[SECURITY] Information Disclosure in Wizards

It has been possible for authenticated editors
to show content of arbitrary tables and fields
that are defined in TCA by manipulating
GET parameters of the forms and table wizard.

This change adds a check if the editor has access
to the given record.

Change-Id: I2a93d78da4d7c216920cf568cb08cea0f9fb1dac
Fixes: #41714
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
Security-Commit: d5445792546339d3731a1e37d7b269943775a94a
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26211
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in backend user adminstration

Change-Id: Ie4a34a40e167b7fe54da29d16e1e962668218907
Fixes: #48691
Releases: 6.2, 6.1, 6.0
Security-Commit: be70b6e6d6e2f5baa442ab244e72cddfcd804740
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26212
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Prevent editor controlled hmac content

An hmac of the editor controlled auto respond message was used to verifiy
the correctness of this message on submit. To prevent this, we add an
additional secret.

Change-Id: Id1fefa786737c7d7ef2b4496d853897cdecdde83
Fixes: #45043
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
Security-Commit: 18804436394a5ee7fdbebae8ef0b8511deb416e5
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26213
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader