[SECURITY] XSS vulnerability in extension manager

Add escaping on extension meta data when rendering.

Change-Id: I64cb5f23281ddb6c63439bf33aaeac1b1fa803b4
Fixes: #20811
Releases: 4.7, 4.5
Security-Commit: 647add5b8b668c173376ac45e4d227e4b25112d9
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26181
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Prevent editor controlled hmac content

An hmac of the editor controlled auto respond message was used to verifiy
the correctness of this message on submit. To prevent this, we add an
additional secret.

Fixes: #45043
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
(cherry picked from commit 66013e46f09b38343ac22d9e231328966bff0c6e)
Security-Commit: fa5bdd2ac518555f21ec857dc31d2991a1e937ad
Security-Bulletin: TYPO3-CORE-SA-2013-004

Change-Id: I66b1ddc379577fc3ed67012384a15c38a6b76a03
Reviewed-on: https://review.typo3.org/26182
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in colorpicker wizard

Encode user-input in JavaScript context for colorpicker.

Change-Id: Ia5d181bb74f3cbe2d2b7c75097655f9c7593b70d
Fixes: #42772
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 9fba6ded6247aaa74b974daf1c9bba5eb4aaf028
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26183
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader