn add '@claviska/jquery-minicolors@^2.3.6' yarn build Resolves: #96495 Releases: main, 11.5, 10.4 Change-Id: Iaafdd29dd50a18321746fb36702702302078fceb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72942 Tested-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
-
- Jan 07, 2022
-
-
Jörn Wagner authored
This patch adds a check to detect self referencing redirects, thus avoiding them and instead log an error in the corresponding frontend redirect middleware. Furthermore, add a bunch of tests along the way to cover this change and the different constellations, for example not avoiding redirect with the same path but external host. Resolves: #96427 Releases: main, 11.5, 10.4 Change-Id: I554ba51b53065dd754068e379f69c2a5dffc3054 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72808 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
Benjamin Franzke authored
User supplied strings must not be concatenated into the format parameter of sprintf() as sequences like %s, or (more likely) %20S (which is ' S' url escaped) may be contained and cause warnings because sprintf() expects additional arguments in that case. Streamline to always use the static '%s: "%s"' format instead. Releases: main, 11.5, 10.4 Resolves: #96478 Change-Id: Ic3b09c6e1e7c617e78ea405289680bd78d0aab64 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72901 Tested-by:
-
- Jan 05, 2022
-
-
Nikita Hovratov authored
With the introduction of itemGroups, the index 3 of the select items array has been shifted one position to the right. Before that, the index 3 was used for descriptions and index 4 for an optional keyword EXPL_ALLOW or EXPL_DENY. These are used together with authMode=individual to explicitly allow or deny single items. Since descriptions now occupy the index 4, the former usage of this index needs to be shifted as well to index 5. For backwards compatibility reasons, a TCA migration is added, which will check for these special keywords and move them one index up. Resolves: #96444 Related: #91008 Releases: main, 11.5, 10.4 Change-Id: I32a96f5c6377871551ab4ee60a402a585da7eaa0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72820 Tested-by:
-
Ingo Fabbri authored
This patch adds missing 'CompositeExpression' as union type for QueryBuilder methods 'where()', 'andWhere()' and 'orWhere()' to match the ability of the underlying doctrine/dbal QueryBuilder methods. Resolves: #96457 Releases: main, 11.5, 10.4 Change-Id: Ib9330ffabcdc7680bfd5bb8a991cec60889c9773 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72879 Tested-by:
-
- Jan 04, 2022
-
-
Benjamin Franzke authored
With the changes in #95854, database mounts are no longer sorted by the order they are defined in the group/user settings, but undefined by the order the database returns. DB mounts aren't sorted against each other, that means sorting values are not meaningful anyway, and results in uncontrolable orderings. Explicitly preserve the order using usort(). Also revert groupAndSortPages() to the state prior to #95854, as the forcePid parameter would now be unused. Releases: main, 11.5, 10.4 Resolves: #96359 Related: #95854 Change-Id: I64b8d90c68246cc0ac01abcbf3678aa1055189e3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72854 Tested-by:
-
Christian Kuhn authored
The busybox variant as packaged with the test images based on alpine of mktemp needs six 'X' as template in cglFixMyCommit.sh. It otherwise emits a warning executing the command: > Build/Scripts/runTests.sh -s cglGit Resolves: #96432 Releases: main, 11.5, 10.4 Change-Id: I1c1853aabe79186694161c21f5fe0341e1bd2e75 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72874 Tested-by:
-
Georg Ringer authored
The option "autoplay" only works if "mute" is enabled. See https://developer.chrome.com/blog/autoplay/ for reference. Resolves: #96320 Releases: main, 11.5, 10.4 Change-Id: Ic4e2de0576fe3d1619af8e35274adeb013c72b31 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72846 Tested-by:
-
- Dec 30, 2021
-
-
Benjamin Franzke authored
With the changes in #95854, implicit rootPid dbmounts caused duplicated pages in pagetree, because explicit page mounts have been considered multiple times for the pid=0 tree: * First time because of their relationship to pid = 0 * Second time because of their explicit mount (which was sorted into the pid = 0 tree) This happened because #95854 optimized to only use one call to the PageTree repository, which then had the side effect of merging "multiple" pages into one tree, instead of showing "two" separate trees. The patch ensures that multiple page trees are used when the rootPid (0) is included as a webmount. Releases: main, 11.5, 10.4 Resolves: #96367 Related: #95854 Change-Id: I7f421995f2d4aa88bb266fec684565102a4dc080 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72816 Tested-by:
-
Nikita Hovratov authored
The TCA option "appearance" is an array, with pre-defined configuration keys. The column "custom_stages" of the table "sys_workspace" set a csv value for this option. This does not work. The configuration is now transformed into the correct array format. Resolves: #96437 Releases: main, 11.5, 10.4 Change-Id: I25112d7ea1ce605376d70fa2dabceddd3c121faa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72834 Tested-by:
-
- Dec 27, 2021
-
-
Torben Hansen authored
Added the following Composer plugins as allowed/trusted * composer/package-versions-deprecated * typo3/class-alias-loader * typo3/cms-composer-installers Resolves: #96428 Releases: main, 11.5, 10.4 Change-Id: Iabb8f00411279f502bca1d1ba79714cc58d82d3f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72782 Tested-by:
Wouter Wolters <typo3@wouterwolters.nl> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
- Dec 23, 2021
-
-
Oliver Bartsch authored
This fixes several issues for the case that an editor only has access to translated pages and not to the default language (L=0). Resolves: #95795 Releases: main, 11.5, 10.4 Change-Id: Ied31c7aa5229d3b8686741dd97005f9b5f16ef16 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72617 Tested-by:
-
- Dec 21, 2021
-
-
Simon Gilli authored
The core version service now uses the new entry point of the REST API available via https://get.typo3.org/api. The old entry point is still available but should not be longer used. For more information see `https://get.typo3.org/api/doc <https://get.typo3.org/api/doc>`_ and `https://github.com/TYPO3/get.typo3.org/pull/272 <https://github.com/TYPO3/get.typo3.org/pull/272>`_. Resolves: #92020 Releases: main, 11.5, 10.4 Change-Id: I2c92554e9ba212827b6412d4a88ac5c92e26aa17 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72757 Tested-by:
-
- Dec 20, 2021
-
-
Sybille Peters authored
Remove the deprecated parameter useCacheHash from Typolink viewhelper documentation (included in comments). The parameters useCacheHash and noCacheHash have been deprecated in TYPO3 v10 and should no longer be used. The change applies to TYPO3 v10 only. Resolves: #91956 Releases: 10.4 Change-Id: I1db7c06307d7e69a48ef91d7bafcdc63ee1e22ff Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72707 Tested-by:
-
- Dec 17, 2021
-
-
Helmut Hummel authored
Get rid of the select query entirely, which optimises the task to only require one update query instead of one select and possibly multiple update queries and gets rid of doctrine version related incompatibilities with fetching the select result. Resolves: #96369 Related: #87162 Releases: main, 11.5, 10.4 Change-Id: I87b570f5efa3d77ed5f2c5fc0074e84bef4675a4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72692 Tested-by:
Helmut Hummel <typo3@helhum.io> Tested-by:
-
- Dec 15, 2021
-
-
Marc Bastian Heinrichs authored
Resolves: #96308 Releases: main, 11.5, 10.4 Change-Id: Ibcbda7fd97a338d721cf00b38026727e941c72ac Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72681 Tested-by:
-
Guido Schmechel authored
If a language in the SiteConfig is set to the fallbackType free and there is no translated page for this language, then there is now no generated hreflang. Previously, a link was always generated with default language slug, which lead to 404 page not found. Resolves: #94270 Releases: main, 11.5, 10.4 Change-Id: Ifb261cf388fccbaabbf2bcae9ac805b143c9b42f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72674 Tested-by:
-
- Dec 14, 2021
-
-
Benni Mack authored
Change-Id: I2427fff61df9c82b8f13145265c3ef95ec076251 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72652 Tested-by:
-
Benni Mack authored
Change-Id: Iecf91dfa57e2486f331374db6d6ea6626cbbbfc9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72651 Tested-by:
-
- Dec 13, 2021
-
-
Helmut Hummel authored
With the introduction of site settings being exposed to TypoScript with https://review.typo3.org/64128 it has become important to allow more characters as TypoScript keys. Allowing a slash in addition should cover cases where paths are exposed as keys. Additionally the above change reveals, that the ArrayUtility::flatten method does not properly handle array keys that has dots in between, as those must be escaped to produce a correct result. This change introduces a new flatten method after several failed attempts to guess what fixes might not be breaking. The new method is used in places where no TypoScript is used, as in those the weird edge case behaviour of the flatten method isn't expected anyway. The new method is marked internal until it is decided how to proceed with the flatten method. Resolves: #94646 Releases: main, 10.4 Change-Id: I4ebad8a0beece975702d8601a343aa1fdaaa285c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72120 Tested-by:
-
- Dec 11, 2021
-
-
Benni Mack authored
This avoids an error-prone AJAX call in the backend module. This issue does not happen in TYPO3 v11+ anymore, as the method is not called via AJAX directly anymore. Resolves: #90073 Resolves: #91679 Releases: 10.4 Change-Id: I0dd9caba77352ee60e0e56138bffa3bbc02a98d0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72609 Tested-by:
-
- Dec 10, 2021
-
-
linawolf authored
* Adjusts all configuration files using the main branch instead of master * Makes all "Edit on Github" links in the Changelog and System Extension manuals work again after master - main switch. * Fixes all link to Github or Docs using the path containing main instead of master Resolves: #96138 Releases: main, 11.5, 10.4 Change-Id: Ifde73dd2bb8efdbf54eb2ba7625d6f201de9bd11 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72573 Tested-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
-
Rémy DANIEL authored
If TSFE->set_no_cache is called, either a warning or a notice is triggered, depending if a BE user is connected or not. With this change, the preview mode will trigger a notice instead of a warning. This restores the same behaviour than before #86002. Resolves: #96306 Releases: main, 11.5, 10.4 Change-Id: I40b9b1d90d42f14de2977aca61c24a9fd698ced0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72578 Tested-by:
-
Albrecht Koehnlein authored
Make HTML parser more tolerant for single tags with ending slash but without white spaces. So `<hr/>` already was allowed and internally converted to `<hr />` while parsing the HTML. This patch extends this replace rule to all tags so that also `<br/>` can be used in RTE fields. Resolves: #96307 Releases: main, 11.5, 10.4 Change-Id: I7ba6c88e35804c6b5f991fb6b730fbc3d7a2514e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72580 Tested-by:
-
- Dec 06, 2021
-
-
Christian Kuhn authored
Populate a series of minor deprecations and updates. composer req --dev typo3/testing-framework:^6.15.1 composer req --dev typo3/testing-framework:^6.15.1 -d typo3/sysext/core/ --no-update Resolves: #96265 Releases: 10.4 Change-Id: If8c9e5e9b424e907607edf4d718f92a926c3a15d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72533 Tested-by:
-
Christian Kuhn authored
Additional backport of #96166 to v10 since it is useful for nightly execution, too. Change-Id: I8e461592eecd0a66b0fcf6ee5ab14509ebec8277 Resolves: #96166 Releases: master, 11.5, 10.4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72532 Tested-by:
-
Christian Kuhn authored
The patch changes runTests.sh and the container definition to avoid mounting users home, /etc/passwd and /etc/group. yarn based setups need some special treatment but in the end bow to shell power, too. Change-Id: I4e5665d31c5bef4e046e992eddd534ae597cce31 Resolves: #96253 Releases: main, 11.5, 10.4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72517 Tested-by:
-
- Dec 04, 2021
-
-
Christian Kuhn authored
APCu cache backend is a shared memory per user and typically bound to the executing posix user-id. Calculating different cache identifiers per user is useless since those won't share the same shm. Resolves: #96232 Releases: master, 11.5, 10.4 Change-Id: If6b6a744828d06d55f2c9b5656aef48193da7384 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72511 Tested-by:
-
- Dec 03, 2021
-
-
Oliver Bartsch authored
A false check in the TER API allowed to use arbitrary version strings, as soon as they start with the known `XXX.XXX.XXX` schema. This will be fixed in TER API. However, core as receiver should also validate the incoming data, before storing them in the database. Therefore, the same version number check, which is used in the TER API, is now also applied in the ExtensionXmlParser. Resolves: #96209 Releases: main, 11.5, 10.4 Change-Id: I487eed34c6b25a5e3841d5263b52b9a73aaf681a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72484 Tested-by:
-
- Dec 01, 2021
-
-
Georg Ringer authored
The translations need to use the language of the current backend user and not the one of the current language of the site in the frontend. Resolves: #96004 Releases: master, 11.5, 10.4 Change-Id: Id409e759de4f0324835cc932f87719147b6e1b0f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72362 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
-
- Nov 29, 2021
-
-
Oliver Hader authored
Resolves: #96133 Releases: main, 11.5, 10.4 Change-Id: Ic1924bbf34b746bf1891419da6cb54e547a509a8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72365 Tested-by:
-
