[TASK] Raise submodule pointer

Change-Id: I7d4e1642ef79513a564f0b02fe2ca36fa4c2e645
Reviewed-on: http://review.typo3.org/9987
Reviewed-by: TYPO3 v4 Release Team
Tested-by: TYPO3 v4 Release Team
[SECURITY] XSS for extension meta data in About module

Change-Id: I6ce1a90375b20c79c645a76b24713c718a06d529
Releases: 6.0, 4.7, 4.6, 4.5, 4.4
Fixes: #30969
Security-Review: http://review.typo3.org/9954
Security-Commit: 590a0dc93e1b66da085ed7f3788a4a3efe335a20
Security-Bulletin: TYPO3-CORE-SA-2012-001
Reviewed-on: http://review.typo3.org/10012
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in be_layouts

Some values from the backend layout configuration
are not properly escaped

Change-Id: I4e85bfe5ec1e6c2d28ef5fa02a5059b35df3fef1
Fixes: #29536
Releases: 6.0, 4.7, 4.6, 4.5, 4.4
Security-Review: http://review.typo3.org/9953
Security-Commit: 3829ac8cd35ee19cf56d22a420f15b9eea84f273
Security-Bulletin: TYPO3-CORE-SA-2012-001
Reviewed-on: http://review.typo3.org/10013
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS possibility in RemoveXSS

RemoveXSS fails to properly remove non printable characters, especially
zero-byte (\x00) chars.

Change-Id: Ia21e067edfcb568fae994ce1d339dd9c1724bd4b
Fixes: #30188
Releases: 6.0, 4.7, 4.6, 4.5, 4.4
Security-Review: http://review.typo3.org/9952
Security-Commit: fbc344bf1759262237a5af8ba08080f70efc51dd
Security-Bulletin: TYPO3-CORE-SA-2012-001
Reviewed-on: http://review.typo3.org/10014
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in BE file list

Change-Id: I0a689a566c57766bfa7b3197b0d9198ad289cdf2
Fixes: #30940
Releases: 6.0, 4.7, 4.6, 4.5, 4.4
Security-Review: http://review.typo3.org/9951
Security-Commit: 22625eda929ea4781a25c98f1bbaa40a1cdb70cb
Security-Bulletin: TYPO3-CORE-SA-2012-001
Reviewed-on: http://review.typo3.org/10015
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Missing escaping in scheduler

A proper escaping is missing for field "frequency"
Sanitize submitted uid

Change-Id: Iaf8f336342aa95daa4dfc145f1fb2029dd1aeb13
Fixes: #24474
Releases: 6.0, 4.7, 4.6, 4.5, 4.4
Security-Review: http://review.typo3.org/9950
Security-Commit: b60463b268821af9b189fa8fd35ffaccf1204ee3
Security-Bulletin: TYPO3-CORE-SA-2012-001
Reviewed-on: http://review.typo3.org/10016
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in show item

Change-Id: Id3fca3b9c58b5b20bbe1435fac3f0fccb54ed165
Fixes: #29397
Releases: 6.0, 4.7, 4.6, 4.5, 4.4
Security-Review: http://review.typo3.org/9948
Security-Commit: bf865ae162d560138d9f1054bd51bf536dcf7eb0
Security-Bulletin: TYPO3-CORE-SA-2012-001
Reviewed-on: http://review.typo3.org/10017
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Information disclosure showing DB name

By accessing a cli script in the frontend, it is possible
that the DB name is shown.

Change-Id: I405b5655aedbd17f45453a62f9fe9ad8c420642e
Fixes: #29060
Releases: 6.0, 4.7, 4.6, 4.5, 4.4
Security-Review: http://review.typo3.org/9947
Security-Commit: fd242fbb0ef6955d7e81bc9d54a305a1fd2f54b0
Security-Bulletin: TYPO3-CORE-SA-2012-001
Reviewed-on: http://review.typo3.org/10018
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[!!!][SECURITY] XSS in filelink element

Add escaping to description and file name of file link content element.
Warning: There is no longer HTML possible in description!

Change-Id: Ie690b60a06280d4cadd04cd08a82381a5e1f9fa0
Fixes: #25246
Releases: 6.0, 4.7, 4.6, 4.5, 4.4
Security-Review: http://review.typo3.org/9946
Security-Commit: df5cf5a42ce0c84c28394782e43f85c129f96ca8
Security-Bulletin: TYPO3-CORE-SA-2012-001
Reviewed-on: http://review.typo3.org/10019
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Missing escaping for sys_notes

sys_notes misses an escaping in info module

Change-Id: I684e33172c664e504174c02202fd71372f6a6e98
Fixes: #22748
Releases: 6.0, 4.7, 4.6, 4.5, 4.4
Security-Review: http://review.typo3.org/9949
Security-Commit: 7c56f512b20577bb286b792fc0eacc752b1c6a8a
Security-Bulletin: TYPO3-CORE-SA-2012-001
Reviewed-on: http://review.typo3.org/10020
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader