[SECURITY] t3lib_div::quoteJSvalue allows XSS

When t3lib_div::quoteJSvalue() was used with second
parameter set to TRUE closing HTML script tags were
not escaped correctly.

Now every character except harmless ones is encoded
to a hex representation.

Change-Id: If890cc4b176e0d6a391adbe0dcb2dcfe536c1308
Releases: 6.0, 4.7, 4.6, 4.5
Fixes: #23226Security-Commit: bc3791c2ac8ceda854ab90256cc462e285aa9c51
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13755
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in Indexed Search statistics

Indexed Search statistics module is vulnerable to
persistent XSS attack injected by arbitrary frontend users.

Change-Id: I992ba279a2648949482c56f0f4a1eb88438624e1
Fixes: #31927
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: b95690beb6b1d3b9d3d9bfc75defc3f79aa06136
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13756
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Untrusted GP data is unserialized in old CSH handling

Using the old and already deprecated CSH handling in TYPO3 backend,
untrusted GP data is unserialized. There's no longer a code path
in TYPO3 to generate the GP data. So we can safely throw an exception
for requests with potential dangerous parameter values.

Change-Id: I98ccee42e10f64730bf18fe1633c8f2306a69aa6
Fixes: #33520
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 0c4c243a01473e9157ada11802ec83ca3055d999
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13757
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Information Disclosure in the Configuration Module

The configuration module showed the encryption key as plaintext.
For this view, the encryption key is masked and it's length is
shown instead, e.g. "***** (length: 96 characters)"

Change-Id: If3b7dbb055bd2587a1df3a241796728fd98f51ba
Fixes: #39345
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 3fd7178a0a54b778f5d899570a72f15852fc9945
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13758
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] HTML5 support in RemoveXSS

Add support for HTML5 tags and attributes in RemoveXSS.

Change-Id: Ibcb00dd8ddd40be0acf88a5b29c5e3a73d5a0d57
Fixes: #37127
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: a49962526bc21c79b9c3b8061eabb3a1573d5a70
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13759
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in Scheduler Example Task

The scheduler test-task that sends an email does not properly
sanitize the input of the email field when rendering the editing
form of that task.

Change-Id: Ib290b514ff49513a3d021e6c725270d5a46614f1
Fixes: #30967
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 0349d4d5f1651f2c8f9d4753be2724437e942411
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13760
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in TCE forms

Properly encode field labels that are set via TSConfig.

Fixes: #25356
Releases: 6.0, 4.7, 4.6, 4.5

Change-Id: I86efd0e725a66193c21eec2b8044d4c9bffe4405
Security-Commit: e2452741234c33c3f70a2440c1a706419bfbcecc
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13761
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in validateForm

Properly quote the form name and field list
for the JavaScript validation

Fixes: #25052
Releases: 6.0, 4.7, 4.6, 4.5

Change-Id: I1dcc451d498ff5ea8f34510ffbc9edebc49df046
Security-Commit: f738b4f2168eb3df53c7f808eafe1db8bc762a46
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13762
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Page Link Target vulnerable to XSS

This patch adds htmlspecialchars to page link target to prevent
XSS.

Change-Id: Iadf524cebd03428fad1880f25c1698fba4182135
Fixes: #32653
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: feefa613021d110792e4c47e1f26b2b708016743
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13763
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in install tool

In the "Basic Configuration" section, some configuration values are
rendered without proper escaping both as input fields or as
regular content of the page. These values are htmlspecialchars-
treated now.

For the "All Configuration" form, all input fields and text area fields get now htmlspecialchars-treated.

Change-Id: If8fb4e4b5d239decc14b9e039f4e151785b342ba
Fixes: #21634
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: fc68b42e9951f268acad92f6413ab04a94649e41
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13764
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader