[BUGFIX] Add input string argument to Format.Crop ViewHelper

The Format.Crop ViewHelper did not provide a way to pass
the input string as simple argument; this patch now allows
this. An appropriate UnitTest is added; additionally an
augmentation to the ViewHelpers' DocComment, mentioning an
inline use case, is added.

Change-Id: Ia744fb10bf2e85c529c7c0b2629a8fa9c362e5a8
Releases: master
[FEATURE] Add errorClass to form.hidden VH

For use in JS-enhanced frontends it can be useful to attach errorClass
even to hidden fields (to detect validation errors).

Change-Id: Iabfe939014bf3997d805fd902ab1f7a6be401f45
Releases: master
[TASK] Remove dependency on installer

Rely on implicit dependency through TYPO3.Flow

Change-Id: I8a80c23c995dd3b76e8ab5187df3330e96e3603d
Releases: 2.0, master
[TASK] filemtime is namespaced in TemplateView.php

Change-Id: I583a28863564818dd0206937b74d4f0a86291603
Resolves: #45987
Releases: 2.0, master
Merge "[BUGFIX] Add input string argument to Format.Crop ViewHelper"
[TASK] Adjust Fluid to Lazy Dependency Injection

This adjusts the ViewHelperNode and AbstractWidgetViewHelper
to Lazy Dependency Injection introduced in Flow 2.0

Change-Id: I2a27be59aca05ef1a316f8d9942679fc503788ac
Related: #43819
Releases: 2.0, master
Merge "[FEATURE] Add errorClass to form.hidden VH"
[FEATURE] Add a Format.Case ViewHelper

This adds a Format.Case ViewHelper that changes
a string's case in various manners like uppercase,
lowercase, (un-)capitalization and
each-word-capitalization.

Change-Id: Ibabab201d3181b932945a5b38451b0ac6d8109ce
Resolves: #44572
Releases: master
Merge "[FEATURE] Add a Format.Case ViewHelper"
Merge "[TASK] filemtime is namespaced in TemplateView.php"
[BUGFIX] GroupedFor ViewHelper to support DateTime objects

The groupedFor view helper can group by DateTime objects as defined
in the properties of an object. It uses \DateTime::RFC850 format to
group by internally, so the the subsequent groupKey can use it to
format a valid date again.

Change-Id: I06bdbd29c794c3bb085cba13353e7470ffbb3962
Fixes: #44826
Releases: master
Merge "[BUGFIX] GroupedFor ViewHelper to support DateTime objects"
[TASK] Add packageKey attribute to ifHasRole view helper

This change adds support for handling a packageKey to the ifHasRole
view helper. It can be used in three ways:

1) The 'old' way, with just a string like 'Administrator'
   This will result in a check for the Administrator role within
   the current package (fetched from the controllerContext)
2) With a full role identifier like 'Foo.MyPackage.Administrator'
3) Using both, the role attribute and packageKey attribute

Change-Id: Iae92119bf9f8d6125211d1e4b1e42a0a513d804b
Related: #37451
Releases: master
Merge "[TASK] Add packageKey attribute to ifHasRole view helper"
[TASK] Remove leading backslash in use statement(s)

Change-Id: If99654189ac69742c95c1de8096a01e51471661c
[TASK] Revert: "Add packageKey attribute to ifHasRole view helper"

This reverts commit 806a29a4dabd5a7a90b55d819a39782a0a807cff
The change was merged too early by mistake. Related changes need to
be merged first.
see: https://review.typo3.org/#/q/status:merged+branch:master+topic:roles,n,z

Change-Id: Iefc877e227484f3a1db502b0da4d3f5e7fb7b0a7
Related: #37451
Releases: master
Merge "[TASK] Remove dependency on installer"
[TASK] Add packageKey attribute to ifHasRole view helper

This change adds support for handling a packageKey to the ifHasRole
view helper. It can be used in three ways:

1) The 'old' way, with just a string like 'Administrator'
   This will result in a check for the Administrator role within
   the current package (fetched from the controllerContext)
2) With a full role identifier like 'Foo.MyPackage:Administrator'
3) Using both, the role attribute and packageKey attribute

This was once Iae92119bf9f8d6125211d1e4b1e42a0a513d804b but had to be
reverted after an accidental merge.

Change-Id: If4c762c5de51c747495a3602eb56c56dd3972c73
Related: #37451
Releases: 2.0, master
[!!!][TASK] CSRF protection for "safe" request methods

This change set adjusts URL related view helpers in Fluid to
an important behavior for Flow applications: HTTP request
methods which are, by definition, considered to be "safe"
(that is, "read-only") are now treated as such.

The Fluid Link and Uri view helpers will not generate CSRF tokens
anymore, since we assume that you are using them for GET requests.
The FormViewHelper however, will enable link protection if the
form does not have method="get" set.

Please adjust your applications to cleanly observe this principle since
more optimizations in this direction are planned for later versions of
TYPO3 Flow.

Related: #47252
Releases: 2.0, master
Change-Id: Ic600a9e591d047ca9bbd39d352c4f337bcfaa6a9
[FEATURE] CSRF token ViewHelper

With I9d667aa451a7510cf12ab13be745fed1f7ca477e CSRF tokens
are not added to URIs any longer.
Therefore you need to add the token yourself for "unsafe" requests
(POST, PUT, DELETE, ...).

This is not true for fluid forms where the token is added automatically
if the form does not have method="get" set
(see Ic600a9e591d047ca9bbd39d352c4f337bcfaa6a9).

For other forms or AJAX requests the ViewHelper can be used like this:

<form action="<someAction>" method="post">
  ...
  <input type="hidden" name="__csrfToken" value="{f:security.csrfToken()}" />
</form>

Change-Id: I519c5ca522fede984bb93809a942b40a85008466
Related: #47252
Releases: 2.0, master