- May 05, 2020
-
-
Chris Müller authored
Clicking on external links (with target="_blank") in RSS widgets and buttons of Dashboard widgets can leak the referrer of the linked page. This is mostly not wanted because it reveals the URL of the TYPO3 backend. Additionally, the other page can access the "window.opener" property, which exposes security issues. Also if the other page is running a lot of JavaScript, the performance of the TYPO3 backend may also suffer, because the other page may run on the same process as the TYPO3 backend. To mitigate this behaviour rel="noreferrer" is added to external links in the according widgets. "noreferrer" also implies the "noopener" behaviour, so this is sufficient. See also: - https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer - https://developers.google.com/web/tools/lighthouse/audits/noopener Resolves: #91290 Releases: master Change-Id: Ie53b543e39bc716a5437d9a7364691de3ec7346f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64401 Reviewed-by:
Josef Glatz <josefglatz@gmail.com> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Richard Haeser <richard@maxserv.com> Tested-by:
TYPO3com <noreply@typo3.com> Tested-by:
-
Richard Haeser authored
As the www prefix is not used anymore on typo3.org, the URLs of the RSS feeds are updated in the Dashboard Widgets. Resolves: #91297 Releases: master Change-Id: I4ffff83035967b0ba9b7233c82df01651599f103 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64405 Tested-by:
-
Georg Ringer authored
According to https://www.sitemaps.org/de/protocol.html the option `priority` is optional. If a SitemapProvider doesn't provide a priority information the tag must be avoided to have a valid XML structure. Resolves: #91286 Releases: master, 9.5 Change-Id: I0bd4379633359321ad39726e4357773880c15638 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64397 Tested-by:
Christian Eßl <indy.essl@gmail.com> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
-
- May 04, 2020
-
-
Andreas Fernandez authored
This patch resets the `window.opener` for the entire TYPO3 backend and loads modules using this only in an authenticated environment. This solves an issue when `window.opener` is accessed and the login or backend were opened from a link, e.g. the password reset mail. Resolves: #91270 Resolves: #91205 Releases: master, 9.5 Change-Id: I83bdbfa7dfb80fbcd92ac4a000a6479aad22a73a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64394 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
Susanne Moog <look@susi.dev> Reviewed-by:
-
Helmut Hummel authored
Because TYPO3's DefaultConfiguration is recursively merged with settings from LocalConfiguration, it was impossible to change or remove log writers that are defined in DefaultConfiguration. One would have had to use AdditionalConfiguration for that. A simpler way to disable individual log writers is added now. It is simpler, because it allows to disable log writers directly in LocalConfiguration. To avoid misconfiguration regarding deprecation logging, E_USER_DEPRECATED is now enforced in SYS/errorHandlerErrors. E_USER_DEPRECATED needs to be enforced to avoid, that the default PHP error handler is called, which would cause these errors to be added to the output or filling up log files, depending on the global PHP configuration (php.ini). Because all other values from DefaultConfiguration.php resemble production settings and logging deprecation messages in production are not desired, the deprecation logger is now disabled by default. Last but not least, deprecation logging is now enabled/disabled in the Live and Debug presets in the install tool UI. Resolves: #84105 Resolves: #89934 Resolves: #88444 Releases: master, 9.5 Change-Id: I52a6f9c70ad13e6e0bad6a6b06b6fbfe7abc623c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/56077 Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Benjamin Franzke <bfr@qbus.de> Reviewed-by:
-
Chris Müller authored
As the class TYPO3\CMS\Dashboard\DasboardRegistry is wrong-spelled and does not exist, it is removed. Resolves: #91287 Releases: master Change-Id: I016aeb4839ed62ae7d23f011c9a87c104bb2b138 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64398 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
-
Georg Ringer authored
Improve the cache clearing label added with #88718. Resolves: #91284 Releases: master Change-Id: I8c1036af1428453a6f9cc7a801dbbf0f747011cc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64396 Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
Stefan Froemken authored
Since TYPO3 v9, PageRepository works independently from TSFE and can and should be instantiated on its own, depending on the context. This leads to multiple initializiation calls which can and should be cached, as a page with 100 links will re-trigger the properties all the time, even if they are not needed (groupWhereClause for instance). Caching these values reduces the time needed for typolink generation a lot. Resolves: #91208 Releases: master, 9.5 Change-Id: Ied7e2b78519754af2e10eeb4e9c1c9fcbbffe2e8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64321 Tested-by:
-
Oliver Bartsch authored
The ElementBrowser which is typically used for type=group, can be disabled via the `fieldControl`. This configuration is now also respected by the TableList buttons, which are also links for the ElementBrowser. Resolves: #88979 Releases: master, 9.5 Change-Id: Ib48586207480e4e61403ad6b0b694b51ee6e38c2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64076 Tested-by:
-
Oliver Hader authored
* allows custom events to bubble up in DOM tree * ensures that custom events are dispatched at those elements that initially contained the `data-event-name` attributes Resolves: #91186 Releases: master Change-Id: I0c5951a573bba0bbe73967ffcecf5dcfeae2e2f2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64311 Tested-by:
-
- May 03, 2020
-
-
Andreas Fernandez authored
IRRE relied on the HTML comment `<!--notloaded-->` to detect whether a record is already loaded or not. As this might collide with HTML minification, the comment has been replaced with a class placed in the panel. Resolves: #91258 Releases: master Change-Id: Ibe890317bdcb9707a71de1168de0d404fb3c67a4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64385 Tested-by:
Xavier Perseguers <xavier@typo3.org> Tested-by:
-
- May 02, 2020
-
-
Alexander Schnitzler authored
Releases: master Resolves: #91264 Relates: #91253 Change-Id: Ifcd89d719494c9be3f14b7b6d943d9e0eabfff82 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64383 Reviewed-by:
-
Oliver Hader authored
Resolves: #91265 Releases: master, 9.5 Change-Id: I5e413f91ae92ba666a74606767c4ecd081407f79 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64389 Tested-by:
-
Helmut Hummel authored
Resolves: #91261 Releases: master Change-Id: I8e7db92d914a8423b083c08c27c6922b1341f252 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64387 Tested-by:
Guido Schmechel <guido.schmechel@brandung.de> Reviewed-by:
-
- May 01, 2020
-
-
Andreas Fernandez authored
The InlineControlContainer tried to fetch elements via `querySelector()` previously. This fails once the selector contains a character that has a specific meaning for the whole selector, e.g. a dot. Having a selector `#foo-bar-settings.test` instructs the query selector to fetch an element matching the ID `foo-bar-settings` and the class `test`. As we handle IDs only, we can safely use `getElementById()` which doesn't have the previously mentioned implications. Resolves: #91183 Releases: master Change-Id: I63d23428ee548140f42e2c551d155ac829a2b596 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64343 Tested-by:
Raphael Zschorsch <rafu1987@gmail.com> Tested-by:
Armin Vieweg <armin@v.ieweg.de> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
Benni Mack authored
The CGL changes and the streamlining of the header comments is now cleaned up (via the php-cs-fixer rules) and are now applied to other files. This is a precursor patch to include this PHP-CS-Fixer configuration in our pre-merge checks. Resolves: #91253 Releases: master Change-Id: Icb75ddb2255eee4ae2ff457c4d09465cde73e638 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64380 Tested-by:
-
- Apr 30, 2020
-
-
Patrick Schriner authored
To prevent the necessity to duplicate logic of the datahandler tags are passed to the hook. Resolves: #91231 Releases: master, 9.5 Change-Id: I437f40d4bdb9c786eeaa46be279e22a3ebb5b90b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64344 Reviewed-by:
-
Andreas Fernandez authored
This patch fixes two flaws with the determination and loading of the first available backend module: * ModuleLoader::getModuleSetupInformation() only sets default options if the configuration array is not empty * The availability of the module is checked. If the configured module doesn't exist, the first available module is determined again. Resolves: #91210 Releases: master Change-Id: Idae8de6e0bf253754c4d44e50b15e81038e1315f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64309 Tested-by:
Daniel Siepmann <coding@daniel-siepmann.de> Tested-by:
-
- Apr 29, 2020
-
-
Oliver Hader authored
Resolves: #91229 Releases: master, 9.5 Change-Id: Ieb6211252a74983a89b7a1057574a1ebe29ae390 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64341 Tested-by:
-
- Apr 28, 2020
-
-
Daniel Goerz authored
Resolves: #91224 Releases: master Change-Id: I47d30a21965c3d2246a53c51a68856642cca647a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64339 Tested-by:
Daniel Goerz <daniel.goerz@posteo.de> Reviewed-by:
-
Benni Mack authored
Change-Id: I654ba61c86a66b41f147f32a43bba473258e4f39 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64336 Tested-by:
-
Benni Mack authored
Change-Id: I5c7f36e32298917e78f6de564fe9c19dca412015 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64335 Tested-by:
-
Oliver Bartsch authored
The TcaColumnsOverrides provider now handles overwriting of a fields default value for a specific record type. This is done by setting the value from `columnsOverrides` as the field value of the new `databaseRow` by respecting TSconfig `TCAdefaults`. Resolves: #86876 Releases: master, 9.5 Change-Id: If03871f262ed89011dbeda3f268f0b61c20036be Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64081 Tested-by:
aslam idrisov <aslambek.idrisov1@swisscom.com> Tested-by:
-
Christian Eßl authored
If a html comment is placed in a fluid template at a position, that gets parsed by lib.parseFunc_RTE and no "tags" configuration exists for the parsefunc, a php warning is thrown, because it was not checked if $conf['tags.'] is an actual array. Resolves: #91172 Related: #39261 Releases: master Change-Id: Ia51ff78d7dcda6b74e9e4d218b5345f23c04333d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64304 Reviewed-by:
-
Helmut Hummel authored
Especially to ease using the API on CLI, we now add a request argument for the siteUrl which is preferred over the current site url to create a default site configuration. Resolves: #91214 Releases: master Change-Id: If00beb2550909c2334d99a61283c6d7f546b25d7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64329 Tested-by:
-
Benjamin Franzke authored
The extbase DataMapper was changed to use constructor based dependency injection with change #87305. The argument $query (of type QueryInterface) was set to a nullable and way therefore ignored by the Extbase ObjectManager. This class is currently only used via the Extbase ObjectManager in core. It was therefore excluded from the symfony dependency injection and therefore never fataled during symfony DI container build. Symfony DI does – in contrast to extbase DI – inject nullable constructor arguments. That means: Once core or an extension starts to inject this service, injection will fail, as QueryInterface points to the Query object which is not autowirable. (see exception below) Note: While it is not supported that extensions inject this internal service, we still fix this case, because the exception is a) hard to debug und b) core may inject it in future. The service is also declarted to be a prototype (shared: false) as it may contain state, as set via `setQuery`. [1] exception thrown by symfonyduring DI compilation: Symfony\Component\DependencyInjection\Exception\RuntimeException: Cannot autowire service "TYPO3\CMS\Extbase\Persistence\Generic\Query": argument "$type" of method "__construct()" has no type-hint, you should configure its value explicitly. Releases: master Resolves: #91200 Related: #87305 Change-Id: I58b1cff94136a4170fb7e6712470069a141940b7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64319 Tested-by:Sebastian Fischer <typo3@evoweb.de> Tested-by:
Alexander Schnitzler <git@alexanderschnitzler.de> Reviewed-by:
-
Helmut Hummel authored
The check for the constant TYPO3_PATH_WEB was an experiment, to allow a document root with public assets only, but this never worked out and was never really used. The check can safely be removed, as it won't do anything useful anyway. Also adapt a comment in SystemEnvironmentBuilder which still refers to this variable/constant and its usage in the helhum/typo3-secure-web package. This statement can be removed as helhum/typo3-secure-web is not actually using that constant/envvar. Resolves: #91215 Related: #63025 Releases: master Change-Id: I1b44ba97f4654d1e4e200d7ad1a7c228dba48c25 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64330 Tested-by:
-
Helmut Hummel authored
\TYPO3\CMS\Install\Updates\DatabaseRowsUpdateWizard currently can only update rows. \TYPO3\CMS\Install\Updates\RowUpdater\WorkspaceVersionRecordsMigration however needs to delete rows and marks them as deleted. We now check for this value for tables without soft delete and delete the row straight away Resolves: #91213 Releases: master Change-Id: I21163c7db435c316231c8e25daa8c190b1507621 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64328 Tested-by:
-
Benni Mack authored
The TypoScript conditions "[backend.user.*]" are documented, but were never implemented. https://docs.typo3.org/m/typo3/reference-typoscript/master/en-us/Conditions/Index.html#backend-user This patch is now introducing the missing conditions. Resolves: #90767 Releases: master, 9.5 Change-Id: If6db277f56a2ef3457deb027a676af62a3494151 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63752 Tested-by:
Julian Mair <julian.mair94@gmail.com> Reviewed-by:
-
Benjamin Franzke authored
The existing "inline" rendering for icons causes bitmaps to be rendered for SVG-inline usage using the <image> tag. This tag can not be rendered in HTML context. The backend module menu uses inlined SVGs. Rendering bitmap icons with SVG-syntax, without an SVG root element, does not work in this context. (Note: It works in SVG trees because the optional svg container is removed by SvgTree.js and the image-tag is wrapped into a new <g> element) We do now wrap "inline" bitmap icons into an svg tag, which will fix the bitmap module case while the bitmap icons will still be embeddable into svg groups (<g>) for svg trees. Resolves: #89558 Related: #89206 Releases: master, 9.5 Change-Id: Ifaec3e697a45ba37b1ee23c0369414ce431cf4e8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64325 Tested-by:
Frank Nägler <frank.naegler@typo3.org> Reviewed-by:
-
Benjamin Franzke authored
SMTP encrypt options were quite a hassle with swiftmailer: 'tls' was used as identifier to start a STARTTLS connection via SMTP (instead of using SMTPS), while strings like ssl/tlsv1.0/tlsv1.1/tlsv1.2 instructed to use a SSL/TLS connection via SMTPS (without STARTTLS). symfony/mailer does no longer allow to specify the STARTTLS usage, as it will use it by default (if the server provides support for it). Therefore, we now adapt the SMTP encryption configuration setting via a silent configuration upgrade to avoid that the previous STARTTLS 'tls' is casted to true while symfony/mailer expects false/null. While at it, we also fix an incorrect migration for the transport type 'mail'. This wizard didn't work because of a wrong typecast (which has probably been a copy & paste mistake). Releases: master Resolves: #91070 Related: #90295 Change-Id: I7fb1112730fedbbfcdb641c8ce04e17ea925d927 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64246 Tested-by:
Björn Jacob <bjoern.jacob@tritum.de> Reviewed-by:
-
Simon Gilli authored
This will check the dependencies of dependencies during the install of an extension with the extension manager. This solves especially issues with dependent extensions having various major versions for different TYPO3 major versions e.g. ext:powermail. Resolves: #91179 Releases: master, 9.5 Change-Id: I98e6c019066aab303e78b5455ac4dfb58f78cd50 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64308 Tested-by:
-
- Apr 27, 2020
-
-
Daniel Siepmann authored
* Fix broken indentation * Add missing blank line * Fix wrong used reference target * Add missing interface to docs, which already was referenced Resolves: #91199 Releases: master Change-Id: If42021e0f7b4a0b879ba5be6bde9112b6c7e658d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64322 Tested-by:
-
Benjamin Franzke authored
We fix PackageManager and ContainerBuilder to allow multiple container instances (including multiple cache identifiers) to be live. ExtensionManager will now load a new symfony container after installing a new extension, and before reloading all ext_localconf files. We need to ensure that possible services in ext_localconf can be loaded when they depend on symfony DI. Note: This is not a BUGFIX as this was never supported for extensions. But it may lead to hard-to-debug bugs when extension developers add a service to ext localconf but do not test the re-installation procedure before publishing the extension to TER. Releases: master Resolves: #91150 Change-Id: I9b01feae6fe2f1637ca653403336cd7d216483bd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64263 Reviewed-by:
Simon Gilli <typo3@gilbertsoft.org> Reviewed-by:
-
Benni Mack authored
The newly added ContentFetcher class uses the legacy cache name "cache_runtime" which was renamed in TYPO3 v10.0 to "runtime". The change modifies the cache to "runtime". Resolves: #91188 Releases: master Change-Id: I3d6f1b61f766120f13c5fee2fac78b50adfb35b0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64313 Reviewed-by:
-
Anja Leichsenring authored
The current nightly run simply takes too long, we need to cut down the sheer number of tests we run. The current setup aims to execute a small subset of all tests on each DBMS and Php version, but in total every test is run in each composer stage at least once. Resolves: #91058 Releases: master, 9.5 Change-Id: I94fc6627f5da0cc6f36cf789ef8aa227d73d8daa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64152 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
-
Resolves: #91198 Releases: master, 9.5 Change-Id: Ibd8ec73ee4a3b38feced4fca3a8609be4b0a3757 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64317 Tested-by:
-
Stephan Großberndt authored
If caching is disabled in the CacheManager, caches using the TransientMemoryBackend are not adjusted to NullBackend anymore. This mainly affects the runtime cache, which is memory-based anyways and should be a "forget after the request"-cache. This also fixes a PDOException in the page slug update wizard when using PostgreSQL, as the Install Tool is using the core in "no-cache" mode. (See entry point of the Install Tool) Resolves: #91206 Releases: master, 9.5 Change-Id: Id9085bd85bdbf321ef210c75c2bb8aefc6f5f061 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64320 Reviewed-by:
Stephan Großberndt <stephan.grossberndt@typo3.org> Reviewed-by:
-
Georg Ringer authored
Replace the usage of `GeneralUtility::milliseconds` in Indexer class which has been deprecated with 91001. Resolves: #91192 Releases: master Change-Id: I2057ecec038195d67acab10946d4542b1fba9646 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64316 Tested-by:
-
Andreas Fernandez authored
While migrating DataTables to tablesort, the sorting for updateable or (un)installed extensions went lost. This patch adds the ability to sort these columns again. Resolves: #91182 Related: #86343 Releases: master Change-Id: Ia33c3dcc789967a984090ccf26150f6d319e85e9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64310 Tested-by:
-
