Namespaces are not supported in PHP 5.2.x, hence one must not
prefix a class name with backslash.

Regression fix to #54748.

Resolves: #59825
Releases: 4.5
Change-Id: Ideb2cef1c5e2ec0d2ac3328ebd4f318a161d368a
Reviewed-on: https://review.typo3.org/31084
Tested-by: Sebastian Sommer
Tested-by: Steffen Mächtel
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Due to patch https://review.typo3.org/#/c/30305/ the string comparison
on colPos fails and new content elements are always stored on pid 0.
This patch corrects the check for an integer colPos type by setting the
unused variable to NULL.

Resolves: #59059
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: Iecd7f0cacf5c9315d882eebeb3893bcfa63ae7eb
Reviewed-on: https://review.typo3.org/30419
Tested-by: SITS Developer
Reviewed-by: Markus Klein
Tested-by: Markus Klein

The AJAX url for retrieving a new encryption key contains
two question marks. This causes the request to fail.

Fix this by removing the superflous ? from the parameters.

Resolves: #59034
Releases: 6.1, 4.7, 4.5
Change-Id: Iab3833f50a48b71b25cf0205f7eb8d6b57dd859a
Reviewed-on: https://review.typo3.org/30543
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Markus Klein authored May 22, 2014 and Christian Kuhn committed May 23, 2014

lang/4.5/locallang_csh_pages.xlf contains invalid
HTML structure a <p> tag should actually be a <b> tag.

Resolves: #58936
Releases: 6.2, 6.1, 4.5
Change-Id: Id37d424296628202d8d434e0cf9cafd8529da2c3
Reviewed-on: https://review.typo3.org/30331
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn

The SoftReferenceIndex parses and rebuilds typolink tags, but the
support for more than one value in class attribute is missing, because
the values don't get enclosed with quotes on rebuilding.
This leads to lost classes in typolinks in exports from impexp.

Resolves: #58484
Releases: 6.2, 6.1, 4.5
Change-Id: I12ed3be7f5be36254bcee57fcb24bf2a10f92f46
Reviewed-on: https://review.typo3.org/29853
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Change-Id: Iffabf254620824d1d0b7a42e239576bd3aa73791
Reviewed-on: https://review.typo3.org/30309
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I296aa228d3d9ffda43cf99a41d3ac36d8b93f439
Reviewed-on: https://review.typo3.org/30308
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Helmut Hummel authored May 22, 2014 and Oliver Hader committed May 22, 2014

TYPO3 uses the values of HTTP_HOST in several
places without validating them. This could
lead to a situation where links are generated
using the host part from HTTP_HOST.
Since HTTP_HOST headers are user input and
can be spoofed by an attacker, it leads
into several potential and actual security issues.
To address this, a configuration option for
trusted hosts is added, which is evaluated every
time getIndpEnv('HTTP_HOST') is called.
The configuration option is
$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern']
and can contain either a regular expression or the
value "SERVER_NAME"
To properly output the exception message in case
the trustedHostPattern does not match,
we need to adapt the exception handlers slightly
to not log information in this case and to actually
show the message even in production context to not
confuse admins on what is currently going wrong.
To not break all existing installations, the default
pattern is set to 'SERVER_NAME' which allows all
HTTP_HOST values matching the SERVER_NAME (and
optionally the SERVER_PORT if a port is specified
in the HTTP_HOST value).
This will secure all installation which use properly
configured name based virtual hosts, but leaves
installations where the web server is not bound
to a specific host name still in an insecure state.
Fixes: #30377
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Bulletin: TYPO3-CORE-SA-2014-001

Change-Id: Id210212e6fbd186a273f92b340d5060e9c6f900d
Reviewed-on: https://review.typo3.org/30275
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Marc Bastian Heinrichs authored May 22, 2014 and Oliver Hader committed May 22, 2014

Needs to be fixed also in 6.x, but the affected function is not
used anymore.

Change-Id: Iae077221a4a8ef8f3aacaeb9d679cc68e97799bd
Fixes: #54111
Fixes: #54113
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 6b746d50d9ee4fbf2eff3e3e4c0699100be983a2
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30274
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Markus Klein authored May 22, 2014 and Oliver Hader committed May 22, 2014

Sanitize user-input colPos in new content element wizard.

Change-Id: I13ff938e7320c68c8ad3f88b0cb688bc4d43d839
Fixes: #48695
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 582087ad27cee5365ea36387bba28c1b62212564
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30273
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Marc Bastian Heinrichs authored May 22, 2014 and Oliver Hader committed May 22, 2014

Change-Id: I6942457ce27ad22a33efd003ceaa96fa7460c0bf
Fixes: #54109
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 9abedcf7dc0fd59b602a2221ffd9a998636b8092
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30272
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Nicole Cordes authored May 22, 2014 and Oliver Hader committed May 22, 2014

Change-Id: I7e58e32a4d7146c2c341d756816c29f7c01ed31d
Fixes: #57576
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 7493eb3ec56903b00923dcabf00a04f34529ad18
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30271
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Markus Klein authored May 22, 2014 and Oliver Hader committed May 22, 2014

The url for the Open in New Window button must be quoted for
use in JavaScript to prevent XSS issues.

Change-Id: If3600662e79fb0945ca62b3a25feaf001180b88d
Fixes: #48693
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 8a9c1615f82cf0a8c3449ae37f47338da132e505
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30270
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Helmut Hummel authored May 22, 2014 and Oliver Hader committed May 22, 2014

Change-Id: Iee9d2712ae3b489a89604cb7be8c2af27a924fe0
Fixes: #56458
Releases: 6.1, 6.0, 4.7, 4.5
Security-Commit: 36eb11e44d7faca68b3d6fefb1633a463cc22fac
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30269
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Helmut Hummel authored May 22, 2014 and Oliver Hader committed May 22, 2014

The file charts.swf is vulnerable to XSS, is delivered
by ExtJS but not used in TYPO3 CMS at all.

Since the vendor of ExtJS did not fix this vulnerability,
we decided to remove it from TYPO3 sources.

Change-Id: I7d81fc44294473d041c8910e04c815d91efb409f
Fixes: #54526
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: fef11509739f8bddfeba0fc6f752ac93feb16f03
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30268
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Jigal van Hemert authored Apr 25, 2014 and Oliver Hader committed May 08, 2014

The reason for this behaviour is the combination of prototype.js
and ExtJS. The ExtJS defer() method takes precedence. Calling the
defer() method without any arguments would have resulted in using
a default value of "0.01" seconds in standalone prototype.js, but
results in directly calling the submitted function.

The stack overflow is caused by not delaying the function call
and thus ending in a recursive endless loop.

Resolves: #58187
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I6db191ff67a3e869072877936d949fc733cda74f
Reviewed-on: https://review.typo3.org/29908
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Change-Id: I5bb6b9f459f7f22157a917a8e77ddbe111fd60d1
Reviewed-on: https://review.typo3.org/29515
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Iaba6bc222c65a196239ad222bb6335fb5ffa6e3a
Reviewed-on: https://review.typo3.org/29514
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Upgrades prototype from 1.6.0.3 to 1.7.1 and scriptaculous
from 1.8.2 to 1.9.0.

Solves the problem with sorting IRRE elements in IE9+, for example.

Resolves: #51768
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I5ea11b2e926ae0f23d1c6d85a0ff5ba24995eebb
Reviewed-on: https://review.typo3.org/29474
Reviewed-by: Markus Klein
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind

Change-Id: I72aa69adc75820cf513bb87cf2af6ea1b50a2fc7
Resolves: #57934
Releases: 4.5
Reviewed-on: https://review.typo3.org/29489
Reviewed-by: Oliver Klee
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind

The SoftReferenceIndex parses and rebuilds typolink tags, but the
support for the title attributes was missing.
This leads to lost title attributes on typolinks in exports from impexp.

Resolves: #56580
Releases: 6.2, 6.1, 6.0, 4.5
Change-Id: I9bf5c02b79ae4c9024322f0da99dcca37b678daa
Reviewed-on: https://review.typo3.org/28171
Reviewed-by: Wouter Wolters
Reviewed-by: Marc Bastian Heinrichs
Tested-by: Marc Bastian Heinrichs

Oliver Hader authored Apr 04, 2014 and Oliver Hader committed Apr 04, 2014

This file is a modified and updated version like it has been
releases with every package in the past. Since these files have
been taken from git.typo3.org/TYPO3CMS/Distributions/Base.git,
which is target to be cleaned up, the file is explicitely put
to old branches as well.

Resolves: #57656
Releases: 6.1, 6.0, 4.7, 4.6, 4.5
Change-Id: I3b696895deaf03b2f630e12f1bd7b17b649b985c
Reviewed-on: https://review.typo3.org/29175
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

The class name is submitted in a hidden form and is susceptible to XSS.
The patch introduced htmlspecialchars to prevent XSS possibility.

Resolves: #57603
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I4979e66f28a581e168c56d91327a1bbe2672448d
Reviewed-on: https://review.typo3.org/29155
Reviewed-by: Nicole Cordes
Tested-by: Nicole Cordes

This reverts commit 70ce5402.

The 401 header code is used with HTTP based authentication schemes,
based on RFC 2617.

This is not the case here.

Resolves: #55966
Reverts: #51803
Releases: 6.2, 6.1, 6.0, 4.5
Change-Id: Id283069003542ea5b44fdd72b7abda88a2b6762d
Reviewed-on: https://review.typo3.org/27900
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Encoding a few extra character besides the ones according to RFC3986
makes password reset links working again in various mail clients which
do not comply to this RFC (and which do not have plans to fix this in
the near future).

Change-Id: I0b42bef6cb732c5fc6cc2d900407271cb606e301
Fixes: #23984
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Reviewed-on: https://review.typo3.org/27830
Reviewed-by: Oliver Klee
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Patch for issue #31998 introduced a namespace in unit test,
the test suite now fails after patch for issue #53682. Use
old class name instead.

Change-Id: I83e7cd33787364c1f531c51406f09884aff418c6
Resolves: #55811
Related: #53682
Related: #31998
Releases: 4.7, 4.5
Reviewed-on: https://review.typo3.org/27513
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
(cherry picked from commit df8e21b7)
Reviewed-on: https://review.typo3.org/27514

When using a HTTPS backend the download of CSV is not
working in Internet Explorer browser versions lower then 9.
Add the needed header to fix this problem.

Change-Id: Iefa63fb37d57491fb73bfd504b6caed5b76c8cac
Resolves: #16491
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Reviewed-on: https://review.typo3.org/27481
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn

Change-Id: I252da74973c3dc4157717139c95ad0605e16fce1
Releases: 6.2, 6.1, 4.5
Resolves: #55458
Reviewed-on: https://review.typo3.org/27150
Reviewed-by: Wouter Wolters
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind

Tim Lochmüller authored Jan 27, 2014 and Wouter Wolters committed Jan 28, 2014

There is a "copy-and-paste" mistake in the domain redirect mechanism.
The function HttpUtility::redirect should call with a valid HTTP
status code (the const value) and not with the name of the constant.

Resolves: #55350
Releases: 6.2, 6.1, 6.0, 4.5
Change-Id: I97f55ac8df1688011198666da1fd322a5c3bd323
Reviewed-on: https://review.typo3.org/27105
Reviewed-by: Tim Lochmüller
Tested-by: Tim Lochmüller
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters

This reverts commit 2526bddb.

This is not PHP 5.2 compatible (static::*).

See also travis reporting on that:
https://travis-ci.org/TYPO3/TYPO3.CMS/jobs/17114327

Change-Id: Ia0dc0766dd73ce5343464afd1f71b1b2d8e27795
Reviewed-on: https://review.typo3.org/26910
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Ernesto Baschny
Tested-by: Ernesto Baschny

PHP reflection has quite an overhead in performance.
Use a switch construct like in Flow instead to
instantiate classes with up to 8 arguments without
reflection.

Resolves: #53682
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I82ecf0b1ea9a412a39b4429d7689f2bb6489f3df
Reviewed-on: https://review.typo3.org/26643
Reviewed-by: Markus Klein
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind

The be.tableList view helper uses the class localRecordList
which relies on a available $GLOBALS['SOBE']->doc object.
Since https://review.typo3.org/19000/ the doc instance
in SOBE does not get instantiated in any case, which
results in a PHP fatal error using this view helper.

For 6.x this was fixed with https://review.typo3.org/15007/

Fixes: #54748
Releases: 4.7, 4.5
Change-Id: I4ac4a1718ec6c8e0a02723802bf73dbabd1648ab
Reviewed-on: https://review.typo3.org/26890
Reviewed-by: Markus Klein
Tested-by: Markus Klein

If a record is deleted in a workspace the delete icon is still
displayed but the function is different. If you click on
the delete icon of a deleted record you will "restore"
the record (remove the deleted flag).
The icon should change if record is marked as deleted.

Resolves: #52554
Releases: 6.2, 6.1, 6.0, 4.5
Change-Id: I9bccc076d06525fad16f9f5ca4b3413e217f32f6
Reviewed-on: https://review.typo3.org/24746
Reviewed-by: Markus Klein
Tested-by: Markus Klein

This change adds a case to treat "inline" TCA types the same way
"select" is treated when building the record's label value.

Before, if record used field of type "inline" as TCA label field, TYPO3
would display fx "3" (number of related records as stored in field
on parent record).

After, TYPO3 will display fx "Record1, Record2, Record2" if "inline"
field contains three related records named thusly.

Fixes: #52133
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: Ie06f09368e81505cb1e5989b61ae98add54b05ba
Reviewed-on: https://review.typo3.org/23914
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Needed to workaround a login-problem with IE11.

ExtJS tries to clear a cookie with different settings than when
setting the cookie. In IE11 this leads to problems with the cookie
being set twice on the next call to set(). The get() however
would return the first (empty) cookie.

Using set() with a date in the past also clears the cookie but
will correctly use the same path-settings.

Change-Id: Ieff22129895cd89ca2e1429703daf1636596ecb6
Resolves: #53818
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Reviewed-on: https://review.typo3.org/25871
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Steffen Ritter
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Change-Id: I3073c38f3df08f909e9d29b58acbd8f1671272c9
Reviewed-on: https://review.typo3.org/26227
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Ied61f0997ee99da6866d4c3d43fd46ed213c6c83
Reviewed-on: https://review.typo3.org/26226
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Anja Leichsenring authored Dec 10, 2013 and Oliver Hader committed Dec 10, 2013

The second typolink parameter, that is the target, can be abused to
introduce XSS code into the generated link. Escaping the parameter
with quoteJSvalue solves the problem.

Change-Id: I1652e2f1e9fea660d2a5a9e74ace6317fe05ba3b
Fixes: #31206
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 4a1a06ad0124defafb991639b19d81f81f7d5b95
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26184
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Anja Leichsenring authored Dec 10, 2013 and Oliver Hader committed Dec 10, 2013

Encode user-input in JavaScript context for colorpicker.

Change-Id: Ia5d181bb74f3cbe2d2b7c75097655f9c7593b70d
Fixes: #42772
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 9fba6ded6247aaa74b974daf1c9bba5eb4aaf028
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26183
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Franz G. Jahn authored Dec 10, 2013 and Oliver Hader committed Dec 10, 2013

An hmac of the editor controlled auto respond message was used to verifiy
the correctness of this message on submit. To prevent this, we add an
additional secret.

Fixes: #45043
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
(cherry picked from commit 66013e46f09b38343ac22d9e231328966bff0c6e)
Security-Commit: fa5bdd2ac518555f21ec857dc31d2991a1e937ad
Security-Bulletin: TYPO3-CORE-SA-2013-004

Change-Id: I66b1ddc379577fc3ed67012384a15c38a6b76a03
Reviewed-on: https://review.typo3.org/26182
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader