[SECURITY] t3lib_div::quoteJSvalue allows XSS

When t3lib_div::quoteJSvalue() was used with second
parameter set to TRUE closing HTML script tags were
not escaped correctly.

Now every character except harmless ones is encoded
to a hex representation.

Change-Id: Iab6793a3028976c4283cda466a2d3c6799b2554e
Releases: 6.0, 4.7, 4.6, 4.5
Fixes: #23226
Security-Commit: 70901d7dab2ba8cd314e931e98c3ec84b08fd0fb
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13735
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in Indexed Search statistics

Indexed Search statistics module is vulnerable to
persistent XSS attack injected by arbitrary frontend users.

Change-Id: I9298b5d1808cef9d123d4b9c3867f1f55dfe4efe
Fixes: #31927
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: f16df3528cb66183fd7371cf6a64f7f7da98dd74
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13736
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Untrusted GP data is unserialized in old CSH handling

Using the old and already deprecated CSH handling in TYPO3 backend,
untrusted GP data is unserialized. Validate the submitted data with
an hmac.

Change-Id: I0a6961b7db3e4b80270745421c82122deb4f6874
Fixes: #33520
Releases: 6.0, 4.7, 4.6, 4.5
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13737
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Information Disclosure in the Configuration Module

The configuration module showed the encryption key as plaintext.
For this view, the encryption key is masked and it's length is
shown instead, e.g. "***** (length: 96 characters)"

Change-Id: Id9561ca6c5812fb9bd6c177896a27854e8f0cdb4
Fixes: #39345
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 0e61891d3f872437729d2d5a2d976669e38bd938
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13738
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] HTML5 support in RemoveXSS

Add support for HTML5 tags and attributes in RemoveXSS.

Change-Id: I4487386f8c62d6ec32d9f66215ebd45e3ebf9cb0
Fixes: #37127
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 4868b1a837cc7263cb2a92e2007ce253f0303a7e
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13739
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in Scheduler Example Task

The scheduler test-task that sends an email does not properly
sanitize the input of the email field when rendering the editing
form of that task.

Change-Id: I82f63ff7267e4ba8da2e31a2659b0bca4cf83ed2
Fixes: #30967
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 7f96ebdff7db327825dbb8f835b1e6f8aee39ce1
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13740
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in TCE forms

Properly encode field labels that are set via TSConfig.

Fixes: #25356
Releases: 6.0, 4.7, 4.6, 4.5

Change-Id: Ic41ce41cf8babd27867e71764173cf4e6524843e
Security-Commit: efdf638fa6f2971d62195aa40137e19a89884a2b
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13741
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in validateForm

Properly quote the form name and field list
for the JavaScript validation

Fixes: #25052
Releases: 6.0, 4.7, 4.6, 4.5

Change-Id: I01527117c20e25963951502c2277b853f683fe04
Security-Commit: 20a6486d3027f474fb2352668cdb0fbee5f251f3
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13742
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Page Link Target vulnerable to XSS

This patch adds htmlspecialchars to page link target to prevent
XSS.

Change-Id: Ib8f812f89f892f580fc70300a4e4fa2287559dba
Fixes: #32653
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: f9987febc23355d9a4996eba7ac0039bfe801607
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13743
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in install tool

In the "Basic Configuration" section, some configuration values are
rendered without proper escaping both as input fields or as
regular content of the page. These values are htmlspecialchars-
treated now.

For the "All Configuration" form, all input fields and text area fields get now htmlspecialchars-treated.

Change-Id: Iba8a37ad24557f1af6772af8596660cab8d4bf7f
Fixes: #21634
Releases: 6.0, 4.7, 4.6, 4.5
Security-Commit: 835221d1b9b4f50a0769a5ed1f0116993b87da9c
Security-Bulletin: TYPO3-CORE-SA-2012-004
Reviewed-on: http://review.typo3.org/13744
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[RELEASE] Release of TYPO3 4.5.19

Change-Id: I6497d5ff720b47abd594e1e5b9ea11f17a3c254c
Reviewed-on: http://review.typo3.org/13775
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team
[TASK] Set TYPO3 version to 4.5.20-dev

Change-Id: I712fe72e2638caf8a3dbee37ac493d3410dce8da
Reviewed-on: http://review.typo3.org/13776
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team