[SECURITY] t3lib_div::quoteJSvalue allows XSS

When t3lib_div::quoteJSvalue() was used with second
parameter set to TRUE closing HTML script tags were
not escaped correctly.

Now every character except harmless ones is encoded
to a hex representation.

Change-Id: I98d752ca13abb8655eb1fc06c003d9228c61b952
Releases: 6.0, 4.7, 4.6, 4.5
Fixes: #23226
Security-Commit: 5df5647a9ed543de5451f4ab4baa6767218d89db
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13745
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in Indexed Search statistics

Indexed Search statistics module is vulnerable to
persistent XSS attack injected by arbitrary frontend users.

Change-Id: I084bffd1e0b489e6f061f5672f7fb12b3bab1aee
Fixes: #31927
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 62ae11e97b563746bed0884d8f3d52d8fc3ea84a
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13746
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Untrusted GP data is unserialized in old CSH handling

Using the old and already deprecated CSH handling in TYPO3 backend,
untrusted GP data is unserialized. Validate the submitted data with
an hmac.

Change-Id: Ifc93c7d853c2b0df59dd12ab95a7ce1ee4a28a8e
Fixes: #33520
Releases: 6.0, 4.7, 4.6, 4.5
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13747
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Information Disclosure in the Configuration Module

The configuration module showed the encryption key as plaintext.
For this view, the encryption key is masked and it's length is
shown instead, e.g. "***** (length: 96 characters)"

Change-Id: I8ed5ee014f686fdf8ff527c0b569218c51a9bcaa
Fixes: #39345
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 585cf4f52ff4e946f31371f4cb6fde33d398d4d4
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13748
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] HTML5 support in RemoveXSS

Add support for HTML5 tags and attributes in RemoveXSS.

Change-Id: I2a5545a703ad149eb5eb5f308ba1857b1af5cd30
Fixes: #37127
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 440c49e1d129be446f3e28e8db77407bb4d095e1
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13749
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in Scheduler Example Task

The scheduler test-task that sends an email does not properly
sanitize the input of the email field when rendering the editing
form of that task.

Change-Id: Idb4c998fd712552fbb80af77c2856d46aadbf44a
Fixes: #30967
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 5ee5c9798fdb04b106b72ab941532e7a68f43a98
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13750
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in TCE forms

Properly encode field labels that are set via TSConfig.

Fixes: #25356
Releases: 6.0, 4.7, 4.6, 4.5

Change-Id: I23fc1de4ceeab54e1d3d97bc27870a0c070b6038
Security-Commit: 8ddba7927a643e94b491cafd5f348551fdea84ca
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13751
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in validateForm

Properly quote the form name and field list
for the JavaScript validation

Fixes: #25052
Releases: 6.0, 4.7, 4.6, 4.5

Change-Id: I98bfef92b5595ab343a49e1cba1d8b2563d1d8aa
Security-Commit: d832f7be6bad577ba0be08a7382b421a433ee07f
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13752
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Page Link Target vulnerable to XSS

This patch adds htmlspecialchars to page link target to prevent
XSS.

Change-Id: I9e1ab1ac22c7bc1225f1d3d3234865e1e603656b
Fixes: #32653
Releases: 6.0, 4.7, 4.6, 4.5
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13753
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in install tool

In the "Basic Configuration" section, some configuration values are
rendered without proper escaping both as input fields or as
regular content of the page. These values are htmlspecialchars-
treated now.

For the "All Configuration" form, all input fields and text area fields get now htmlspecialchars-treated.

Change-Id: Ic40340c9d0a4242d31a7202c140b9ba0d1f88184
Fixes: #21634
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 3b42f81101b537481734204308ad7ce99fd99cb5
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13754
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader