- Feb 18, 2020
-
-
Christian Eßl authored
If a HMAC of a submitted form is invalid (because it has been tampered with), TYPO3 would previously throw an exception that leads to a status code 500. This is incorrect behaviour, as the error comes from bad user input and not a server error. In case the HMAC of a submitted form is invalid, both extbase and ext:form will now throw a BadRequestException, which will then lead to a status code 400 (BAD REQUEST). Resolves: #90134 Releases: master, 9.5 Change-Id: If4dad7ba27190b5992bab68b4ce64a423c0db645 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63272 Tested-by:
TYPO3com <noreply@typo3.com> Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Alexander Schnitzler <git@alexanderschnitzler.de> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
Daniel Goerz <daniel.goerz@posteo.de> Reviewed-by:
-
- Feb 17, 2020
-
-
Chris Müller authored
When creating a new IRRE child element the uid of the parent element was not set. This is a problem when you use an itemsProcFunc for a select column which relies on the parent's element uid to show according values. With the parent uid you can query the stored values. Resolves: #63777 Releases: master, 9.5 Change-Id: I898de29020bf68e25de9ef1d80cc20353a635524 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/61480 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Tobi Kretschmann <tobi@tobishome.de> Reviewed-by:
Henning Liebe <h.liebe@neusta.de> Reviewed-by:
Sascha Rademacher <sascha.rademacher+typo3@gmail.com> Reviewed-by:
Felix P. <f.pachowsky@neusta.de> Reviewed-by:
Jörg Bösche <typo3@joergboesche.de> Reviewed-by:
-
Nikita Hovratov authored
This patch: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62227 introduced decoding of attribute values in tags. This was necessary for email link parameter, but broke html inside attribute tags, because quotes were left unescaped. Resolves: #90339 Releases: master, 9.5 Change-Id: I3c336901df6e3ee5eeea46888db11c40986ced56 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63274 Tested-by:
Richard Haeser <richard@maxserv.com> Reviewed-by:
-
Manuel Selbach authored
With this change, the DocumentTypeExclusionRestrictionTest will use NOT IN instead of <>. This will allow to have only one instance of that restriction. Additionally multiple casts to integer have been removed. Resolves: #87938 Releases: master, 9.5 Change-Id: I3c1c5cc47800dae3f13afc654f55236634ad5bc5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60275 Tested-by:
Dennis Prinse <dennis@dennisprinse.com> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Claus Due <claus@phpmind.net> Reviewed-by:
-
Nicole Cordes authored
For PersistedAliasMapper and PersistedPatternMapper, language handling when resolving a URL route paramter was not explicit enough. PersistedAliasMapper incorrectly resolved language default records even when the HTTP request contained a language aspect and a more specific record (having the same slug value) would have been available. That was similar in PersistedPatternMapper when `uid` field was not defined in corresponding pattern (e.g. `^(?P<title>.+)-(?P<uid>\d+)$). For both mentioned scenarios language restrictions and fallback handling has been integrated. Records are retrieved in the following order: + "all language (-1)", most specific if present, can't be localized + "current language" most specific for the current given request context + "language fallbacks" (might include "default language") Resolves: #89153 Releases: master, 9.5 Change-Id: I25b17d1d618bb1509737d43b877a16c3a6da9f28 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/61668 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Markus Klein authored
Resolves: #90408 Releases: master Change-Id: Ifefec22a13b0bf303fd06afa744fd9b1c1733a36 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63281 Tested-by:
-
Markus Klein authored
Preset the expected data values correctly to make the detail view of BE users functional if those have no table read or modify permissions. Resolves: #90409 Releases: master Change-Id: I3040390c7f702cd201909ded3499f445ea83e7c2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63280 Tested-by:
-
Oliver Hader authored
