Skip to content
Snippets Groups Projects
  1. Mar 06, 2020
  2. Mar 05, 2020
  3. Mar 04, 2020
  4. Mar 03, 2020
  5. Feb 25, 2020
  6. Feb 24, 2020
  7. Feb 19, 2020
  8. Feb 15, 2020
  9. Feb 14, 2020
  10. Feb 13, 2020
    • Benni Mack's avatar
      [FEATURE] Implement SameSite option for TYPO3 cookies · de29dc2d
      Benni Mack authored
      This change introduces a new security option for setting the SameSite
      option to all cookies sent by TYPO3 Core.
      
      Namely:
      - Frontend User Sessions ("lax" by default)
      - Backend User Sessions ("strict" by default)
      - Install Tool Sessions ("strict", none-configurable)
      - Last Login Provider in Backend ("strict", non-configurable)
      
      This means that these can only be accessed by scripts and requests
      by the same site, and not by any third-party scripts.
      
      Since we're talking about actual cookies for a user, and not
      ads-related or third-party login-dependant cookies, the default
      options fit just perfectly.
      
      All modern browsers except Internet Explorer respect this option
      to be set. Please note that Firefox and Chrome will have "SameSite=lax"
      set in Q1/2020 by default if NO SameSite option is set at all. This change
      allows to configure this.
      
      Backend and Frontend User Cookies can be configured to "strict", "lax"
      or "none" (= same as before), whereas "none" only works for secure
      connections (= HTTPS).
      
      If "strict" is in place, security via CSRF is not needed anymore, and can
      be dropped in the future.
      
      Resolves: #90351
      Releases: master, 9.5, 8.7
      Change-Id: I8095e2a552faa9d1fd4fa7855297302a9ec6a75f
      Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/63183
      
      
      Tested-by: default avatarAnja Leichsenring <aleichsenring@ab-softlab.de>
      Tested-by: default avatarTYPO3com <noreply@typo3.com>
      Tested-by: default avatarGeorg Ringer <georg.ringer@gmail.com>
      Reviewed-by: default avatarAnja Leichsenring <aleichsenring@ab-softlab.de>
      Reviewed-by: default avatarGeorg Ringer <georg.ringer@gmail.com>
      de29dc2d
  11. Feb 12, 2020
  12. Feb 03, 2020
  13. Feb 02, 2020
  14. Jan 22, 2020
  15. Jan 17, 2020
  16. Jan 16, 2020
  17. Dec 20, 2019
  18. Dec 19, 2019
  19. Dec 13, 2019
  20. Dec 10, 2019
  21. Dec 03, 2019
  22. Dec 02, 2019
  23. Nov 29, 2019
  24. Nov 27, 2019
  25. Nov 26, 2019
  26. Nov 22, 2019
  27. Nov 21, 2019
    • Benni Mack's avatar
      [TASK] Raise testing framework to version 5.0.16 · 5cf5eeb8
      Benni Mack authored
      The next version has PHP 7.4 support and was
      cleaned up a lot.
      
      Used composer command:
          composer req typo3/testing-framework:~5.0.16 \
              --update-with-all-dependencies --dev
      
      Resolves: #89725
      Releases: master
      Change-Id: Iba181feb693c9ee61b8792cd0d0197c1e3b1f59a
      Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62359
      
      
      Tested-by: default avatarTYPO3com <noreply@typo3.com>
      Tested-by: default avatarBenni Mack <benni@typo3.org>
      Reviewed-by: default avatarBenni Mack <benni@typo3.org>
      5cf5eeb8
    • Benni Mack's avatar
      [TASK] Update symfony dependencies to 4.4 or 5.0 · f20a7aae
      Benni Mack authored
      TYPO3 Core v10 should rely on Symfony 4.4 (LTS release)
      and add support for 5.0 automatically.
      
      Symfony 4.4 made breaking changes to the Mailer and Mime components
      which now need adaptions.
      
      Used composer command:
      
      composer req "symfony/config":"^4.4 || ^5.0" \
      "symfony/console":"^4.4 || ^5.0" \
      "symfony/dependency-injection":"^4.4 || ^5.0" \
      "symfony/expression-language":"^4.4 || ^5.0" \
      "symfony/finder":"^4.4 || ^5.0" \
      "symfony/mailer":"^4.4 || ^5.0" \
      "symfony/mime":"^4.4 || ^5.0" \
      "symfony/property-access":"^4.4 || ^5.0" \
      "symfony/property-info":"^4.4 || ^5.0" \
      "symfony/routing":"^4.4 || ^5.0" \
      "symfony/yaml":"^4.4 || ^5.0" --update-with-all-dependencies
      
      Loading composer repositories with package information
      Updating dependencies (including require-dev)
      Package operations: 0 installs, 27 updates, 0 removals
        - Updating symfony/polyfill-ctype (v1.11.0 => v1.12.0)
        - Updating symfony/filesystem (v4.3.1 => v4.4.0)
        - Updating symfony/config (v4.3.2 => v4.4.0)
        - Updating symfony/service-contracts (v1.1.2 => v1.1.8)
        - Updating symfony/polyfill-php73 (v1.11.0 => v1.12.0)
        - Updating symfony/polyfill-mbstring (v1.11.0 => v1.12.0)
        - Updating symfony/console (v4.3.1 => v4.4.0)
        - Updating symfony/dependency-injection (v4.3.2 => v4.4.0)
        - Updating symfony/var-exporter (v4.3.1 => v4.4.0)
        - Updating symfony/cache-contracts (v1.1.1 => v1.1.7)
        - Updating psr/log (1.0.2 => 1.1.2)
        - Updating symfony/cache (v4.3.1 => v4.4.0)
        - Updating symfony/expression-language (v4.3.1 => v4.4.0)
        - Updating symfony/finder (v4.3.3 => v4.4.0)
        - Updating symfony/polyfill-php72 (v1.11.0 => v1.12.0)
        - Updating symfony/polyfill-intl-idn (v1.11.0 => v1.12.0)
        - Updating symfony/mime (v4.3.2 => v4.4.0)
        - Updating symfony/event-dispatcher-contracts (v1.1.1 => v1.1.7)
        - Updating symfony/event-dispatcher (v4.3.1 => v4.4.0)
        - Updating doctrine/lexer (v1.0.1 => 1.2.0)
        - Updating egulias/email-validator (2.1.9 => 2.1.11)
        - Updating symfony/mailer (v4.3.2 => v4.4.0)
        - Updating symfony/inflector (v4.3.1 => v4.4.0)
        - Updating symfony/property-access (v4.3.1 => v4.4.0)
        - Updating symfony/property-info (v4.3.1 => v4.4.0)
        - Updating symfony/routing (v4.3.1 => v4.4.0)
        - Updating symfony/yaml (v4.3.1 => v4.4.0)
      
      Resolves: #89721
      Releases: master
      Change-Id: I834a79e3880b3a7a95429c2fe052657e21599ec7
      Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62354
      
      
      Tested-by: default avatarTYPO3com <noreply@typo3.com>
      Tested-by: default avatarAnja Leichsenring <aleichsenring@ab-softlab.de>
      Tested-by: default avatarSusanne Moog <look@susi.dev>
      Tested-by: default avatarBenni Mack <benni@typo3.org>
      Reviewed-by: default avatarAnja Leichsenring <aleichsenring@ab-softlab.de>
      Reviewed-by: default avatarSusanne Moog <look@susi.dev>
      Reviewed-by: default avatarBenni Mack <benni@typo3.org>
      f20a7aae
  28. Nov 19, 2019
  29. Nov 14, 2019
  30. Nov 09, 2019
  31. Nov 08, 2019
  32. Nov 07, 2019
  33. Oct 30, 2019
  34. Oct 23, 2019
  35. Oct 18, 2019