Change-Id: I5706e9296860dc95e0056a47d97fed6533ccc985
Reviewed-on: http://review.typo3.org/35230


Reviewed-by: TYPO3 Release Team <typo3v4@typo3.org>
Tested-by: TYPO3 Release Team <typo3v4@typo3.org>

Change-Id: I1f43bd5fc9f1197ca7f6fdfd6f68c84f7f6214ff
Reviewed-on: http://review.typo3.org/34679


Reviewed-by: TYPO3 Release Team <typo3v4@typo3.org>
Tested-by: TYPO3 Release Team <typo3v4@typo3.org>

Change-Id: If2f6374021bd90046335888117ac5968405b9a40
Reviewed-on: http://review.typo3.org/34677


Reviewed-by: TYPO3 Release Team <typo3v4@typo3.org>
Tested-by: TYPO3 Release Team <typo3v4@typo3.org>

Change-Id: Ie90485ebcb8da9859020a18cabc19a17e504737c
Reviewed-on: http://review.typo3.org/33462


Reviewed-by: TYPO3 Release Team <typo3v4@typo3.org>
Tested-by: TYPO3 Release Team <typo3v4@typo3.org>

Change-Id: I2156d74111b5594f5bf18d8cd274877b563b73c7
Reviewed-on: http://review.typo3.org/33461


Reviewed-by: TYPO3 Release Team <typo3v4@typo3.org>
Tested-by: TYPO3 Release Team <typo3v4@typo3.org>

Change-Id: Ib1d17b43dce8d0abd1c56494495f62863cb3d18d
Reviewed-on: http://review.typo3.org/32936


Reviewed-by: TYPO3 Release Team <typo3v4@typo3.org>
Tested-by: TYPO3 Release Team <typo3v4@typo3.org>

Change-Id: Iea9655ddd56df9fbba3d4f769eab1c2fbd8c4f68
Reviewed-on: http://review.typo3.org/32935


Reviewed-by: TYPO3 Release Team <typo3v4@typo3.org>
Tested-by: TYPO3 Release Team <typo3v4@typo3.org>

Change-Id: I29de73b589d2adf8a66f08455048f5b709ad5d02
Reviewed-on: https://review.typo3.org/31509
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Ic994e542cd4bab39a88fd1426d718b9174867783
Reviewed-on: https://review.typo3.org/31508
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Iffabf254620824d1d0b7a42e239576bd3aa73791
Reviewed-on: https://review.typo3.org/30309
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I296aa228d3d9ffda43cf99a41d3ac36d8b93f439
Reviewed-on: https://review.typo3.org/30308
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Helmut Hummel authored May 22, 2014 and Oliver Hader committed May 22, 2014

TYPO3 uses the values of HTTP_HOST in several
places without validating them. This could
lead to a situation where links are generated
using the host part from HTTP_HOST.
Since HTTP_HOST headers are user input and
can be spoofed by an attacker, it leads
into several potential and actual security issues.
To address this, a configuration option for
trusted hosts is added, which is evaluated every
time getIndpEnv('HTTP_HOST') is called.
The configuration option is
$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern']
and can contain either a regular expression or the
value "SERVER_NAME"
To properly output the exception message in case
the trustedHostPattern does not match,
we need to adapt the exception handlers slightly
to not log information in this case and to actually
show the message even in production context to not
confuse admins on what is currently going wrong.
To not break all existing installations, the default
pattern is set to 'SERVER_NAME' which allows all
HTTP_HOST values matching the SERVER_NAME (and
optionally the SERVER_PORT if a port is specified
in the HTTP_HOST value).
This will secure all installation which use properly
configured name based virtual hosts, but leaves
installations where the web server is not bound
to a specific host name still in an insecure state.
Fixes: #30377
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Bulletin: TYPO3-CORE-SA-2014-001

Change-Id: Id210212e6fbd186a273f92b340d5060e9c6f900d
Reviewed-on: https://review.typo3.org/30275
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader

Change-Id: I5bb6b9f459f7f22157a917a8e77ddbe111fd60d1
Reviewed-on: https://review.typo3.org/29515
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Iaba6bc222c65a196239ad222bb6335fb5ffa6e3a
Reviewed-on: https://review.typo3.org/29514
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I3073c38f3df08f909e9d29b58acbd8f1671272c9
Reviewed-on: https://review.typo3.org/26227
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Ied61f0997ee99da6866d4c3d43fd46ed213c6c83
Reviewed-on: https://review.typo3.org/26226
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I0c80cd295e4146fb8c5c9ac2c9e3188d18f5959e
Reviewed-on: https://review.typo3.org/25695
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I3e7c742865cf45eb50918e3de4029fa60beea15d
Reviewed-on: https://review.typo3.org/25694
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Ifd4a45e440a1b25df360163d7c67a0f85ea58099
Reviewed-on: https://review.typo3.org/23780
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Ic083947be2c806f1edf2f177163dae4d6c36fce4
Reviewed-on: https://review.typo3.org/23779
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: If965931f73498172f9950382421c293ae417afd2
Reviewed-on: https://review.typo3.org/22714
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I51cad328946686b1aa0bb37a2c8744f77794fcb4
Reviewed-on: https://review.typo3.org/22713
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I73ac008099c789255f184785e52069d26764a03f
Reviewed-on: https://review.typo3.org/22525
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I60233a700dd013cc905f9b19bc5abf9d0b8cf26a
Reviewed-on: https://review.typo3.org/22524
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I2ad5f71706e9caeaa0e1b2c32b95d075334b24ef
Reviewed-on: https://review.typo3.org/21027
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I340309f0355c3b2a1d976ea4cdcd067ac66e226a
Reviewed-on: https://review.typo3.org/21026
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I58f86edced0c72436a14ae9ed1ac57a3700bdc62
Reviewed-on: https://review.typo3.org/20451
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: Icf32e527e7c19afe18e2b0ef89dfb9a34ae11942
Reviewed-on: https://review.typo3.org/20450
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

The documentation is now located at docs.typo3.org.
Update the URL accordingly.

Change-Id: Ib9b102e0705742fe0b1498f6a7c22cbc0d23a333
Resolves: #47621
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Reviewed-on: https://review.typo3.org/20251
Reviewed-by: Jigal van Hemert
Tested-by: Jigal van Hemert

Change-Id: I67350696542cfd9a96f2d711e7349e6ea89a08dc
Reviewed-on: https://review.typo3.org/20086
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I3497e1cd620e6ed0ca49c6d143580a48cdcb501d
Reviewed-on: https://review.typo3.org/20085
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Some versions of Imagemagick (6.7.0 and above) use the sRGB colorspace
instead RGB as before. This results in darker images after processing,
because TYPO3 hardcoded the RGB colorspace in graphical functions.

This patch introduces a setting in the GFX part of the Install Tool,
lets the user choose the sufficient colorspace.
This selection is used in graphical functions.

Additionaly a hint on the setting was added to the Image Processing Test
'Read Images' in the Install Tool.

Fixes: #36597
Releases: 6.1, 6.0, 4.7, 4.5
Change-Id: I50a26c414705afa3177a2f12fc3bb4532c2d0f7f
Reviewed-on: https://review.typo3.org/19725
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring

Resolves: #46085
Releases: 6.1, 6.0, 4.7, 4.6, 4.5
Change-Id: I970078281d129be8ffef0bef128b23354ce59ddd
Reviewed-on: https://review.typo3.org/18785
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn

Change-Id: I884b7a09079e0aa45426e423e1ff91272c5d5802
Reviewed-on: https://review.typo3.org/18772
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I930eee365b05613162ca5d386d7e4c36511fb4b0
Reviewed-on: https://review.typo3.org/18771
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I34308235cb9a9a3518427bc01be6a6a40f8bd24d
Reviewed-on: https://review.typo3.org/18742
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: If6102d6b79cfd35350b8e80b90a54a6d14ef065a
Reviewed-on: https://review.typo3.org/18741
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I7c5941f836186c44643006c04f75b493b212f67a
Reviewed-on: https://review.typo3.org/18278
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Change-Id: I5e9b7cd9903a0419677c9184f7707237402d332d
Reviewed-on: https://review.typo3.org/18277
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team

Mario Rimann authored Nov 27, 2012 and Christian Kuhn committed Jan 24, 2013

In #35154 the PHP error_reporting defaults have changed and
this now changes the description in the install tool.

Change-Id: I5c5b0fec5f7e521fcd61812a36149590e08905fa
Fixes: #38240
Releases: 6.0, 4.7, 4.6, 4.5
Reviewed-on: https://review.typo3.org/17626
Reviewed-by: Mattias Nilsson
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn