- 17 Nov, 2020 6 commits
-
-
Change-Id: I670b5e1551626d776d5746a8a7eec50dbdd82fdb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66666 Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
-
Instead of storing session IDs with their corresponding storage backends in plain text, their HMAC-SHA256 (Redis) or HMAC-MD5 (DB) is being used. HMAC-MD5 had to be chosen to avoid breaking changes for limited field size in database fields (32 characters currently). This change also allows a fallback to non-hashed-session values, meaning that * set() and update() will create new session records with the hashed identifier * get() contains a fallback to the non-hashed-version when no session with a hashed identifier is found Resolves: #91854 Releases: master, 10.4, 9.5 Change-Id: Ia57acc5e0d0cf71088af1aaff1ab894bd1d4e3dd Security-Bulletin: TYPO3-CORE-SA-2020-011 Security-References: CVE-2020-26228 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66657 Tested-by:
-
* XSS in `f:be.labels.csh` in argument `label` * XSS in `f:be.menus.actionMenu` in argument `label` * XSS in `f:form` in argument `fieldNamePrefix` Resolves: #92602 Releases: master, 10.4, 9.5 Change-Id: I7574bfb60eb2e11ecfb98d187f2edd580f43cd93 Security-Bulletin: TYPO3-CORE-SA-2020-010 Security-References: CVE-2020-26227 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66656 Tested-by:
-
Change-Id: Ie2adfafff4ab57cac9426d9a5784b794f459ea7c Resolves: #92829 Releases: master Security-Bulletin: TYPO3-CORE-SA-2020-009 Security-References: CVE-2020-26216 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66655 Tested-by:
-
The access settings is an exclude field and hence the value is synchronized to the translation. Fetching the translation overlay therefore does not need to evaluate the fe_groups again. Resolves: #91725 Releases: master, 10.4, 9.5 Change-Id: Ie6ec2208d15f67eafb6a48627c5f1b76ffdc5725 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66591 Tested-by:
TYPO3com <noreply@typo3.com> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
-
Benni Mack authored
With this change an undefined symbol is included when not having AdminPanel loaded: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66218 This change aims to change the logic for checking if the preview flag is enabled. Resolves: #92746 Reverts: #92242 Releases: master, 10.4, 9.5 Change-Id: I1005424a86f1ced595b23938bd6dcc70ff2f00c9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66589 Tested-by:
-
- 16 Nov, 2020 3 commits
-
-
Introduces Content-Security-Policy HTTP header check on fileadmin/ resources. This can be seen as follow-up up to TYPO3-CORE-SA-2020-006 and TYPO3-PSA-2019-010 now actively analyzing this HTTP header and letting users know in reports module and system environment check of the install tool. Resolves: #92835 Releases: master, 10.4, 9.5 Change-Id: I53028ae36c9195082993ee89d630efa7b555c547 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66629 Tested-by:
-
The session expiration time for the install tool is reduced from 60 to 15 minutes. When accessing the install tool via backend user interface, currently logged in backend users have to confirm their user password again in order to get access to the install tool. This process is known as "sudo mode". Standalone install tool is not affected by sudo mode confirmation. This change enforces mitigation as mentioned in TYPO3-CORE-SA-2020-006, see https://typo3.org/security/advisory/typo3-core-sa-2020-006. Resolves: #92836 Releases: master, 10.4, 9.5 Change-Id: Ib4f0e92346610879347a48587ffd575429b98650 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66634 Tested-by:
-
When switching to the "Language" module in the Backend, the module will show language flags and titles for content elements. However if the content element has language "All", neither flag, nor title will be displayed. This change adds the flag and the title. The fix is contributed by the University of Basel. Resolves: #92785 Releases: 9.5 Change-Id: Id26aaf39f1145b3075a4ff32bd263e1c672be4cc Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66575 Tested-by:
Oliver Bartsch <bo@cedev.de>
Tested-by: Dmitry Dulepov <9csxfqr4jy@liamekaens.com> Tested-by:
Oliver Bartsch <bo@cedev.de>
Reviewed-by:
-
- 13 Nov, 2020 1 commit
-
-
* replace string states with specific StatusMessage models * combine file path and base URL in new FileLocation model * streamline responsibilities of classes Resolves: #92834 Releases: master, 10.4, 9.5 Change-Id: Ib1a24fb00d4362062e88f93f236b3fd385015c3c Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66626 Tested-by:
-
- 12 Nov, 2020 3 commits
-
-
Resolves: #92821 Releases: master, 10.4, 9.5 Change-Id: Ife0999560d3da75051b663b55d46e0f6a5e03dfb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66607 Tested-by:
Anja Leichsenring <aleichsenring@ab-softlab.de> Reviewed-by:
Chris Müller <typo3@krue.ml> Reviewed-by:
-
Helmut Hummel authored
When creating a new image file, the indexing process must not try to extract with and height, when the file is empty to avoid warnings. Resolves: #92455 Releases: master, 10.4, 9.5 Change-Id: I6e906285c2767c8997c77df258ce6fe085e12790 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65969 Tested-by:
Helmut Hummel <typo3@helhum.io> Reviewed-by:
Oliver Klee <typo3-coding@oliverklee.de> Reviewed-by:
-
With #86219 the migration from sys_domain records to Sites was faulty. Formerly all known domain records were inspected in order to decide whether a domain was local or not. This was changed to an invalid check covering the current site only. This change now again validates all known sites. Resolves: #92626 Related: #86219 Releases: master, 10.4, 9.5 Change-Id: I2ce4dc0e8891ee2b438c42d20fff10428fafa7e9 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66252 Tested-by:
-
- 11 Nov, 2020 3 commits
-
-
Due to a refactoring and "unrolling" of buttons in TYPO3 v9, the TSconfig options.saveDocNew has been forgotten when adding a button to create a new record right while editing another one. Even if the new button nowadays is physically not a "Save and create new" action in the label, the behaviour is strictly the same as any unchanged edit will trigger a modal asking whether the changes should be persisted. Releases: master, 10.4, 9.5 Resolves: #87321 Resolves: #92788 Change-Id: Ic79f7ff06afef0cf9423780eef2d5324e5613664 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66579 Tested-by:
-
Anja Leichsenring authored
Two new options for the famous Build/Scripts/runTests.sh script have been added, that allow to quickly set up local environment for composer min and max testing. There is now - Build/Scripts/runTests.sh -s composerInstallMax for no platform.php setting and `composer update` preset and - Build/Scripts/runTests.sh -s composerInstallMin for platform.php set to current PHP version bugfix version 0 (like 7.2.0 or 8.0.0) and `composer update --prefer-lowest` preset Resolves: #92795 Releases: master, 10.4, 9.5 Change-Id: I13f782f2e73bb89404fcd2e18d507e2c39e4eba3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66610 Tested-by:
-
Anja Leichsenring authored
The formerly hard coded DBMS versions the local testing script Build/Scripts/runTests.sh received more options to run almost all supported DBMS versions by passing addidional parameters. Resolves: #92794 Releases: master, 10.4, 9.5 Change-Id: I402a605782c1063f4ec336d6279b768a79d1cc2b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66599 Tested-by:
-
- 07 Nov, 2020 3 commits
-
-
When using renderType textTable for text fields in TCA, the controller will pass the currently stored value to underlying API. This API always expects a string. Most of the time those fields might have null as default in persistence leading to a PHP TypeError. Therefore a check is added which will fall back to empty string as proper default for internal API. Resolves: #92761 Releases: master, 10.4, 9.5 Change-Id: I29ef4076e21a1f93f9b6834afcc163c4041a0909 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66574 Reviewed-by:
-
PHP versions 8.0-RC1, 7.4.12, 7.3.24 introduced a different behavior for `stream_wrapper_restore()` and would throw a PHP notice which is mitigated with this phar stream wrapper release. see https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.6 composer require typo3/phar-stream-wrapper:^3.1.6 Resolves: #92789 Releases: master, 10.4, 9.5 Change-Id: Ia2bc9b4fd7f568b9a4390205e1d332050904a15b Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66562 Tested-by:
-
Helmut Hummel authored
To benefit from faster operations and cleaner updates Composer 2 usage is now enforced by requiring ^2.0 of composer-runtime-api. Although currently there is no real code dependency yet to the runtime API introduced for Composer 2, this requirement enforces usage of Composer 2 for all interactions with this package (install/ update). The package is required as dev dependency to still allow "manual" usage of this package for classic installs and make the breaking impact low (composer install --no-dev will still work with Composer 1) For TYPO3 v11 this dependency will likely be a production dependency as well. composer up --lock composer req --dev composer-runtime-api:^2.0 Resolves: #92753 Releases: master, 10.4, 9.5 Change-Id: Ie919c0cf36a0818eea2124bb9623485d3d642066 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66565 Tested-by:
-
- 04 Nov, 2020 1 commit
-
-
When dragging content elements in page module, the colPos value of the dragged element is updated based on the dropped area. A drop area is a table cell `td` in which the elements are placed as `div`. The cell itself has the colPos set via a data attribute. This means moving an element (`div`) to another cell (`td`), the element gets updated with the colPos of the new cell. This did not work if `defLangBinding` was activated because all elements are then assigned to separate cells which missed the colPos information completely. The colPos information is now added to all cells in the `defLangBinding` view. Resolves: #92454 Releases: master, 10.4, 9.5 Change-Id: I1ab5cb0b3dd5574b6d3397dc52397365dc59d1ee Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66394 Tested-by:
Mathias Brodala <mbrodala@pagemachine.de> Tested-by:
-
- 31 Oct, 2020 1 commit
-
-
Andreas Fernandez authored
Resolves: #92739 Related: #92735 Releases: master, 10.4, 9.5 Change-Id: I94dc49ec3ef1c55a565cecab8a4d1553099acefa Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66360 Tested-by:
Andreas Fernandez <a.fernandez@scripting-base.de> Tested-by:
-
- 30 Oct, 2020 1 commit
-
-
Andreas Fernandez authored
Executed commands: composer require --dev friendsofphp/php-cs-fixer:^2.16.7 composer update typo3/class-alias-loader typo3/cms-composer-installers composer dump-autoload Resolves: #92735 Releases: master, 10.4, 9.5 Change-Id: I569b5566745b966c23e3f14a943bae38c4b52ca3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66356 Tested-by:
-
- 28 Oct, 2020 1 commit
-
-
Resolves: #92716 Releases: master, 10.4, 9.5 Change-Id: I0ad629f08cac11fbbffc2d61e9c4c8d7b2de7a23 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66329 Tested-by:
Christian Kuhn <lolli@schwarzbu.ch> Reviewed-by:
-
- 27 Oct, 2020 2 commits
-
-
Benni Mack authored
When the admin panel is active, the rendered page should always be marked as "preview mode" so TSFE will later set TSFE->no_cache which then allows to not store anything in the Page cache. Resolves: #92242 Releases: master, 10.4, 9.5 Change-Id: I6ef326d0a65b3b2c0dfdec7bf2bc29831c267b10 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66218 Tested-by:
Sybille Peters <sypets@gmx.de>
Tested-by: -
The Introduction page is updated to reflect current master. The text are changed in a way that they also apply for previous versions 10 and 9. Screenshots are replaced. Resolves: #92691 Releases: master, 10.4, 9.5 Change-Id: I9eb633f5446dc08636f97548920a6419b1fe8359 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66210 Tested-by:
Sybille Peters <sypets@gmx.de>
Tested-by:
-
- 22 Oct, 2020 2 commits
-
-
Version 2.11.0 and 2.11.1 contain breaking changes. In order to ensure smooth operation of Core and extensions, the version is now limited to 2.10.x and 2.11.2+ composer req doctrine/dbal "~2.10.0 || ~2.11.2" Resolves: #92376 Releases: 10.4, 9.5 Change-Id: I795561b13e0843fa7b46eb9383c99e8afd2ea153 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66253 Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
-
Using view helper `f:form.select.optgroup` with argument `disabled` throws PHP type error, since array is expected, but string given. Resolves: #92656 Releases: master, 10.4, 9.5 Change-Id: I7f1fd3a1f81c7befb15e4657c9e59ff862e663e1 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66205 Tested-by:
Daniel Goerz <daniel.goerz@posteo.de> Reviewed-by:
-
- 19 Oct, 2020 1 commit
-
-
Use the same sorting logic for page paths RealURL used, even if not consistently. Resolves: #92568 Releases: 10.4, 9.5 Change-Id: Id01be5ed57cb5cf62d0a04bfcfd1e4cd8733fea5 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66143 Tested-by:
-
- 13 Oct, 2020 2 commits
-
-
Christian Kuhn authored
Build/Scripts/checkIntegrityCsvFixtures.php --fix destroys field content that contain double quotes. Quote them properly. Resolves: #92554 Releases: master, 10.4, 9.5 Change-Id: Ib82974580a232eb4320303b3729b1ab1fda90c97 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66121 Tested-by:
-
This patch changes the behaviour when searching by username in the backend module "SYSTEM"->"Backend users": Before a LIKE search on the backend user UID was done, this leads to an SQL error at least on PostgreSQL, thus from now on searching in UID is only done if the term is an integer and then only returns exact matches instead of returning user with uid "1" and "10" when searching for "1". Resolves: #92520 Releases: master, 10.4, 9.5 Change-Id: I9820cae2a81b85dba68ba9bb00aeaa52cd2647eb Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66119 Tested-by:
-
- 12 Oct, 2020 1 commit
-
-
During the update, the value of the field log_data is unserialized. The expected value is an array, but it was never validated. If the field contains an invalid value, unserialize() returns a boolean false. Now the result is type casted to an array to ensure the correct type. Resolves: #91042 Releases: 10.4, 9.5 Change-Id: I2959da0ae5b74f0377285755175da447676ead68 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66114 Tested-by:
-
- 08 Oct, 2020 2 commits
-
-
Resolves: #91780 Releases: 10.4, 9.5 Change-Id: I3c13e69c87c25a3d90456c524d130156bac3e510 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66045 Tested-by:
Georg Ringer <georg.ringer@gmail.com> Reviewed-by:
Josef Glatz <josefglatz@gmail.com> Reviewed-by:
-
Georg Ringer authored
Resolves: #92362 Releases: master, 10.4, 9.5 Change-Id: I9db655907b321bce70285e3201e8ea6a3bd205f3 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66033 Tested-by:
-
- 02 Oct, 2020 1 commit
-
-
Several custom controller implementations allow calling internal *Action methods. In order to avoid unintended behavior and to streamline the application flow those invocations are defined now explicitly. ManagementController just had one possible action method and has been simplified in this regard. Resolves: #91564 Releases: master, 10.4, 9.5 Change-Id: I9092088ba66504562b42c522883c022955fa6f36 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64776 Tested-by:
-
- 29 Sep, 2020 2 commits
-
-
Benni Mack authored
Change-Id: I8dcbffef833bc2f3c3733adb9aad8251b04b7ae8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65956 Tested-by:
-
Benni Mack authored
Change-Id: Ic09e2ef96a4075fad469c2b859aaa818d03bba36 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65955 Tested-by:
-
- 28 Sep, 2020 1 commit
-
-
This patch ensures, that the plugin content element only calls the f:cObject viewHelper, when a plugin is selected in the list of available plugins. Resolves: #92413 Releases: master, 10.4, 9.5 Change-Id: I0fc8de43d5f72b6e113a00ed224c888da1981737 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65863 Tested-by:
-
- 26 Sep, 2020 1 commit
-
-
Andreas Fernandez authored
This patch updates all packages within their constraint boundaries, unless affected packages are sub-dependencies. The command `yarn upgrade` is used to update all packages. To make clear which direct dependencies have been updated, the version constraints in package.json have been raised. Resolves: #92419 Releases: master, 10.4, 9.5 Change-Id: I66a32b1a216a82ca639a1b6a7e705fa62b4f1335 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65900 Tested-by:
-
- 25 Sep, 2020 2 commits
-
-
Andreas Fernandez authored
Executed commands: yarn add ckeditor-wordcount-plugin@^1.17.6 grunt build Resolves: #92420 Releases: master, 10.4, 9.5 Change-Id: I82bfead7265a70afdec0b3f2e331afb2b3c2ef70 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65896 Tested-by:
-
Andreas Fernandez authored
Executed command: yarn add codemirror@^5.58.1 Resolves: #92414 Releases: master, 10.4, 9.5 Change-Id: Ic00ac9b6c673a9de805f658a84e44d0af54432b6 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/65886 Tested-by:
-
