Change-Id: Iea9655ddd56df9fbba3d4f769eab1c2fbd8c4f68
Reviewed-on: http://review.typo3.org/32935


Reviewed-by: TYPO3 Release Team <typo3v4@typo3.org>
Tested-by: TYPO3 Release Team <typo3v4@typo3.org>

Jigal van Hemert authored Jul 01, 2013 and Oliver Hader committed Sep 20, 2014

The modify time of the extensions.xml.gz file is used to display the last
update of the extension list. Checking if the file exists will prevent a
PHP warning.

Change-Id: Ic8cae6c591f0b6ff955fb01c192df9b17876fe68
Releases: 4.5
Resolves: #37946
Reviewed-on: http://review.typo3.org/21776


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

Stanislas Rolland authored May 20, 2014 and Oliver Hader committed Sep 20, 2014

Problem: IE raises a syntax error when it encounters html comments in
the JavaScript code. The html comments are added by the page renderer.
Solution: There is no need for the page renderer to wrap inline
javascript as html comments.

Resolves: #55457
Releases: 6.2, 6.1, 4.5
Change-Id: Iae180a73778ca3bb1c9934c887315b969888b10d
Reviewed-on: http://review.typo3.org/30240


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

In the page module information on neighboring content elements is
collected while building the page layout. This information must be
remembered for other elements on the page instead of generated new when
rendering each element. This makes sure the move buttons and edit
buttons have the correct URLs.

Resolves: #60199
Releases: 6.3, 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I9fec256b145fe8aba229d8b026fba73871942347
Reviewed-on: http://review.typo3.org/32330


Reviewed-by: Markus Klein <klein.t3@reelworx.at>
Tested-by: Markus Klein <klein.t3@reelworx.at>

Change-Id: I29de73b589d2adf8a66f08455048f5b709ad5d02
Reviewed-on: https://review.typo3.org/31509
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Ic994e542cd4bab39a88fd1426d718b9174867783
Reviewed-on: https://review.typo3.org/31508
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Nicole Cordes authored Jul 08, 2014 and Oliver Hader committed Jul 08, 2014

Due to commit I148ca1b023226f2f99417b3baf238b72346e721f the information
concerning previous and next content elements in one row is messed up.
This patch helps to build information which depends on colPos again and
prevents records being moved to another column.

Resolves: #48939
Resolves: #49055
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I3a15321ee11a1f7d96b58b8b7a5ab14098664b22
Reviewed-on: https://review.typo3.org/31494
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

By default travis notifies on each build when
posting to channels (irc, slack)
We can reduce the number of notifications by only
posting successful builds when it previously failed.
Additionally encrypt the API token for posting to slack.

Releases: 6.3, 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I882d34903c972201454e6cc5b9041393e3bd3661
Reviewed-on: https://review.typo3.org/31226
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel

Notify on Slack and IRC, remove email notification.

Resolves: #59838
Releases: 6.3, 6.2, 4.5
Change-Id: Ic4dacd5c7b6b4e6e2b8cfa92ae7976b666209747
Reviewed-on: https://review.typo3.org/31209
Reviewed-by: Nicole Cordes
Reviewed-by: Michael Stucki
Tested-by: Michael Stucki

Namespaces are not supported in PHP 5.2.x, hence one must not
prefix a class name with backslash.

Regression fix to #54748.

Resolves: #59825
Releases: 4.5
Change-Id: Ideb2cef1c5e2ec0d2ac3328ebd4f318a161d368a
Reviewed-on: https://review.typo3.org/31084
Tested-by: Sebastian Sommer
Tested-by: Steffen Mächtel
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Due to patch https://review.typo3.org/#/c/30305/ the string comparison
on colPos fails and new content elements are always stored on pid 0.
This patch corrects the check for an integer colPos type by setting the
unused variable to NULL.

Resolves: #59059
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: Iecd7f0cacf5c9315d882eebeb3893bcfa63ae7eb
Reviewed-on: https://review.typo3.org/30419
Tested-by: SITS Developer
Reviewed-by: Markus Klein
Tested-by: Markus Klein

The AJAX url for retrieving a new encryption key contains
two question marks. This causes the request to fail.

Fix this by removing the superflous ? from the parameters.

Resolves: #59034
Releases: 6.1, 4.7, 4.5
Change-Id: Iab3833f50a48b71b25cf0205f7eb8d6b57dd859a
Reviewed-on: https://review.typo3.org/30543
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Markus Klein authored May 22, 2014 and Christian Kuhn committed May 23, 2014

lang/4.5/locallang_csh_pages.xlf contains invalid
HTML structure a <p> tag should actually be a <b> tag.

Resolves: #58936
Releases: 6.2, 6.1, 4.5
Change-Id: Id37d424296628202d8d434e0cf9cafd8529da2c3
Reviewed-on: https://review.typo3.org/30331
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn

The SoftReferenceIndex parses and rebuilds typolink tags, but the
support for more than one value in class attribute is missing, because
the values don't get enclosed with quotes on rebuilding.
This leads to lost classes in typolinks in exports from impexp.

Resolves: #58484
Releases: 6.2, 6.1, 4.5
Change-Id: I12ed3be7f5be36254bcee57fcb24bf2a10f92f46
Reviewed-on: https://review.typo3.org/29853
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Change-Id: Iffabf254620824d1d0b7a42e239576bd3aa73791
Reviewed-on: https://review.typo3.org/30309
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I296aa228d3d9ffda43cf99a41d3ac36d8b93f439
Reviewed-on: https://review.typo3.org/30308
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Helmut Hummel authored May 22, 2014 and Oliver Hader committed May 22, 2014

TYPO3 uses the values of HTTP_HOST in several
places without validating them. This could
lead to a situation where links are generated
using the host part from HTTP_HOST.
Since HTTP_HOST headers are user input and
can be spoofed by an attacker, it leads
into several potential and actual security issues.
To address this, a configuration option for
trusted hosts is added, which is evaluated every
time getIndpEnv('HTTP_HOST') is called.
The configuration option is
$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern']
and can contain either a regular expression or the
value "SERVER_NAME"
To properly output the exception message in case
the trustedHostPattern does not match,
we need to adapt the exception handlers slightly
to not log information in this case and to actually
show the message even in production context to not
confuse admins on what is currently going wrong.
To not break all existing installations, the default
pattern is set to 'SERVER_NAME' which allows all
HTTP_HOST values matching the SERVER_NAME (and
optionally the SERVER_PORT if a port is specified
in the HTTP_HOST value).
This will secure all installation which use properly
configured name based virtual hosts, but leaves
installations where the web server is not bound
to a specific host name still in an insecure state.
Fixes: #30377
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Bulletin: TYPO3-CORE-SA-2014-001

Change-Id: Id210212e6fbd186a273f92b340d5060e9c6f900d
Reviewed-on: https://review.typo3.org/30275
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Marc Bastian Heinrichs authored May 22, 2014 and Oliver Hader committed May 22, 2014

Needs to be fixed also in 6.x, but the affected function is not
used anymore.

Change-Id: Iae077221a4a8ef8f3aacaeb9d679cc68e97799bd
Fixes: #54111
Fixes: #54113
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 6b746d50d9ee4fbf2eff3e3e4c0699100be983a2
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30274
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Markus Klein authored May 22, 2014 and Oliver Hader committed May 22, 2014

Sanitize user-input colPos in new content element wizard.

Change-Id: I13ff938e7320c68c8ad3f88b0cb688bc4d43d839
Fixes: #48695
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 582087ad27cee5365ea36387bba28c1b62212564
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30273
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Marc Bastian Heinrichs authored May 22, 2014 and Oliver Hader committed May 22, 2014

Change-Id: I6942457ce27ad22a33efd003ceaa96fa7460c0bf
Fixes: #54109
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 9abedcf7dc0fd59b602a2221ffd9a998636b8092
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30272
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Nicole Cordes authored May 22, 2014 and Oliver Hader committed May 22, 2014

Change-Id: I7e58e32a4d7146c2c341d756816c29f7c01ed31d
Fixes: #57576
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 7493eb3ec56903b00923dcabf00a04f34529ad18
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30271
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Markus Klein authored May 22, 2014 and Oliver Hader committed May 22, 2014

The url for the Open in New Window button must be quoted for
use in JavaScript to prevent XSS issues.

Change-Id: If3600662e79fb0945ca62b3a25feaf001180b88d
Fixes: #48693
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 8a9c1615f82cf0a8c3449ae37f47338da132e505
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30270
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Helmut Hummel authored May 22, 2014 and Oliver Hader committed May 22, 2014

Change-Id: Iee9d2712ae3b489a89604cb7be8c2af27a924fe0
Fixes: #56458
Releases: 6.1, 6.0, 4.7, 4.5
Security-Commit: 36eb11e44d7faca68b3d6fefb1633a463cc22fac
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30269
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Helmut Hummel authored May 22, 2014 and Oliver Hader committed May 22, 2014

The file charts.swf is vulnerable to XSS, is delivered
by ExtJS but not used in TYPO3 CMS at all.

Since the vendor of ExtJS did not fix this vulnerability,
we decided to remove it from TYPO3 sources.

Change-Id: I7d81fc44294473d041c8910e04c815d91efb409f
Fixes: #54526
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: fef11509739f8bddfeba0fc6f752ac93feb16f03
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30268
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Jigal van Hemert authored Apr 25, 2014 and Oliver Hader committed May 08, 2014

The reason for this behaviour is the combination of prototype.js
and ExtJS. The ExtJS defer() method takes precedence. Calling the
defer() method without any arguments would have resulted in using
a default value of "0.01" seconds in standalone prototype.js, but
results in directly calling the submitted function.

The stack overflow is caused by not delaying the function call
and thus ending in a recursive endless loop.

Resolves: #58187
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I6db191ff67a3e869072877936d949fc733cda74f
Reviewed-on: https://review.typo3.org/29908
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Change-Id: I5bb6b9f459f7f22157a917a8e77ddbe111fd60d1
Reviewed-on: https://review.typo3.org/29515
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Iaba6bc222c65a196239ad222bb6335fb5ffa6e3a
Reviewed-on: https://review.typo3.org/29514
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Upgrades prototype from 1.6.0.3 to 1.7.1 and scriptaculous
from 1.8.2 to 1.9.0.

Solves the problem with sorting IRRE elements in IE9+, for example.

Resolves: #51768
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I5ea11b2e926ae0f23d1c6d85a0ff5ba24995eebb
Reviewed-on: https://review.typo3.org/29474
Reviewed-by: Markus Klein
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind

Change-Id: I72aa69adc75820cf513bb87cf2af6ea1b50a2fc7
Resolves: #57934
Releases: 4.5
Reviewed-on: https://review.typo3.org/29489
Reviewed-by: Oliver Klee
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind

The SoftReferenceIndex parses and rebuilds typolink tags, but the
support for the title attributes was missing.
This leads to lost title attributes on typolinks in exports from impexp.

Resolves: #56580
Releases: 6.2, 6.1, 6.0, 4.5
Change-Id: I9bf5c02b79ae4c9024322f0da99dcca37b678daa
Reviewed-on: https://review.typo3.org/28171
Reviewed-by: Wouter Wolters
Reviewed-by: Marc Bastian Heinrichs
Tested-by: Marc Bastian Heinrichs

Oliver Hader authored Apr 04, 2014 and Oliver Hader committed Apr 04, 2014

This file is a modified and updated version like it has been
releases with every package in the past. Since these files have
been taken from git.typo3.org/TYPO3CMS/Distributions/Base.git,
which is target to be cleaned up, the file is explicitely put
to old branches as well.

Resolves: #57656
Releases: 6.1, 6.0, 4.7, 4.6, 4.5
Change-Id: I3b696895deaf03b2f630e12f1bd7b17b649b985c
Reviewed-on: https://review.typo3.org/29175
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

The class name is submitted in a hidden form and is susceptible to XSS.
The patch introduced htmlspecialchars to prevent XSS possibility.

Resolves: #57603
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I4979e66f28a581e168c56d91327a1bbe2672448d
Reviewed-on: https://review.typo3.org/29155
Reviewed-by: Nicole Cordes
Tested-by: Nicole Cordes

This reverts commit 70ce5402.

The 401 header code is used with HTTP based authentication schemes,
based on RFC 2617.

This is not the case here.

Resolves: #55966
Reverts: #51803
Releases: 6.2, 6.1, 6.0, 4.5
Change-Id: Id283069003542ea5b44fdd72b7abda88a2b6762d
Reviewed-on: https://review.typo3.org/27900
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Encoding a few extra character besides the ones according to RFC3986
makes password reset links working again in various mail clients which
do not comply to this RFC (and which do not have plans to fix this in
the near future).

Change-Id: I0b42bef6cb732c5fc6cc2d900407271cb606e301
Fixes: #23984
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Reviewed-on: https://review.typo3.org/27830
Reviewed-by: Oliver Klee
Reviewed-by: Markus Klein
Tested-by: Markus Klein

Patch for issue #31998 introduced a namespace in unit test,
the test suite now fails after patch for issue #53682. Use
old class name instead.

Change-Id: I83e7cd33787364c1f531c51406f09884aff418c6
Resolves: #55811
Related: #53682
Related: #31998
Releases: 4.7, 4.5
Reviewed-on: https://review.typo3.org/27513
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
(cherry picked from commit df8e21b7)
Reviewed-on: https://review.typo3.org/27514

When using a HTTPS backend the download of CSV is not
working in Internet Explorer browser versions lower then 9.
Add the needed header to fix this problem.

Change-Id: Iefa63fb37d57491fb73bfd504b6caed5b76c8cac
Resolves: #16491
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Reviewed-on: https://review.typo3.org/27481
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn

Change-Id: I252da74973c3dc4157717139c95ad0605e16fce1
Releases: 6.2, 6.1, 4.5
Resolves: #55458
Reviewed-on: https://review.typo3.org/27150
Reviewed-by: Wouter Wolters
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind

Tim Lochmüller authored Jan 27, 2014 and Wouter Wolters committed Jan 28, 2014

There is a "copy-and-paste" mistake in the domain redirect mechanism.
The function HttpUtility::redirect should call with a valid HTTP
status code (the const value) and not with the name of the constant.

Resolves: #55350
Releases: 6.2, 6.1, 6.0, 4.5
Change-Id: I97f55ac8df1688011198666da1fd322a5c3bd323
Reviewed-on: https://review.typo3.org/27105
Reviewed-by: Tim Lochmüller
Tested-by: Tim Lochmüller
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters

This reverts commit 2526bddb.

This is not PHP 5.2 compatible (static::*).

See also travis reporting on that:
https://travis-ci.org/TYPO3/TYPO3.CMS/jobs/17114327

Change-Id: Ia0dc0766dd73ce5343464afd1f71b1b2d8e27795
Reviewed-on: https://review.typo3.org/26910
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Ernesto Baschny
Tested-by: Ernesto Baschny

PHP reflection has quite an overhead in performance.
Use a switch construct like in Flow instead to
instantiate classes with up to 8 arguments without
reflection.

Resolves: #53682
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I82ecf0b1ea9a412a39b4429d7689f2bb6489f3df
Reviewed-on: https://review.typo3.org/26643
Reviewed-by: Markus Klein
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind