- 11 Dec, 2018 10 commits
-
-
Change-Id: Ib5214342439fd510cfd599d9880b1612ff9b4cc1 Reviewed-on: https://review.typo3.org/59115 Reviewed-by:
Oliver Hader <oliver.hader@typo3.org> Tested-by:
-
Resolves: #87123 Releases: master, 8.7, 7.6 Change-Id: Idceecb174682261b967ea284e12e1836bb7e7bea Reviewed-on: https://review.typo3.org/59107 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Markus Klein <markus.klein@typo3.org> Reviewed-by:
-
Using large media files (*.youtube, *.vimeo in the TYPO3 core) might lead to denial of service scenarios. In order to avoid that, media files are limited to have a content size of 2048 bytes as a maximum. Usually these files contain just the remote identifier - thus, ~20 bytes should have been sufficient already. Resolves: #85381 Releases: master, 8.7, 7.6 Security-Commit: 36c64c45461dee1c4018b7c72a989952d1e2dd45 Security-Bulletin: TYPO3-CORE-SA-2018-011 Change-Id: Ib54cd9ab822ee33a44170822cc0a3c4da4132c95 Reviewed-on: https://review.typo3.org/59105 Reviewed-by:
-
When installing TYPO3, the current version is shown without any kind of authentication provided (no FIRST_INSTALL). This information disclosure is solved. Resolves: #86254 Releases: master, 8.7, 7.6 Security-Commit: a69d09ab4eabd0474f0191f5daf525d91ebaa32f Security-Bulletin: TYPO3-CORE-SA-2018-010 Change-Id: Ib8359937716dce4839d76b054b0d0d549bd4aa0c Reviewed-on: https://review.typo3.org/59104 Reviewed-by:
-
Resolves: #86955 Releases: master, 8.7, 7.6 Security-Commit: d251175e031aaa9943f93f5e5297f5490b99e513 Security-Bulletin: TYPO3-CORE-SA-2018-009 Change-Id: Ia50cac61ee2d649e98cba2102162c1360487bb20 Reviewed-on: https://review.typo3.org/59103 Reviewed-by:
-
Two occurrences allow to render data of the currently logged in frontend user that is not sanitized and thus allow XSS attacks by frontend users. 1. EXT:fe_login adds ###FEUSER_{fieldname}### for each field that exists in the fe_users DB table, which CAN be processed by TypoScript but is insecure by default. 2. config.USERNAME_substToken = <!--###USERNAME###--> sets the username dynamically, which is then insecure. Adding htmlspecialchars as a default configuration solves this problem. Resolves: #87053 Releases: master, 8.7, 7.6 Security-Commit: 1cc57f4aa7dfb5b1e3e4db581c57aacd69dd4d9d Security-Bulletin: TYPO3-CORE-SA-2018-008 Change-Id: I72a1a4ea60f23c81016b87cbbd1ba63161c52df0 Reviewed-on: https://review.typo3.org/59102 Reviewed-by: -
Resolves: #84190 Releases: master, 8.7, 7.6 Security-Commit: 0aaf266ae75d04efc6a943f9414448d5c2787309 Security-Bulletin: TYPO3-CORE-SA-2018-007 Change-Id: Ic5beb5217326d8f3d72445d4bf9cc7ace705a5a0 Reviewed-on: https://review.typo3.org/59101 Reviewed-by:
-
Resolves: #83184 Releases: master, 8.7, 7.6 Security-Commit: c51313ed68970cd6d2f2172a0e3d74454cf05812 Security-Bulletin: TYPO3-CORE-SA-2018-006 Change-Id: Id982d4fc28e7817eeb88eb63f52dc3380365f3b1 Reviewed-on: https://review.typo3.org/59100 Reviewed-by:
-
CKEditor 4.11 was released including a XSS fix where an attacker could add invalid HTML markup by switching to the Source mode of CKEditor and back. Used commands: cd Build/ yarn add ckeditor#4.11.1 --dev grunt build Resolves: #84800 Releases: master, 8.7 Security-Commit: 4a44c536a4f80b1fbf4599070761368e7919980c Security-Bulletin: TYPO3-CORE-SA-2018-005 Change-Id: I50412f24393c306a989dac448d7c0ee66a6760fb Reviewed-on: https://review.typo3.org/59099 Reviewed-by:
-
The PageTitleProviderManager will now check if the page cache object is an instance of FrontendInterface before getting the value from cache. Resolves: #87116 Releases: master Change-Id: I14838b41a7cba653d5f4e6c875c647f547673644 Reviewed-on: https://review.typo3.org/59082 Tested-by:
TYPO3com <no-reply@typo3.com> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com> Tested-by:
Susanne Moog <susanne.moog@typo3.org> Tested-by:
-
- 10 Dec, 2018 4 commits
-
-
Add current query string to the generated canonicalized URL to make the hreflang and canonical work with additional parameters as well. Parameters that are excluded from cache hash generation and not included in $GLOBALS['TYPO3_CONF_VARS']['FE']['additionalCanonicalizedUrlParameters'], are excluded from the canonicalized URL. Resolves: #86577 Resolves: #86866 Resolves: #86865 Releases: master Change-Id: Ib574e2f6c7aa869b4ffa798c7122a60f4cf13f13 Reviewed-on: https://review.typo3.org/58611 Tested-by:
Joerg Kummer <typo3@enobe.de> Tested-by:
-
Add fields, which modify page icon rendering, to default field list of rootline page requests. Ensures more detailed rendering of page status icons in FLUID using ViewHelper core:iconForRecord Resolves: #87076 Releases: master Change-Id: I11adbaa627c77ceaaa23ca28229510cb19936ad3 Reviewed-on: https://review.typo3.org/59030 Reviewed-by:
Josef Glatz <josef.glatz@typo3.org> Tested-by:
Mona Muzaffar <mona.muzaffar@gmx.de> Reviewed-by:
-
Georg Ringer authored
The styling of the debug output is "namespaced" with `.exception-page` to avoid influencing other CSS definitions. Resolves: #86879 Releases: master Change-Id: I5561b7995826abfd5e1ea53b2b31b30b19c2f208 Reviewed-on: https://review.typo3.org/58870 Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
Markus Poerschke <markus@poerschke.nrw> Tested-by:
-
Use multibyte handling to properly process all Unicode characters for the spam protection email address handling. Resolves: #87071 Releases: master Change-Id: I9fec60c000a202ae34927ec4917e29e2d0e64a5c Reviewed-on: https://review.typo3.org/59033 Tested-by:
Wittkiel Gruppe <ts@wittkiel-gruppe.com> Reviewed-by:
-
- 08 Dec, 2018 5 commits
-
-
Show getUrl() error message when fetching content of error page. Resolves: #87073 Releases: master Change-Id: I9b2d548fc1d9a4bd07ea56c7d5776447c0c596d2 Reviewed-on: https://review.typo3.org/59026 Reviewed-by:
-
The reports module now ignores upgrade wizards that do not have any necessary upgrades (shouldRenderWizard property is false). This makes the behavior fully consistent with the install tool because there the wizards that should not be rendered are not displayed either. Resolves: #86632 Releases: master Change-Id: I87caf45023a0ca4eca71418e029bc8ed7091c0e4 Reviewed-on: https://review.typo3.org/59048 Tested-by:
Stefan Neufeind <typo3.neufeind@speedpartner.de> Reviewed-by:
-
Fix a nightly test setup for a wrong composer dependency in "main" stage. Disable the phpunit randomizer in "composer update max" stage for now since young phpunit collides with our current randomizer call. Change-Id: I4a5d9cd3eea1686969fe0185433a2384aad87a90 Resolves: #87106 Releases: master Reviewed-on: https://review.typo3.org/59060 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Tested-by:
-
Intercept has been adapted, the variable to label handing can be simplified a bit. Resolves: #87109 Releases: master, 8.7, 7.6 Change-Id: I27255ef9f5eb515c89f5d89e7061fc473e2abec1 Reviewed-on: https://review.typo3.org/59063 Tested-by:
-
Resolving the path here breaks the localization Override in the LocalizationFactory Class Resolves: #86683 Releases: master Change-Id: Ib7037bcfba0dd02cf46c1b31f98d7808e7974b3c Reviewed-on: https://review.typo3.org/59024 Reviewed-by:
Daniel Goerz <daniel.goerz@posteo.de> Tested-by:
Helmut Hummel <typo3@helhum.io> Tested-by:
-
- 07 Dec, 2018 15 commits
-
-
Change `CObjectViewHelper::getContentObjectRenderer` to return a new instance of `ContentObjectRenderer` instead of returning a reference to `TSFE->cObj`. Change unit test and add prepared instance of `ContentObjectRenderer` to `GeneralUtility` via `addInstance` method. Resolves: #86979 Releases: master Change-Id: Ibdb8fd1d974a525f3583929a743447a8650ca1ab Reviewed-on: https://review.typo3.org/58661 Tested-by:
-
Due to the fact that the translation keys for the page cache info were double negated (noCache_no = yes) they ended up being mixed up. This patch just swaps the labels. In v10 the keys can be renamed to prevent confusion. Resolves: #87039 Releases: master Change-Id: I34f4d3aa2c0d659eee5c99c8df092260bcef7f5b Reviewed-on: https://review.typo3.org/58980 Reviewed-by:
Mathias Schreiber <mathias.schreiber@typo3.com> Reviewed-by:
Jan Helke <typo3@helke.de> Tested-by:
-
Make the full configuration of a SiteLanguage available. This is required to get access to an extended site language configuration. To be in sync to the Site object, the property attributes is renamed to configuration. Resolves: #87027 Releases: master Change-Id: I8962c5f7cafb38398bf9ded77058af38828e7182 Reviewed-on: https://review.typo3.org/59025 Tested-by:
-
The RequestWrapper::getParsedBody method must return an array, otherwise the a condition like [request.getParsedBody()['foo'] == 1] results in a silent exception if the body is empty. ConditionMatcher::normalizeExpression is now using an advanced regex to handle multiple [] parts correctly. Resolves: #86915 Releases: master Change-Id: Ia3f951d1a3994d545025691e35521ca05b97a39a Reviewed-on: https://review.typo3.org/58935 Tested-by:
Raphael Graf <r@undefined.ch> Reviewed-by:
-
Resolves: #87097 Releases: master Change-Id: I1a6415c5b43e478ac90bb5f2db4437fb498fc568 Reviewed-on: https://review.typo3.org/59051 Tested-by:
Frank Naegler <frank.naegler@typo3.org> Tested-by:
Riccardo De Contardi <erredeco@gmail.com> Reviewed-by:
Richard Haeser <richard@maxserv.com> Tested-by:
Florian Peters <fpeters1392@googlemail.com> Tested-by:
-
A `selectMultipleSideBySide` field is now marked as "changed" when either the order of items has changed or when an item has been removed. Resolves: #87082 Releases: master, 8.7 Change-Id: I9f50576270db667751c14e3513d1a7cd31c1135e Reviewed-on: https://review.typo3.org/59056 Reviewed-by:
-
The latest used tab must be set to active only when the DOM has been loaded. Resolves: #84027 Releases: master Change-Id: I52c8c190c5e58f1793335470427fc18203e4c561 Reviewed-on: https://review.typo3.org/59055 Reviewed-by:
-
In parallel to TYPO3, in order to require the package `doctrine/orm:^2.6.0` (and further), the package `doctrine/instantiator` must be required at least with version `1.1.0`. Used composer command: `composer req doctrine/instantiator:^1.0` Resolves: #86965 Releases: master Change-Id: I473caa015bc1d6431654cbb889148cd396e7412b Reviewed-on: https://review.typo3.org/58924 Reviewed-by:
Wouter Wolters <typo3@wouterwolters.nl> Tested-by:
Georg Großberger <garfieldius67@gmail.com> Tested-by:
-
This fix makes sure that the pointer parameter is added just once into the record list pagination urls Resolves: #87007 Releases: master, 8.7 Change-Id: I6db00dd0af0d09277aa9a005e561330acb386809 Reviewed-on: https://review.typo3.org/58954 Reviewed-by:
Nicole Cordes <typo3@cordes.co> Tested-by:
-
URLencoding applied to linkThisScript and linkThisUrl make links fail that are only used and executed by Javascript. Reverting to old behavior fixes the failure. Change-Id: I992c9c362190bb7d4f6135bab059fd7ec058d2bb Resolves: #87010 Relates: #83334 Releases: master Reviewed-on: https://review.typo3.org/58956 Tested-by:
Preben Rather Sørensen <preben@rather.dk> Tested-by:
Tim Karliczek <tkarliczek@3pc.de> Reviewed-by:
Benni Mack <benni@typo3.org> Tested-by:
-
Changes syntax for translation key and add default language value. Resolves: #87001 Releases: master, 8.7 Change-Id: I5a634aff013f6d4af68f25b8288ed04bc340e823 Reviewed-on: https://review.typo3.org/58948 Reviewed-by:
Jörg Bösche <typo3@joergboesche.de> Reviewed-by:
-
Resolves: #53123 Releases: master, 8.7 Change-Id: I8030e434a27ae2f2c5934706eec6f64e64e31cd3 Reviewed-on: https://review.typo3.org/58867 Tested-by:
Willi Wehmeier <wwwehmeier@gmail.com> Reviewed-by:
-
Disable copy option if setting mod.web_layout.localization.enableCopy = 0 in all cases. As a newly translated page has no copies or translations this variable will be false and this results in $allowCopy = true. To disable the copy mode the initial setting $allowCopy is taken into account. Resolves: #76910 Releases: master Change-Id: I38f16a11038885c1ba0d455d7913d729e9669817 Reviewed-on: https://review.typo3.org/59016 Reviewed-by:
-
The new setting `replacement` makes it possible to search and replace strings inside a slug. Resolves: #86740 Releases: master Change-Id: Icc8fe167fcb5d48502ace2c43e0535884bc10341 Reviewed-on: https://review.typo3.org/58851 Reviewed-by:
Peter Kraume <peter.kraume@gmx.de> Tested-by:
-
Resolves: #87096 Releases: master, 8.7 Change-Id: I0a46420cb910d19223a8bb133d9e7457fbd29ee2 Reviewed-on: https://review.typo3.org/59049 Reviewed-by:
-
- 06 Dec, 2018 4 commits
-
-
Add info about the manual steps to remove an existing and add a working language:update scheduler task which is necessary after an upgrade to TYPO3 >= 9.2 Releases: master Resolves: #87081 Change-Id: I0970011b972239d3ebab50d6d06b1f8e33e099f5 Reviewed-on: https://review.typo3.org/59034 Tested-by:
Björn Jacob <bjoern.jacob@tritum.de> Tested-by:
-
This patch fixes multiple issues when generating a date in AdminPanel's preview module: - The order of the date segements is changed to have a valid ISO format - Months are 0-based in JavaScript (0 = January, 11 = December), for this reason, +1 is added to have a valid date string Resolves: #87060 Releases: master Change-Id: Ib6a86e65b962a21eb9c033801a8711cb4f12f193 Reviewed-on: https://review.typo3.org/59047 Reviewed-by:
Mathias Brodala <mbrodala@pagemachine.de> Tested-by:
-
The \TYPO3\CMS\Core\LinkHandling\RecordLinkHandler::asString method expects the parameters to hold the identifier and uid as top-level array elements. The legacy syntax converter now ensures that this nesting is correct. Besides that we now also upgrade the very old linkhandler syntax with no identifier. Therefore we accept - record:<identifier>:<table>:<uid> - record:<table>:<uid> Resolves: #80806 Releases: master, 8.7 Change-Id: I01c3d525de43a56d610dc882ef406de631a8762e Reviewed-on: https://review.typo3.org/58964 Tested-by:
-
Resolves: #87084 Releases: master Change-Id: I2127e0cb08ed346230818050c0f32a70ab9d72d1 Reviewed-on: https://review.typo3.org/59045 Tested-by:
-
- 05 Dec, 2018 1 commit
-
-
Resolves: #87083 Releases: master Change-Id: I674fb3a93c0e399124bbee7dfc0280275116bdcc Reviewed-on: https://review.typo3.org/59035 Tested-by:
-
- 04 Dec, 2018 1 commit
-
-
When \TYPO3\CMS\Frontend\ContentObject\ContentObjectRenderer::getTreeList checked for an existing cache_treelist entry, the given md5hash and the expiry timestamp had been compared. As caches do not expire at all by default, there a very few cases when an entry is actually expired. However, if a cache entry has been expired, the cache entry hasn't been removed and therefore the creation of a new cache entry with the same md5hash identifier resulted in a duplicate entry exception. To solve this, the affected, expired entry will be removed during runtime. Releases: master, 8.7 Resolves: #86028 Resolves: #86491 Change-Id: If1a907607db29f7edd0fa77a8bb47a69bdfc0df9 Reviewed-on: https://review.typo3.org/58951 Tested-by:
-
