[SECURITY] XSS in backend user adminstration

Change-Id: I1d31daf0dbc0dfa0ae49c17be9e6e85a85b8bea2
Fixes: #48691
Releases: 6.2, 6.1, 6.0
Security-Commit: 6fae30c4abb279085e21ddecc944e8e5de2cf773
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26202
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Prevent editor controlled hmac content

An hmac of the editor controlled auto respond message was used to verifiy
the correctness of this message on submit. To prevent this, we add an
additional secret.

Fixes: #45043
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
(cherry picked from commit 00316f7c5d61c9ec72aaf1ee1519e50357c8c6e7)
Security-Commit: b3c77b523c0f04109cd16a16378bf4d7665ac4fb
Security-Bulletin: TYPO3-CORE-SA-2013-004

Change-Id: I17136da945182c8fcf94fd7ce53aace872e2b8f7
Reviewed-on: https://review.typo3.org/26203
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in colorpicker wizard

Encode user-input in JavaScript context for colorpicker.

Change-Id: I83790887c4239d62b6783fd6269169085607b7d4
Fixes: #42772
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 8051c037ed6fae408c99cc9c29232d4c3f2a5504
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26204
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader