This project is mirrored from https://git.typo3.org/typo3/typo3.git.
Pull mirroring failed .
Repository mirroring has been paused due to too many failed attempts. It can be resumed by a project maintainer.
Last successful update .
Repository mirroring has been paused due to too many failed attempts. It can be resumed by a project maintainer.
Last successful update .
- 28 Jul, 2021 4 commits
-
-
Christian Kuhn authored
Similar to styleguide's backend TCA data generator, the extension can now generate a demo frontend to render a page tree with menu having examples of the default core content elements and demos for ext:felogin and ext:form. The generator is accessible through the existing backend styleguide module below the '?' help button in the toolbar. The FE data will be used for core acceptance tests soon. The raise also brings a minor TCA change for a pending core regression patch. composer req --dev typo3/cms-styleguide:~11.4.0 composer req --dev typo3/cms-styleguide:~11.4.0 -d typo3/sysext/core --no-update Change-Id: Ie1ef73400cda2b82c6379401341e69ff9e78645e Resolves: #94658 Related: #94621 Releases: master Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70124 Tested-by:
core-ci <typo3@b13.com>
Tested-by: 
Jochen <rothjochen@gmail.com>
Tested-by: Nikita Hovratov <nikita.h@live.de> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Jochen <rothjochen@gmail.com>
Reviewed-by: -
Show in runTests -h command how to execute one specific acceptance test. The syntax in codeception is a bit different than in phpunit. Resolves: #94644 Releases: master Change-Id: I681be04ff92f6682c2226df8fb4797bf16bcc647 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70113 Tested-by:
core-ci <typo3@b13.com>
Tested-by: -
Since TYPO3 uses the \PDO::FETCH_ASSOC fetch mode by default, fetchAll() is the equivalent for fetchAllAssociative() which is the new API for Doctrine 3. In order to move towards the new Doctrine DBAL 3.x API, this change migrates all fetchAll() calls to fetchAllAssociative() or fetchFirstColumn(). Resolves: #94618 Releases: master Change-Id: I2ab4db871d0b65ad07e629b54bb79b1c3b411005 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70016 Tested-by:
core-ci <typo3@b13.com>
Tested-by: 
Oliver Bartsch <bo@cedev.de>
Tested-by: Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
Reviewed-by: -
Due to several modules initializing tooltips, it might happen that they are initializing the same element twice or even more times. This can be easily avoided by using the new bootstrap Tooltip method "getOrCreateInstance". This should fix weird behaviour, where the tooltip did not disappear. Also, since updating to a newer bootstrap version the fix 0005bc5b did not work anymore. This is fixed by using the container context as selector basis. Resolves: #94477 Releases: master Change-Id: Iea67db7fe63825f2eba028302d435cf7e2c8e7b8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70119 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Benni Mack <benni@typo3.org> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
Reviewed-by:
-
- 27 Jul, 2021 4 commits
-
-
This change * Streamlines Controller Code * Avoids unneeded Fluid assigns * Uses strict typing Resolves: #94604 Releases: master Change-Id: I91035f9c70e4df80c443e3a45f044f10c28fdb27 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69722 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: -
To further streamline the usage of the IconRegistry, the reports registration array now allows to define an icon identifier. Absolute paths and paths with "EXT:" prefix are still possible. Further improvements: The IconViewHelper of the reports extension has been dropped. It had the same functionality as a normal ImageViewHelper with the addition of a fallback icon. This logic has been moved to the controller action. Some minor code refactoring and template cleanup while at it. Resolves: #94588 Resolves: #94590 Releases: master Change-Id: I901b8a0c56f26459c609a36a59c67b341c6b4168 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69965 Tested-by:
core-ci <typo3@b13.com>
Tested-by: -
Oliver Bartsch authored#94612 introduced the realpath command for retrieving the "CORE_ROOT" path. This however leads to execution failures on MacOS systems, which did not manually install this command (as it's not installed by default). To prevent the script from failing on default MacOS systems, a check for the existence of the realpath command is added. If not installed, the previous behaviour is used while displaying a short information. Resolves: #94635 Related: #94612 Releases: master, 10.4, 9.5 Change-Id: I30792f1e5492b57adf7ff28a7fa2c415ac2e094c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70068 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Jochen <rothjochen@gmail.com>
Reviewed-by: Oliver Bartsch <bo@cedev.de> -
The indexed_search queries to "index_config" do not need to have the FrontendRestrictionContainer as the default restriction container is enough to check for. This change was introduced back then when building Doctrine DBAL into Core. Resolves: #94593 Releases: master Change-Id: I2d8c111028591b31af57b2a366e3cfb05311c447 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69977 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Wouter Wolters <typo3@wouterwolters.nl> Tested-by:
-
- 26 Jul, 2021 5 commits
-
-
In case substr returns false $siteUrl is now casted to string and covered by an additional unit test. Resolves: #94624 Releases: master Change-Id: Id778319104d107c329a2ee8f947571a87e3c401d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70059 Tested-by:
Oliver Bartsch <bo@cedev.de>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
Helmut Hummel authored
Several benefits come (basically for free) with this change. 1. We only maintain platform dependencies in composer.json 2. Advanced users can omit the runtime check from being generated 3. Relying on canonical functionality instead of our own For this to work, Composer 2.0 must be required not only for development, but also for any production install of the packages. With doing so, eventually other runtime functionality like installed package versions can be used as well. composer req composer-runtime-api:^2.0 This also remove the upper version check for PHP <9 because Composer runtime API does not provide upper bound checks, to allow future compatiblity of software installs, in case it isn't updated any more, but would run with later PHP versions. Upper PHP version check and failing with an appropriate error message is useful for cases when users accidentally use a PHP version higher than TYPO3 is capable of running on. However not only isn't there a PHP version 9 on the horizon, it isn't even remotely clear, whether this PHP version would have a compatiblity impact on TYPO3. Therefore an upper version check at this point in time provides zero value and can be safely omitted. Besides that, also from a maintainer perspective it will be much easier to check the impact on PHP 9 release candidates, because tests could be run automatically against this version, without modifying the code, so that compatiblity with this future PHP version can be provided ahead of time, making the upper bound check obsolete as well. Resolves: #93257 Releases: master Change-Id: I55c0c17088f222736afa99d929fe8646a483a5ee Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/67371 Tested-by:
core-ci <typo3@b13.com>
Tested-by: 
Simon Gilli <typo3@gilbertsoft.org>
Tested-by: Helmut Hummel <typo3@helhum.io> Reviewed-by:
Xavier Perseguers <xavier@typo3.org> Reviewed-by:
Markus Klein <markus.klein@typo3.org> Reviewed-by:
Mathias Brodala <mbrodala@pagemachine.de> Reviewed-by:
Simon Gilli <typo3@gilbertsoft.org>
Reviewed-by: -
Benni Mack authored
The GitHub main repository has been renamed from "TYPO3/TYPO3.CMS" to "typo3/typo3". The new URL is https://github.com/typo3/typo3 This change reflects all places in TYPO3 Core to adapt to this renaming. Resolves: #94639 Releases: master, 10.4, 9.5 Change-Id: Ia5c3136a48b8b4580283277da4b7b11768c32132 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70092 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Susanne Moog <look@susi.dev> Tested-by:
-
Fix PHP8 undefined array key in indexed_search when typoscript configuration is not included. Resolves: #94631 Releases: master Change-Id: If068c5a1b5bc0d1962b922312adf2bf2efc05e50 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70064 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
Oliver Bartsch <bo@cedev.de>
Reviewed-by: Oliver Bartsch <bo@cedev.de> -
Oliver Bartsch authored
This fixes inconsistency in the display of the grid columns between the fluid based page module and PageLayoutView. * Proper distinction between unassigned and unused columns * State describing classes, such as "restricted" and "hidden" are now added correctly * Access restricted columns do not longer display elements previously added to this column * Column titles are now correct * TSconfig option "hideRestrictedCols" is respected * TSconfig option "colPosList" does now work correctly * All used labels are now translatable * No more cross dependencies for labels Resolves: #94602 Related: #93829 Related: #93313 Releases: master Change-Id: I1d1e641722d57657169e16e92ddd501aab04bc72 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70013 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Jochen <rothjochen@gmail.com>
Reviewed-by: Oliver Bartsch <bo@cedev.de>
-
- 25 Jul, 2021 1 commit
-
-
Smaller images must not be blown up in visual size if smaller than 400x590px. Resolves: #94475 Releases: master, 10.4 Change-Id: I8ef7e084a55d41778d6a71ff50cdc3125bcb176f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69909 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Guido Schmechel <guido.schmechel@brandung.de> Tested-by:
Daniel Haupt <mail@danielhaupt.de> Tested-by:
-
- 23 Jul, 2021 2 commits
-
-
Christian Kuhn authored
With all non-legacy usages of ObjectManager being gone, this final patch adds a series of @deprecation annotations throughout the core, adapts some comments, and finally adds a trigger_error() to ObjectManager->get(). Resolves: #94619 Related: #90803 Releases: master Change-Id: Iaa65f7dee4e5aa9eb4e2c217e76105b0263dc6dc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70054 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Jochen <rothjochen@gmail.com>
Reviewed-by: -
Fix undefined array keys in form, core and indexed_search for the frontend and in extensionmanager. Resolves: #94613 Releases: master Change-Id: I96230feb46f33c9a606a72f765bc79e19d8b28dd Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70024 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by:
-
- 22 Jul, 2021 13 commits
-
-
The reset link, sent in the plain text version of the PasswordReset functionality is not longer be encoded as this makes the link unusable. Resolves: #94589 Releases: master, 10.4 Change-Id: Ie464140bb68f5ac703540d1eba094f19cf2ee299 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69967 Tested-by:
core-ci <typo3@b13.com>
Tested-by: -
When using CKEditor with autolinking plugin enabled (e.g. simply typing www.typo3.org in the RTE) https:// is now used by default when a link is generated. This change reflects the "secure-first" approach by using https:// by default, however users can still manually change this to http://. More than 90% of the web now serve via HTTPS (also see https://transparencyreport.google.com/https) Resolves: #90336 Releases: master Change-Id: I38e4034915f66fd1f169bc96f27026a6427de156 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69923 Tested-by:
Oliver Bartsch <bo@cedev.de>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: -
When using an array as data for a log entry placeholder, it must be imploded as otherwise the placeholder would not be resolved by AbstractWriter->interpolate(). Additionally, the exception is now correctly added to the log message string in PhpErrorLogWriter again. Resolves: #94594 Related: #94315 Releases: master Change-Id: I0aa79e511fd164a75e974547057477479234c25b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69978 Tested-by:
core-ci <typo3@b13.com>
Tested-by: -
docker-compose.yml is now working with v2.0.0beta. Restored old behavior to retrieve the actual CORE_ROOT path using "realpath" which also works on MacOS. Resolves: #94612 Releases: master, 10.4, 9.5 Change-Id: I62ab40870e285b3533a259105dac241e3c4a6af2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70023 Tested-by:
core-ci <typo3@b13.com>
Tested-by: -
Since #57082 the language columns, typically `sys_language_uid`, are defined with the new TCA type "language" instead of type "select". Since this was previously not properly handled, BackendUtility::getProcessedValue() just returned the records' field value instead of the language title. This is now fixed by adding an additional "case" for TCA type "language". Resolves: #94610 Releases: master Change-Id: I89297e679393cb8eb0765a51fb6a7eebc4e12f7c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70022 Tested-by:
core-ci <typo3@b13.com>
Tested-by: -
Christian Kuhn authored
This finishes removal of regular extbase ObjectManager usages throughout the core: All left over places are fallback situations if extensions don't provide proper service definitions. Most places are casual replacements, many of them have been prepared with previous patches. Some places like Query and QueryResult still need special handling: The patch introduces some 'ForwardCompatible' interfaces implemented by core to otherwise OM-fallback if extensions didn't catch up yet. This avoids expensive runtime reflection in potentially often-called areas. When this patch is merged, a final patch can be done, including a ReST with some dedicated transition tips and the ultimate ObjectManager deprecation. Resolves: #94451 Related: #90803 Related: #92238 Releases: master Change-Id: Ic53f3bf6a04d15052680a953c76d19182a2e5e87 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69676 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Jochen <rothjochen@gmail.com>
Reviewed-by: -
Christian Kuhn authored
To further clean up ext:beuser and allow more refactoring of the extension, the BackendUser model no longer extends the ext:extbase base BackendUser model. The patch is a straight merge of the lower class for now and further patches will follow. Resolves: #94614 Releases: master Change-Id: I79978cdae8538ce04b15bc703ad0eefc415f6d27 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70025 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Jochen <rothjochen@gmail.com>
Reviewed-by: -
Christian Kuhn authored
When no scheme is given using f:uri.external or f:link.external fluid view helpers, they now fall back to https instead of http. Resolves: #94615 Releases: master Change-Id: I33ce251d4f38cd504d163dd91f70fbe753952f2d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70026 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Jochen <rothjochen@gmail.com>
Reviewed-by: -
Christian Kuhn authored
The class logs a deprecation in __construct(), but the @deprecated annotation is missing. Unit and functional tests of QueryGenerator are moved now and a PHP8 related patch that has been done to core QueryGenerator is now merged into lowlevel QueryGenerator, too. Resolves: #94587 Related: #92129 Releases: master Change-Id: Ibb59c6bf576c6589a1cbb654ebd4773065b3e8c2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69962 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Jochen <rothjochen@gmail.com>
Reviewed-by: -
This change replaces all query results from the database from fetchColumn() to fetchOne(), as this is the new API used in Doctrine DBAL. This change is one of a few to prepare for Doctrine DBAL 3.0 compatibility. Resolves: #94605 Releases: master Change-Id: Ia9ca2bbb7b2c16a230c5946941cc3023203f494d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69917 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Oliver Bartsch <bo@cedev.de> -
Issue #92815 introduced a regression which triggered an endless recursion in case of a validation error. A bit longer explanation: Given there is an extbase controller action with an argument whose properties have to validated, extbase maps the incoming data of the request onto the internally handled arguments object which then performs the validation on all given arguments. In case of an error, extbase tries to redirect to the referring request aka the current request with an updated set of arguments. The idea is to remove all arguments of the current request to not trigger the same validation error again on the next try. There was a condition in the past which eventually led to the overriding of current arguments which was refactored wrong. The solution is to make the arguments of the ForwardResponse null by default and have the same null check like before. Releases: master Resolves: #94457 Change-Id: I1701001ce0cf55df79b2ed896d69a08659a2902b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70020 Tested-by:
core-ci <typo3@b13.com>
Tested-by: waldhacker <hello@waldhacker.dev> Tested-by:
Oliver Bartsch <bo@cedev.de>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: -
Fix a PHP Warning on custom auth services that have no service subtype "processLoginDataBE". Resolves: #94599 Releases: master Change-Id: I5046236b659674cebc761861ccf668c9bb226dc5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70012 Tested-by:
core-ci <typo3@b13.com>
Tested-by: -
A rather obvious TCA access scenario. Resolves: #94611 Releases: master Change-Id: Ie4ac8c7d1978e89de28076e0d036db1930c51149 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70021 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Jochen <rothjochen@gmail.com>
Reviewed-by: Oliver Bartsch <bo@cedev.de>
-
- 21 Jul, 2021 5 commits
-
-
The "Manage Language Packs" modal now displays the inactive languages correct. This was previously overridden by bootstraps "table-striped" functionality. Resolves: #94584 Releases: master Change-Id: Ib464d9daaea8156fd9f80dca96fe50bee3f61992 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69966 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Jochen <rothjochen@gmail.com>
Reviewed-by: -
Christian Kuhn authored
Legacy Extbase ObjectManager has a symfony DI compiler pass that registers all DI registered "Foo"Interface aliases via registerImplementation in Extbase container, too. This however only works if the target is a class. The Psr/Container/ContainerInterface is a magic 'service_container' alias, though. In turn, ObjectManager fails to inject Psr/Container/ContainerInterface. The patch adds this interface explicitly and adds a functional test to make sure it works. We target that patch to both v11 and v10 to simplify the transition from ObjectManager to symfony based DI. Resolves: #94608 Related: #90803 Related: #94453 Releases: master, 10.4 Change-Id: I282240548d8d8c571314dd433653dc30d1e0dad4 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/70017 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Jochen <rothjochen@gmail.com>
Reviewed-by: -
This change fixes a variable error to use "activeFolder" instead of "selectedFolder". Resolves: #94579 Releases: master Change-Id: I855c89a51f080136f713c1df035e5882fe652910 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69918 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: -
Resolves: #94573 Releases: master, 10.4 Change-Id: I62c96e78accb7a10b0da384bdd9d92a1ecab58c1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69911 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Lina Wolf <112@linawolf.de> Reviewed-by:
-
Since #93892, clearing the search field did not longer submit the form. This is now fixed by adding a dedicated JS module, listening on the browsers "search" event. When using the search in the Record selector, the search options dropdown is now not longer cut off, in case no search results are present. Additionally, the functionality to toggle the search field in the recordlist module is now moved into the Recordlist JS module, as it does not belong to EXT:backend and furthermore does not require a dedicated JS module. Resolves: #94463 Resolves: #94557 Releases: master Change-Id: I504a27fc6cb3d3689555169ac3e39813e2029544 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69830 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Jochen <rothjochen@gmail.com>
Tested-by: Jochen <rothjochen@gmail.com>
Reviewed-by:
-
- 20 Jul, 2021 6 commits
-
-
Oliver Bartsch authored
Both, DatabaseRecordList as well as the ContextMenu feature the "Show" button to preview a content element on its parent page. However, in case the parent page is a "no view doktype" (e.g. sys folder), those buttons lead to a 404 error. This is now fixed by properly checking whether a content elements' parent page can be viewed. If not, the button is no longer shown. Resolves: #93718 Releases: master, 10.4 Change-Id: I2ad48ee7e44d06f569496c4bed2bbd172791b86c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69959 Tested-by:
core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Oliver Bartsch <bo@cedev.de> -
When having the debug logging activated for the authentication process, sensitive data is not being logged anymore. This change * removes password from being logged * hashes the cookie value processed for logging Resolves: #93925 Releases: master, 11.3, 10.4, 9.5 Change-Id: I8c610a72014de571ef52b4430c43f8d149b273d9 Security-Bulletin: CORE-SA-2021-012 Security-References: CVE-2021-32767 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69994 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
The column names, defined in backend layouts, were not properly encoded at some places and therefore led to a XSS vulnerability. The issue is addressed by properly encoding user input. Resolves: #93683 Releases: master, 11.3, 10.4, 9.5, 8.7 Change-Id: I787cee9f56a30aeaf69294412c8d5198a144e31c Security-Bulletin: CORE-SA-2021-011 Security-References: CVE-2021-32669 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69993 Tested-by:
-
Properly encodes error messages to be used in HTML output in "EXT:lowlevel" Query Generator and Query View components. Resolves: #93868 Releases: master, 11.3, 10.4, 9.5 Change-Id: I05812ac7c1cded39edbf10d50bb4dc0fd8faf577 Security-Bulletin: CORE-SA-2021-010 Security-References: CVE-2021-32668 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69992 Tested-by:
-
The `viewpage` module contains a preset selection, where users can select different browser viewports. Since the corresponding preset labels, configurable via TSconfig, had not been encoded properly, is was vulnerable to XSS. The issue is addressed by properly encoding the labels. Resolves: #93702 Releases: master, 11.3, 10.4, 9.5 Change-Id: Ia22c5ab4332816614dd07a93d7e739d9fc1d8bac Security-Bulletin: CORE-SA-2021-009 Security-References: CVE-2021-32667 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69991 Tested-by:
-
* uses stream filter to enclose multi-line content * adds three choosable strategies dealing with control literals + TYPE_REMOVE_CONTROLS - removes control literals (default) + TYPE_PREFIX_CONTROLS - prefixes control literal sequence with `'` + TYPE_PASSTHROUGH - nothing, passthrough data The default strategy is `TYPE_REMOVE_CONTROLS` when invoking `\TYPO3\CMS\Core\Utility\CsvUtility::csvValues`. Resolves: #94271 Releases: master, 11.3, 10.4, 9.5 Change-Id: I2568a0c2dfa6d4636e211e97d66a513984532cc9 Security-Bulletin: TYPO3-PSA-2021-002 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69974 Tested-by:
-