Patch for issue #90351 in master branch was merged fast. Some aspects were missing which are streamlined with this change. - workspace preview "ADMCMD_prev" using backend user setting ("strict" by default) Resolves: #90380 Releases: master Change-Id: I8d244db64a438d7537310787934a49abe3ebf28d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63256 Tested-by: -
Georg Ringer authored
The element information modal now shows all fields of the current record and the selected type. The TCA configuration `showRecordFieldList` inside the section `interface` is not evaluated anymore and all occurences have been removed. Resolves: #88901 Releases: master Change-Id: I7d2dcb60b04b16083e615bf23dccf54f0a493848 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/61424 Tested-by:
Stefan Froemken <froemken@gmail.com> Tested-by:
-
Ralf Zimmermann authored
Make sure to apply all configured validators if a form is rendered multiple times on the same page. Resolves: #90083 Releases: master, 9.5 Change-Id: Ife1a8beb985cde4fdb7c635fd98f4e7bc5ccb9db Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62840 Tested-by:
Björn Jacob <bjoern.jacob@tritum.de> Tested-by:
Ralf Zimmermann <ralf.zimmermann@tritum.de> Reviewed-by:
Steffen Frese <steffenf14@gmail.com> Reviewed-by:
-
Anja Leichsenring authored
Resolves: #90391 Releases: master, 9.5 Change-Id: I8c69e206c175d3a230157a4ad3593365e05f2690 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63268 Tested-by:
-
Alexander Schnitzler authored
This patch adds two methods setDefaultValue and setProperty which are called from within class AbstractRenderable via $this->setDefaultValue() and $this->setProperty() but are meant to be called on a child class. The implementation of said methods with an empty method body only serve the purpose to please phpstan. As mentioned in those method bodies, someone with a deeper understanding of the form extension architecture needs to decide whether the abstract class AbstractRenderable should only declare those methods as abstract methods, i.e. child classes have to implement them or if the abstract class can provide a meaningful default behavior which can but doesn't need to be overridden by child classes. Releases: master Resolves: #90385 Change-Id: I1ac3b319746d8eca12b32394cd9da2073431b582 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63262 Tested-by:
-
Georg Ringer authored
After reworking the IP usage in logs with #85316 the IP address hasn't been substituted anymore in the login error log mails. Replace the IP address which can be found in the field 'IP'. Resolves: #90335 Releases: master, 9.5 Change-Id: I2472bd8902915bf964a167c389c2048242b29207 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63249 Reviewed-by:
Guido Schmechel <guido.schmechel@brandung.de> Reviewed-by:
-
- Feb 16, 2020
-
-
Sybille Peters authored
Document change "Feature: #87451 - scheduler:run command accepts multiple task options". The scheduler command now accepts multiple --task options. Resolves: #90394 Releases: master Change-Id: Ie0f7973cab01db88f4df0cb4cd87a194bf4914b1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63270 Tested-by:
-
Sybille Peters authored
We move chapter on scheduler command line execution to top level in the menu. This was somewhat hidden under "Installation". Additionally, we add a link to this chapter to the section on cron. Additionally the chapter "Installation" is renamed to "Installation & setup". "Administration" is renamed to "Backend administration". Resolves: #90395 Releases: master, 9.5 Change-Id: Id25cdb16f9f3c87c9fdac1194246c5d471d1476c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63271 Tested-by:
-
Sybille Peters authored
Events are named AfterSectionMarkupGeneratedEvent and BeforeSectionMarkupGeneratedEvent. Resolves: #90397 Releases: master Change-Id: I6a4b690894321d10a618f6056e0790a69d0921d6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63273 Tested-by:
-
Georg Ringer authored
Use mb_strlen & mb_substr to cut off TypoScript to avoid exceptions if the 20th character is a multibyte value. Resolves: #90372 Releases: master, 9.5 Change-Id: I8f90aa54a4cb6ede95d4fa50d557aeec4d8cd031 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63255 Reviewed-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Tested-by:
-
- Feb 15, 2020
-
-
Christian Eßl authored
A regression introduced with #87879 removed the _REF_ label in the header table row of the filelist module. This commit fixes this bug. Resolves: #90387 Relates: #87879 Releases: master Change-Id: I7c7289352d81b09576fce6b266fb6c7a11daeeb1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63265 Reviewed-by:
-
Georg Ringer authored
Show all collected information of a user in the beuser module instead of just the information directly added to the user record. The UI will be improved with later patches This patch also switched to constructor injection in BackendUserController. Resolves: #90298 Releases: master Change-Id: I8cc19a475ae43404e29402b99852286bf6991b70 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63149 Tested-by:
-
Christian Eßl authored
The "Environment Overview" card in the admin tool will now show the application context the TYPO3 instance is running with. Resolves: #90136 Releases: master Change-Id: Ia9583ac093cdeba341e8cd079bbac341098a3b76 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63259 Tested-by:
Nikita Hovratov <nikita.h@live.de> Tested-by:
-
Alexander Schnitzler authored
Used commands: composer remove rector/rector --dev composer require rector/rector:"~0.7" --dev Since updating phpstan to version 0.12.10, rector failed to run properly. Also, the updated version of rector brings a couple of bugfixes and new features. Releases: master Resolves: #90383 Change-Id: I29d66c5e34db594fbcf24949c61e6db85cecae1b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63260 Tested-by: -
Alexander Schnitzler authored
This patch only pleases phpstan. The refactoring of the indexer which includes the removal of the direct dependency to 3rd-party classes is taken care of in the following issue. https://forge.typo3.org/issues/83603 Releases: master Resolves: #90384 Change-Id: Ia1ee984f692dce7f8293077cbea3359d6843cb46 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63261 Tested-by:
-
Alexander Schnitzler authored
Releases: master, 9.5 Resolves: #90381 Change-Id: Ib7d3700ab928addec9c585e031fa9c0ba1bb50d3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63257 Tested-by:
-
Alexander Schnitzler authored
Releases: master Resolves: #90382 Change-Id: I26fe0116e48c64362c2b124e9daeec73182cccc2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63258 Tested-by:
-
Alexander Schnitzler authored
Both the \TYPO3\CMS\Core\Http\Client\RequestException and \TYPO3\CMS\Core\Http\Client\NetworkException declare a method getRequest which must return a RequestInterface object which they did not. Releases: master Resolves: #90379 Change-Id: I4cdee1cdf95efc1ebcabaacec7be2cd290f31989 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63254 Tested-by:
-
Alexander Schnitzler authored
Upgrade phpstan/phpstan to at least 0.12.10 and enable bleeding edge configuration to be able to run the phpstan analysis with all available cpu cores. Releases: master Resolves: #90378 Change-Id: I4c76a8f44c570b126844d1bde96998cf9d3790fa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63253 Tested-by:
-
Andreas Fernandez authored
Use the correct target (clicked button) to be able to access the button name. Resolves: #90036 Releases: master Change-Id: I3a2face0c10aa41dea13bc49d3f8f3e9f47b3fcc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63251 Tested-by:
-
Nikita Hovratov authored
Since the querybuilder is used to fetch notes the default restrictions of both apply sys_note and be_users. This patch removes the default restrictions and adds them manually only for sys_note. The names of hidden or deleted authors are replaced with "unknown author" instead. Fixes: #90216 Releases: master, 9.5 Change-Id: I7613909dad078256747e8b719bf68d64729fb56d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63246 Tested-by:
-
Guido Schmechel authored
IP anonymization now takes the correct pattern when querying the database. Depending on the mask to be shortened. Resolves: #89788 Releases: master, 9.5 Change-Id: Ic09d2385b33434cc2d7553087c2014b190f9c339 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62992 Tested-by:
-
Mario Lubenka authored
Resolves: #90042 Releases: master Change-Id: I9ca7dbc59495372033659d7d4c82142c92ed5e1b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62813 Tested-by:
-
Claus Due authored
Adds two new methods, evaluate() and onClose() which makes Widgets compatible with Fluid 3.0 but which are never called on Fluid 2.x. Releases: master, 9.5, 8.7 Resolves: #90286 Change-Id: I36a99c30e7c3bb5baae065cfc6368a2bf493cc40 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63133 Tested-by:
-
Stefan Froemken authored
In case of extbase many FlexForm fields are called settings.*. As "settings" is part of the field it should not be removed as extra identifier. Resolves: #80295 Releases: master,9.5 Change-Id: I206f28cfc360cb526f488b2fb016139246c2cad8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63003 Tested-by:
-
ℳichiel ℛoos authored
Allow inline parent UID to have a "NEW..." placeholder value. Resolves: #82931 Releases: master, 9.5, 8.7 Change-Id: I1714160d14d226a02663568947ed9525ad07d347 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/54598 Tested-by:
-
Elias Häußler authored
Both "clear" and "add" buttons for the backend user avatar selection are currently not accessible via keyboard. In order to solve this accessibility issue, both buttons have been converted from links to html buttons to trigger the onclick handler when using the keyboard. Resolves: #90293 Releases: master, 9.5 Change-Id: I263a282a4bee33abdb88f9850d230a453365b7ab Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63148 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Torben Hansen <derhansen@gmail.com> Reviewed-by:
Michael Telgkamp <michael.telgkamp@mindscreen.de> Tested-by:
-
Georg Ringer authored
If a record should be restored, the label in the modal must be set to "Restore record" instead of "Delete". Resolves: #89599 Releases: master, 9.5 Change-Id: I201473cb86be207cda9c87b43c5420f6cb5c6898 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63244 Tested-by:
Riccardo De Contardi <erredeco@gmail.com> Tested-by:
-
Daniel Siepmann authored
Allows direct checks whether an expected bit is part of a bit set, e.g. in a stored checkbox or radio of a record. Resolves: #90213 Releases: master Change-Id: I2ff188c74b207376f5f44307f0a8a2e9514ea6d8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63046 Tested-by:
-
- Feb 14, 2020
-
-
Oliver Bartsch authored
transOrigPointerFields can not longer be excluded as this leads to inconsistent data stored in the database if a non-admin user created a localization by not having the permission to edit the transOrigPointerField. Resolves: #89550 Resolves: #89672 Releases: master Change-Id: Id718323783d37e6044781183052e3428ded9c89c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62632 Tested-by:
-
Claus Due authored
Changes access of $this->viewHelperVariableContainer to $this->renderingContext->getViewHelperVariableContainer since the former is deprecated in AbstractViewHelper. Releases: master, 9.5, 8.7 Resolves: #90276 Change-Id: I157948834a6a6e654b2e851057922745e9921920 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63101 Tested-by:
-
Alexander Schnitzler authored
Unfortunately phpstan looses the correct type of $this as soon as $this is passed into a hooked as a hook method parameter without a specific type. This leads to phpstan losing the information about available methods and properties of $this. Releases: master Resolves: #90204 Change-Id: I6fdb4f07dd970a1602a7afbbf662b29f2a927a15 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63036 Reviewed-by:
-
Benni Mack authored
Use code cache properly instead of storing strings into it, because it is proper usage of our API, removes the need for stripping PHP code strings and improves performance when OPCache is in use (which is recommended on production systems). Additionally all calls to ->has are removed, except one place where boolean values are stored in a runtime cache and in tests, because the API guarantees returning "false" when using ->get or ->require Doing so reduces the amount of lookups on the backend storage (file_exists for file backend, SQL queries for DB backend) and makes up more straightforward code in most places (reduces cyclomatic complexity by removing obsolete "else" branching). Releases: master Resolves: #89895 Change-Id: I401512ad4ddffb622ce2f4a9d88274deb4b4e849 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62558 Tested-by:
Achim Fritz <af@achimfritz.de> Tested-by:
-
