This project is mirrored from https://git.typo3.org/typo3/typo3.git.
Pull mirroring failed .
Repository mirroring has been paused due to too many failed attempts. It can be resumed by a project maintainer or owner.
Last successful update .
Repository mirroring has been paused due to too many failed attempts. It can be resumed by a project maintainer or owner.
Last successful update .
- 22 Jan, 2019 6 commits
-
-
* HtmlentitiesViewHelper * UrlencodeViewHelper * StripTagsViewHelper Resolves: #85764 Releases: master, 9.5, 8.7 Security-Commit: 37bc147e634d67d521b716f83ca8d925ec57d531 Security-Bulletin: TYPO3-CORE-SA-2019-005 Change-Id: I1d5473b20378217a68e06c792be7f1cf096859fe Reviewed-on: https://review.typo3.org/59537 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Resolves: #86455 Releases: master, 9.5 Security-Commit: 161663d336f7a6c52a87359a1d1ac01037e5c768 Security-Bulletin: TYPO3-CORE-SA-2019-004 Change-Id: Ief21fcf68f14cb756f140b4c709ddb51f447e544 Reviewed-on: https://review.typo3.org/59536 Reviewed-by:
-
When using FormEngine it is possible to create a Backend User without setting a password (or username), which could lead to issues when using third-party authentication providers. A hook within DataHandler ensures to set a random username and/or password if the data is handed into DataHandler without proper data. Besides that new backend users are disabled per default and have to be enable manually. Resolves: #80269 Releases: master, 9.5, 8.7 Security-Commit: f8a9edfed26ad48d13564ea99f27e0846671841c Security-Bulletin: TYPO3-CORE-SA-2019-002 Change-Id: Ic1d84010717e3ac056f447fd373b31bbce8f65c6 Reviewed-on: https://review.typo3.org/59535 Reviewed-by:
-
Inline JavaScript settings for RequireJS and ajaxUrls disclose the existence of specific extensions in a TYPO3 installation. In case no backend user is logged in RequireJS settings are fetched using an according endpoint, ajaxUrls (for backend AJAX routes) are limited to those that are accessible without having a user session. Resolves: #83855 Releases: master, 9.5, 8.7 Security-Commit: a9b60d26597449fec46bd26e0b511bc6e423ef24 Security-Bulletin: TYPO3-CORE-SA-2019-001 Change-Id: Ifa4029340e750baaf216fa953bf41b6d06d3138b Reviewed-on: https://review.typo3.org/59534 Reviewed-by:
-
ErrorPageController which is used by the ProductionExceptionHandler must not rely on PackageManager to be available. Rather use paths derived from Environment::getFrameworkBasePath(). Releases: master, 9.5 Resolves: #87503 Related: #87175 Change-Id: I556b503e06962b338ec11f2e031eb941417d5944 Reviewed-on: https://review.typo3.org/59507 Tested-by:
TYPO3com <noreply@typo3.com> Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
-
Resolves: #87505 Releases: master, 9.5 Change-Id: I879c4c484f8380a7270bd57c0d54a14ea7c7ad2e Reviewed-on: https://review.typo3.org/59508 Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Tymoteusz Motylewski <t.motylewski@gmail.com> Tested-by:
-
- 21 Jan, 2019 4 commits
-
-
composer update guzzlehttp/psr7 Resolves: #87512 Releases: master, 9.5, 8.7 Change-Id: Ic3dcef632fd1ac65e09f5d8fb6d631ab211e8c3e Reviewed-on: https://review.typo3.org/59517 Tested-by:
-
Since it is not obvious how to add a "Hidden" field to form definitions without the visual editor we add an element to the form definition example. Releases: master Resolves: #87449 Change-Id: I860a5a17346e405cf1f7b29ea3c6255dda1be044 Reviewed-on: https://review.typo3.org/59447 Reviewed-by:
Josef Glatz <josef.glatz@typo3.org> Tested-by:
Daniel Goerz <daniel.goerz@posteo.de> Tested-by:
Björn Jacob <bjoern.jacob@tritum.de> Tested-by:
Mathias Brodala <mbrodala@pagemachine.de> Tested-by:
-
Since #86422 the configuration of a site is available with TypoScript. As the identifier itself is not part of the configuration, it can't be retrieved. Now "site:identifier" will retrieve the identifier as well. Resolves: #87434 Releases: master, 9.5 Change-Id: Ic5a60e8a033c8fbc45baa19ad6a3fe81ff3b6e0b Reviewed-on: https://review.typo3.org/59506 Tested-by:
Riny van Tiggelen <info@online-gamer.nl> Tested-by:
-
Bootstrap::createCache() uses Typo3DatabaseBackend::class as fallback if no cache backend is configured explicitly. In that case incorrect class name 'Typo3DatabaseBackend' would be used without the `use` statement. Releases: master Resolves: #87504 Change-Id: I6abd1024d79fb7dad194ab32ae79d0658654c4a5 Reviewed-on: https://review.typo3.org/59509 Tested-by:
-
- 20 Jan, 2019 3 commits
-
-
This is the last round of planned extension extractions from the main core repository. Both the extensions 'taskcenter' and its add-on extension 'sys_action' did not receive much love over the years. They are rarely used and their approach is clumsy to say the least. They are both dropped from main core repository with core v10 now. A fresh approach for a cool new dashboard is in the works already that may eventually find its way into the core later. The patch removes both extensions with have been released as 'taskcenter' and 'sys_action' to TER and as 'friendsoftypo3/taskcenter' and 'friendsoftypo3/sys_action' to composer. Extension 'impexp' registered a task for the taskcenter which is now within 'taskcenter' directly. Resolves: #87499 Releases: master Change-Id: I86e0292f13247bbd1f2060214f4f6d8e2aefe6c0 Reviewed-on: https://review.typo3.org/59502 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Looking back, extension feedit had a hard life: While so many parts in the core improved so much over the years, it never received any similar love. There have already been multiple attempts to rewrite a frontend editing approach for TYPO3, for instance with core 4.5 as the feedit_advanced extension that quickly died. There is another editing approach as extension frontend_editing in the works that may eventually end up being integrated in the core again. feedit itself however is so sparse, outdated and not well working that we now go ahead and drop that extension from the core, extracting it to github.com/friendsoftypo3. Maybe some enthusiasts pick the development up again and make the extension shine and healthy again, without boundaries of core development. The patch removes the extension from the core repository, including some feedit specific code in adminpanel that has already been merged into the friendsoftypo3 feedit repository and released as v10.0.0. The extension is available as friendsoftypo3/feedit via composer and as name 'feedit' via TER. An upgrade wizard is in place to fetch it for those who want to use it. Resolves: #87498 Releases: master Change-Id: I11a0e91830b47f88fcea9a15459be37bc6dbd3de Reviewed-on: https://review.typo3.org/59501 Tested-by:
-
There is a test related check for the extension scanner to verify all referenced ReST files actually exist. It is active as part of the 'integrity' job in bamboo. The patch adds a variable to suppress checking the same ReST file name multiple times if it is referenced in many matchers. In practice, this speeds up the scanning process drastically, on my local machine with current master from more than a minute to less than ten seconds. Resolves: #87493 Releases: master, 9.5 Change-Id: Iaa19add06ad9eeda9d36e3e204c1a671368b5f29 Reviewed-on: https://review.typo3.org/59495 Reviewed-by:
-
- 19 Jan, 2019 3 commits
-
-
Change backslash to slash in file format, where backslash is not visible in rendered HTML - it is a file path, not a PHP namespace. Releases: master, 9.5 Resolves: #87495 Change-Id: If749a3cb1faaf9b25e05db7c1c3cbf7a38d0eafc Reviewed-on: https://review.typo3.org/59498 Tested-by:
-
Adopt wrong spelling in deprecation Changelog which is rendered in documentation and extension scanner Resolves: #87494 Releases: master, 9.5 Change-Id: I4ebea1d5f263762be61b16104b14f66655ddcd4f Reviewed-on: https://review.typo3.org/59496 Tested-by:
Alexander Stehlik <alexander.stehlik@gmail.com> Tested-by:
-
Change backslash to slash in file format, where backslash is not visible in rendered HTML - it is a file path, not a PHP namespace. Releases: master, 9.5 Resolves: #87492 Change-Id: I5a26eed78ba49b0c32cc5bfef95f9f587635053c Reviewed-on: https://review.typo3.org/59493 Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
-
- 18 Jan, 2019 15 commits
-
-
The patch pics various smaller places to drop their deprecated code snippets. Additionally some comments are changed slightly to better hint on what needs to be done later in v11. Resolves: #87476 Releases: master Change-Id: Ib7fe5e4ca29b1c41dd02806e25484e99ef9a41ba Reviewed-on: https://review.typo3.org/59475 Reviewed-by:
-
Extension rsaauth that has been marked deprecated in v9 due to its flaws and is dropped from core v10 with this patch. People who still think not using https but using the rsaauth extension approach is a good idea can fetch the extension from ter using an upgrade wizard or composer require friendsoftypo3/rsaauth. Needs a typo3/testing-framework raise since the acceptance tests still used loginSecurityLevel rsa: composer require --dev typo3/testing-framework ~5.0.4 Resolves: #87470 Releases: master Change-Id: Iefdd1c4e4b8725e0968875d4b8cb68103634783c Reviewed-on: https://review.typo3.org/59470 Reviewed-by:
-
Resolves: #87482 Releases: master Change-Id: Id644857a9090ab98efaa4a6bf36ee2ec37e169b0 Reviewed-on: https://review.typo3.org/59482 Reviewed-by:
-
Passwords prefixed with M$ in fe_user or be_user table are passwords that have been previously stored as simple md5 and have been converted to salted md5 using the saltedpasswords converter task. That task has been removed in v9 already and affected only users who did not log in for ages (multiple core versions), since otherwise their password would have been upgraded already. The patch now finally drops the handling of M$ prefixed passwords. If there are still users like that, they have to have their password reset by and editor or admin user. Resolves: #87489 Releases: master Change-Id: I2d98476e91dd40c60a1084f9b05cf4ce7b9c5829 Reviewed-on: https://review.typo3.org/59487 Tested-by:
-
Since the release of fluid 2.6.0 unit tests fail due to changed calling sequence. The unit tests use mocked calls to keep track of internal sequence. Using the prophecy mock framework gives better control and fixes the issue for now. Resolves: #87474 Releases: master, 9.5 Change-Id: I371ae8c7793ae74ecc827696cbbb97c30b3862f8 Reviewed-on: https://review.typo3.org/59474 Tested-by:
-
Resolves: #87480 Releases: master Change-Id: I9fcb2a9ace87d12f96c8ff3463358349b57841bd Reviewed-on: https://review.typo3.org/59480 Tested-by:
Wouter Wolters <typo3@wouterwolters.nl> Tested-by:
-
Resolves: #87479 Releases: master Change-Id: Icd23eb06690ff775ba0aff516e01553fd2f6271e Reviewed-on: https://review.typo3.org/59477 Tested-by:
-
Resolves: #87481 Releases: master Change-Id: I9d1fa4db56c2a7fe93a1d5e6a68fb7d42f623d63 Reviewed-on: https://review.typo3.org/59481 Tested-by:
-
Method addArguments() of Route class is marked as '@deprecated Probably not required'. It looks like a left over from the routing development. The method is indeed unused and can be dropped without further notice from this @internal marked class. Change-Id: Iefaec031003b55571c5d2f0f658fed9b25132cbb Resolves: #87488 Releases: master. Reviewed-on: https://review.typo3.org/59486 Tested-by:
-
There are four @deprecated annotations in extbase query / persistence area that have been marked as such in v6 and never removed. Those methods are still used in extbase and needed. Remove the deprecation notes for these methods. Resolves: #87485 Releases: master Change-Id: If47487792124909e736583819640133a135e090e Reviewed-on: https://review.typo3.org/59483 Tested-by:
-
There is an "Deprecated stuff" comment in TypoScriptFrontendController that is there since before 4.5 times. The code below is clearly needed. Drop that comment. Resolves: #87486 Releases: master Change-Id: Ie0362742c4e1eac2ba3160dece9ee128347106d7 Reviewed-on: https://review.typo3.org/59484 Tested-by:
-
Some methods in BasicFileUtility have been marked as deprecated for various versions already but never removed since they are still used within core. Switch these to @internal to give core freedom to remove these at will. Resolves: #87487 Releases: master Change-Id: I837dfbbfdc7069dd89f86133c75ad9b0fd45e046 Reviewed-on: https://review.typo3.org/59485 Tested-by:
-
ext_tables.php, ext_localconf.php and all Configuration/TCA/*.php do not have global scope anymore. Thus, it is necessary to use $GLOBALS['TYPO3_CONF_VARS'] instead of $TYPO3_CONF_VARS Also, $_EXTKEY and $_EXTCONF are gone in these files. Resolves: #87483 Releases: master Change-Id: I2c33c696151ace8596cbc9a59a43ef188de26b9c Reviewed-on: https://review.typo3.org/59300 Reviewed-by:
-
Resolves: #87477 Releases: master Change-Id: I0bffc072667c736195e002e4b3811055334cb633 Reviewed-on: https://review.typo3.org/59476 Tested-by:
-
nvm (node version manager) is a tool to have multiple node versions installed. Since TYPO3 relies on an older node version right now, we can provide support for nvm by adding a .nvmrc file. This still requires to have nvm installed and configured on the client. Resolves: #87468 Releases: master, 9.5, 8.7 Change-Id: Ie16827594fbdebeff1004cd178c28c67a61d60d7 Reviewed-on: https://review.typo3.org/59466 Reviewed-by:
-
- 17 Jan, 2019 9 commits
-
-
In order to harden CommandUtility API arguments used for invoking system commands are escaped in addition. Since no insecure usages have been identified in the TYPO3 core nor in public third party extensions, this change is handled using a public workflow. | In order to evaluate whether third party extensions open a | potential attack vector, usages of CommandUtility::checkCommand(), | CommandUtility::getCommand() and the registration of custom services | ($GLOBALS[‘T3_SERVICES’]) concerning their ‘exec’ argument have to | be checked. Resolves: #87450 Releases: master, 9.5, 8.7 Security-Advisory: TYPO3-PSA-2019-001 Change-Id: If4f2a63045ac7b2473881992f9731a635a768d37 Reviewed-on: https://review.typo3.org/59448 Tested-by:
Frank Naegler <frank.naegler@typo3.org> Tested-by:
-
Resolves: #87466 Releases: master Change-Id: Ia6e4dc9441b559c2e6dbeaa6276cd03bee12d13a Reviewed-on: https://review.typo3.org/59462 Tested-by:
-
When translations and (sub-)pages are present at the same time the 'page' id-attribute will be rendered twice. This ensures that translations and (sub-)pages are independently collapsible. Resolves: #87465 Releases: master, 9.5 Change-Id: I0fd6a8323d89b34ecda0be7fb005fe64adb05928 Reviewed-on: https://review.typo3.org/59465 Reviewed-by:
-
Resolves: #87460 Releases: master Change-Id: Ib4df7ffc1e1b67ae1fcb7e5f68ccc4b89ac2baeb Reviewed-on: https://review.typo3.org/59457 Tested-by:
-
Resolves: #87467 Releases: master Change-Id: I51e3b25545ffe6e3789524980f06920b11f80437 Reviewed-on: https://review.typo3.org/59463 Tested-by:
-
Fix code example for 'slug' TCA type according to this https://docs.typo3.org/typo3cms/TCAReference/ColumnsConfig/Type/Slug.html Releases: master, 9.5 Resolves: #87456 Change-Id: Ica3ebe037623ddc1fb679e362e041eca6e662b49 Reviewed-on: https://review.typo3.org/59455 Reviewed-by:
Sybille Peters <sypets@gmx.de>
Tested-by: Sybille Peters <sypets@gmx.de>
Reviewed-by: -
Resolves: #87459 Releases: master Change-Id: Iae4bd1efc937b225437d49857674276e18d5422c Reviewed-on: https://review.typo3.org/59456 Tested-by:
-
Resolves: #87463 Releases: master Change-Id: I48cce7cea659036e58c1119fee4b4737df67ffbe Reviewed-on: https://review.typo3.org/59460 Tested-by:
-
The old install tool entry point "typo3/install/index.php" which was deprecated is removed now. The entry point "typo3/install.php" is still available to access the install tool in its standalone version. Resolves: #87461 Releases: master Change-Id: I545bfe7f02449c94464cf024f951ea36a584fcf7 Reviewed-on: https://review.typo3.org/59458 Reviewed-by:
-
