- 12 Apr, 2022 1 commit
-
-
Change-Id: I835ca2cc5f309f2686eb8410159a3eca4c2b940c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74274 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
- 11 Apr, 2022 2 commits
-
-
Oliver Bartsch authored
A check in the FormEngine JavaScript component is fixed, preventing a corresponding error when changing the value of a single option group field, e.g. the "content_from_pid" field in pages. Additionally, a wrong selector, leading to a ReferenceError, is fixed as well. Resolves: #97342 Related: #95137 Releases: main, 11.5 Change-Id: I8c27f9ee4eddb032ec51ef66db99da3bf3c5a8d3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74253 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
- align README.rst, Index.rst, Includes.txt, Includes.rst.txt, Settings.cfg - add genindex.rst, Sitemap.rst - remove outdated Targets.rst - reference manual's start page with :doc:`<manual>:Index` Adding the custom label `start` to the beginning of the manual's Index.rst is redundant. Use :doc:`<manual>:Index` instead of :ref:`<manual:start>` to refer to it. - replace :ts: with :typoscript: text role The ambiguous :ts: text role has been removed to not confuse the writer with typescript and typoscript. - rename Includes.txt to Includes.rst.txt - align reST validator at Build/Scripts/validateRstFiles.php - remove outdated encoding note - fix rendering warnings of EXT:core - fix rendering warnings of EXT:dashboard - fix rendering warnings of EXT:linkvalidator - fix rendering warnings of EXT:lowlevel See https://docs.typo3.org/m/typo3/docs-how-to-document/main/en-us/GeneralConventions/FileStructure.html for further details. Resolves: #97258 Releases: main, 11.5, 10.4 Change-Id: I791c905d294a1eb71bd30ff2260f68be2b22f41e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74232 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Lina Wolf <112@linawolf.de>
-
- 08 Apr, 2022 3 commits
-
-
Warmup for frontend caches is not immplemented by TYPO3 core, but may be provided by third party extensions. Adapt the cache:warmup command description that frontend warmup may not be implemented/available. Resolves: #95058 Releases: main, 11.5 Change-Id: Iab4634ac96b3061876d970f6c38a88b8687648fe Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74237 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
Benjamin Franzke authored
The default light system-ui scrollbars are very distracting on the dark module menu surface. Therefore they are now replaced by a more appealing dark-mode scrollbar style, as provided by the browser vendor. Resolves: #95047 Releases: main, 11.5 Change-Id: Iecba9635118f4dc4ba612b286abe4562b53c5b75 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74255 Tested-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Benjamin Franzke <bfr@qbus.de>
-
All pagetree actions that use the "RecordCommit" endpoint (tce_db) (which is loaded in to the main list_frame) need to avoid requesting an explicit and too early page tree update from the server, as the page data may not have been updated at that point. The pagetree refresh actually is and needs to be triggered by an immediate action pushed by the RecordCommit endpoint. (in the list frame via <typo3-immediate-action> element) An early-refresh call – prior to the persistence of the record action – causes stale data to be fetched and displayed when that request ends up to be processed after the record commit request (that is the "race" that causes this to only happen sometimes). Example: Page icon sometimes doesn't change on deactivation. Affected page tree actions are: * disable/enable page * hide/show in menu * past into/after Note that these actions should ideally be migrated to AjaxDataHandler. Once that's done, the pagetree refresh can be added back. Resolves: #94393 Resolves: #95499 Releases: main, 11.5 Change-Id: I4e4059da78cf5b5bfebc5d67aacc89332a67d750 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74230 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Benjamin Franzke <bfr@qbus.de> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de>
-
- 07 Apr, 2022 6 commits
-
-
Check if the fileTarget is set before using it. Resolves: #97329 Releases: main, 11.5 Change-Id: Ibf5bf12600717acf1b705773655bf2d35c352502 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74235 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
Oliver Bartsch authored
- 'eval=int' does not exist for type=group - Empty 'eval' is superfluous Resolves: #97335 Releases: main, 11.5 Change-Id: Id12c15fcc6465def1836ff6c5c435c8be75ac4ba Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74234 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
Benjamin Franzke authored
The pagetree contextmenu click (right click) on node backgrounds must not trigger both, the system contextmenu and the TYPO3 context menu. This has already been done for node-texts, but the default event prevention was missing for node backgrounds. Therefore the native contextmenu is now also prevented whenever the custom context menu is triggered. Resolves: #97331 Releases: main, 11.5 Change-Id: I9a0ffcd6eb843fc2f13fa0da47480df2e99fdbe1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74228 Tested-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Benjamin Franzke <bfr@qbus.de>
-
The clipboard component uses a Bootstrap panel and is also wrapped by row/col elements, whose are superfluous. This patch removes the superfluous divs. Resolves: #97328 Releases: main, 11.5 Change-Id: Ic7c93592b5c8c2dc3315014bc8484af8c10b0aab Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74217 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
The determination of the duration used in Notification.showMessage() now takes `SeverityEnum.error` into account and sets the duration to 0, which is the same behavior when using `Notification.error()`. Resolves: #97315 Releases: main, 11.5 Change-Id: I1d6f50cc81c8a92031a570eae4e0bffc2b5441a7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74214 Tested-by:
Benjamin Franzke <bfr@qbus.de> Tested-by:
core-ci <typo3@b13.com> Reviewed-by:
Benjamin Franzke <bfr@qbus.de>
-
When nullable columns are shown in filelist module, an exception is thrown, because null may be passed to htmlspecialchars(). This change ensures that an empty string is passed to htmlspecialchars(), if the column value is null. Also the last parameter from the getProcessedValueExtra() function call is removed, since it equals the functions default value for the $forceResult parameter. Resolves: #97316 Releases: main, 11.5 Change-Id: I7d82aea0ed073f6f30944d53e0803ce848e30e53 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74145 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
- 06 Apr, 2022 1 commit
-
-
The check for doing the functional test splitting script and running the selected chunk used similar but different minimum chunk value to check against. Thus the splitting script has not been executed in all chunk execution contexts. This patch uses now exactly the same check in the 'Build/Scripts/runTests.sh' like it is defined in the corresponding docker-compose service config. Furthermore all previous created functional split files are now removed to avoid leftovers, which occured if re-run has lower chunksize defined. Example which is now properly fixed: > Build/Scripts/runTests.sh -s functional -c 1/1 Example with partial part files from previous run: > Build/Scripts/runTests.sh -s functional -c 1/10 > Build/Scripts/runTests.sh -s functional -c 1/8 Resolves: #97283 Releases: main, 11.5, 10.4 Change-Id: Id3a0d1c85540b4e7e46aaea69cf2d96839e8e72e Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74192 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
- 05 Apr, 2022 4 commits
-
-
Andreas Fernandez authored
Textarea can be configured in TCA to be read only and to have a richtext editor enabled. If `readOnly` is enabled, ckeditor is now rendered in a read-only mode instead of rendering a plain textarea containing HTML markup. Resolves: #97296 Releases: main, 11.5 Change-Id: I9e457123811ef53ad4e3e355a68e3f1e5701dcfc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74143 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de>
-
Andreas Fernandez authored
`RenderPreviewImportPageAndRecordsByUpdateWithDiff.php` has HTML markup with line breaks and tab characters. With some IDEs this may break if lines containing a tab only will get trimmed. All such characters are now replaced by explicit control characters to make sure the expectation does not break anymore when saving this file. Resolves: #97300 Releases: main, 11.5 Change-Id: Ifc5d7e39d6d69176b111d3361f741a89866f008b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74142 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de>
-
This patch applies the new documentation standards to the .editorconfig. Resolves: #97302 Releases: main, 11.5, 10.4 Change-Id: I798b355f71dfa7ba8ac20ad424105e99a5c870cc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74140 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Lina Wolf <112@linawolf.de> Reviewed-by:
Lina Wolf <112@linawolf.de>
-
Oliver Bartsch authored
The creation and modification time of files is now displayed correctly again, using the file info instead of the file metadata values. Especially when sorting by those fields, this previously led to discrepancies since the driver (performing the sorting) always uses the file info. See related patch: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74158 Additionally, non-admins are now also able to select the creation and modification time "fields" in the column selector. Resolves: #97290 Releases: main, 11.5 Change-Id: Ie9b4b7dccce68efeaac20998af4eeca204710f3f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74139 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
- 04 Apr, 2022 2 commits
-
-
symfony/rate-limiter:5.4.7 has a bug [1] leading to E_DEPRECATED warnings in our functional rate limiting tests. This is mostly test related so it does not make much sense to set this version as conflict. We'll comment two tests while waiting for a patch level release 5.4.8. [1] https://github.com/symfony/symfony/issues/45924 Releases: main, 11.5 Resolves: #97298 Change-Id: Ifb80a631830bb7b50fdc7c9d58d28e0dbf208ad1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74138 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
Georg Ringer <georg.ringer@gmail.com>
-
Implement missing sorting of files in the local driver. Resolves: #97261 Releases: main, 11.5 Change-Id: I94c04dfbd88b0f010c57ec68395f9edbc64c77c0 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74137 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Reviewed-by:
Andreas Fernandez <a.fernandez@scripting-base.de>
-
- 01 Apr, 2022 3 commits
-
-
Oliver Bartsch authored
Resolves: #97280 Releases: main, 11.5 Change-Id: Id6b2b5bf9a200d7c0ccc6c23273bb5086d6ee50a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74136 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
Resolves: #97270 Releases: main, 11.5 Change-Id: If1c899cdfd891cda5af5a502b40ab28c29830f58 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74135 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
Native date/time types have a zero-value, which is '0000-00-00 00:00:00' for DATETIME and '00:00:00' for TIME. For DATETIME values this position in time is really special - however, for TIME values '00:00:00' it would refer to midnight, which actually is common use case (and currently not possible in backend forms). Resolves: #97216 Releases: main, 11.5 Change-Id: Id77a3485e86008ff7c39319679120b2a73b0386c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74153 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
- 31 Mar, 2022 2 commits
-
-
Christian Kuhn authored
When core functional tests started to heavily rely on CSV based import- and assertion files, we found that editing such .csv files in Microsoft Excel leads to warnings if the number of columns is not identical for each row. Script checkIntegrityCsvFixtures.php has then been established to verify all rows of .csv fixture files have the same amount of fields per file, and has been enabled as CI job to ensure all existing fixture files follow this. Nowadays, this restriction feels archaic: Devs actively working with these CSV files typically edit them in an IDE like PhpStorm directly and don't use Excel for this anymore. The PhpStorm plugin "Rainbox CSV" also helps by coloring these files and other alternatives like libreoffice do not have this 'all rows must have same number of colums' restriction. The patch drops the script, the runTests.sh usage and the CI calls. This has the additional advantage that line breaks for single fields are now possible, which will further improve handling and readability of field values in upcoming patches. Resolves: #97274 Related: #83943 Releases: main, 11.5, 10.4 Change-Id: I2b4c2afc98c8471bccae1afb15e055182b563ee7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74130 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Resolves: #97269 Releases: main, 11.5 Change-Id: Iec86d579af4fa8774f7ba6bd4d6b137ccefe3dd5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74134 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
- 29 Mar, 2022 6 commits
-
-
With the introduction of symfony/property-access in TYPO3 version 10 reading properties through a lazy loaded object got broken. There have been workaround available like setting the property public so that the symfony package can access the property. Resolves: #92357 Releases: main, 11.5 Change-Id: Ibb383eeeee5afea69f503da0d617f22f6046936f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74117 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
The styling of the checkbox in the mass undo modal in the recycler module is fixed by using proper DOM structure and bootstrap classes. Resolves: #97249 Releases: main, 11.5 Change-Id: I47f5628bc21ba53fcf86d93af587403a1ebf32b7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74115 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
The unset($info['originalFile']) introduced in #90565 broke an access to that array key below in the method. This leads to the situation that files with UTF-8 characters are not found anymore since the imageLinkWrap() method is fed with an encoded version of the filename and not the original file object anymore. The patch parks $info['originalFile'] in a variable to access it for imageLinkWrap() again. Releases: main, 11.5 Resolves: #93716 Resolves: #90757 Related: #90565 Change-Id: I2471283bd6825c093745b2331a12737de00c105f Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74116 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Resolves: #97189 Releases: main, 11.5 Change-Id: I256b62b3c877cd23ac313fbb44a7bdde97aa2abc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74114 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
In accordance with the core code base, "libs" in "includeJSFooterlibs" must be lowercase. Releases: main, 11.5, 10.4 Resolves: #97251 Change-Id: I0b1d25d6f22254cf7d3747cf66ab0c7e2e611628 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74132 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
The contents of the column "Record" in the Recycler are escaped/encoded twice with htmlspecialchars. This leads to the display of & when the text contains an ampersand. Additionally some spacing was added next to the user avatar in the collapsed row. Resolves: #92857 Releases: main, 11.5 Change-Id: I131710895ecf7ea7ac36e26ba376853f666bdb9d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74071 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
- 28 Mar, 2022 5 commits
-
-
In #95036 the table editor was moved from the separate wizard to "inline". This implementation did not respect "table_delimiter" and "table_enclosure". This has been fixed by passing the delimiter and enclosure to the table component and parse depending on the set values. Resolves: #96536 Releases: main, 11.5 Change-Id: Id5cbeec5ad5b67c7fb108794b61f8c8dc17ef0b7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74070 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Resolves: #96954 Releases: main, 11.5 Change-Id: I60366ca5155c96ccc1068cc48339b0e96318d5f8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74069 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
This resolves a todo for a missing usage of a filled array called "$uniqueIds". This array had two responsibilities: 1. For inline fields with "foreign_unique" set, all already used unique ids must be excluded from the select items. 2. Ensure a select field inside an inline field, which functions as one (symmetric) side of a mn-table, will not have the same field we are currently in, in its select items. In short: This prevents self-references. The previous functionality has been restored with added type-safety. This functionality was probably removed by accident during a refactoring process. Resolves: #96487 Related: #64762 Releases: main, 11.5 Change-Id: I75d68fdaba5bdf896c336fe428652d15d760ac4c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74068 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
Christian Kuhn <lolli@schwarzbu.ch>
-
Oliver Bartsch authored
When a user is no longer available (e.g. deleted), record history entries for this user were not clear since only the general avatar without a name was displayed. This was especially confusing in case the "(via XYZ)" string was displayed, which happens if the change was done in switch user mode. This is improved by using the "[Not found]" label. Additionally, it now also ensures the "(via XYZ)" information is kept, in case the corresponding user is no longer available. Resolves: #97245 Releases: main, 11.5 Change-Id: I701098a07eab4969eefb24016f4351aef3de88bf Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74036 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de>
-
Resolves: #97228 Releases: main, 11.5 Change-Id: I139a7f2dcf1e5ed35675a626b9aa496fe24061a7 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74035 Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Bartsch <bo@cedev.de> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de>
-
- 26 Mar, 2022 1 commit
-
-
Recent CKEditor4 v4.18.0 addressed several vulnerabilities: * CVE-2022-24728 (XSS via attributes & comments) * CVE-2022-24729 (reDoS via Dialog Plugin API) * see https://ckeditor.com/cke4/release/CKEditor-4.18.0 for details Mentioned known vulnerabilities are not considered relevant for the TYPO3 backend user interface. By-passing CKEditor's XSS protection allows to persist malicious markup in database fields, which is mitigated during frontend rendering by typo3/html-sanitizer. That's why this issue is handled as regular bugfix. Executed commands: cd Build/ nvm use yarn add ckeditor4@^4.18.0 rm -r ../typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/ yarn exec grunt build Resolves: #97239 Releases: main, 11.5, 10.4 Change-Id: I3be12120c316b334e7efd237d0300e6d3cd165a8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74057 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Benni Mack <benni@typo3.org>
-
- 25 Mar, 2022 2 commits
-
-
Recent guzzlehttp/psr7 versions address vulnerability CVE-2022-24775. Mentioned known vulnerability is not considered relevant for the TYPO3 core. That's why this issue is handled as regular bugfix. Commands executed: composer req guzzlehttp/psr7:"^1.8.5 || ^2.1.2" composer req guzzlehttp/psr7:"^1.8.5 || ^2.1.2" \ -d typo3/sysext/core --no-update Resolves: #97240 Releases: main, 11.5, 10.4 Change-Id: I915b5620140912ecf1e0dc5bc887f4cc25ffb85a Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74060 Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
-
Oliver Bartsch authored
Using the hook ['Backend/Form/Element/ImageManipulationElement']['previewUrl'], one can define a preview url for the image manipulation wizard. If defined, a button is displayed, opening the defined url in a new window, while adding the crop variants as an additional query parameter. However, the query parameter was previously always added using "&" which failed, in case the defined preview url does not already define query parameters. This is now fixed by properly checking whether the url already contains further parameters when adding the crop variants. Resolves: #97236 Releases: main, 11.5 Change-Id: Iedfdfa10db036490a4a801b1614ad99016f0bdc3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74054 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
- 24 Mar, 2022 1 commit
-
-
Resolves: #97211 Releases: main, 11.5 Change-Id: Ic0165c1c88bae6ef5206d79691aa5918762dc14c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74034 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-
- 23 Mar, 2022 1 commit
-
-
Oliver Bartsch authored
The Scheduler module provides the option to execute symfony commands. Since those commands are usually built for CLI execution they might also contain interactive components like questions, which however can not be used when execution is scheduled. Therefore, the console input is now set to be non-interactive in the ExecuteSchedulableCommandTask "wrapper" class. Resolves: #97225 Releases: main, 11.5 Change-Id: I217c339ea0ef44ff91bcd8396d384227e8691184 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74033 Tested-by:
core-ci <typo3@b13.com> Tested-by:
Oliver Bartsch <bo@cedev.de> Reviewed-by:
Oliver Bartsch <bo@cedev.de>
-