[SECURITY] Check permissions in all actions of ResourceStorage

The ResourceStorage omits checks for the configured user and
group permissions within the actions on that Storage.

This patch refines some naming within the security methods
as well as adding security checks to every method.

PHP file extensions are now also removed from the
text file extension list.

Releases: 6.2, 6.1, 6.0
Fixes: #51079
Change-Id: I95a6d89da7eb2b6ea52afea1c49b1df8acb00707
Security-Commit: f5d926ec7a99098ad42117cf2e0b3b67dae057a4
Security-Bulletin: TYPO3-CORE-SA-2013-003
Reviewed-on: https://review.typo3.org/23595
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Add possibility to en-/disable file permission checks

For admins and for front end request, we must be able
to deactivate permission checks completely, while
it must be possible to restrict backend users
to not have any file permissions thus, not be able to
see/change any file.

Fixes: #51326
Releases: 6.2, 6.1, 6.0

Change-Id: I0b2ba16562d412e4a3bb523a54f7de317ea25c25
Security-Commit: eceac26733d6dff1826b149494532fb321274611
Security-Bulletin: TYPO3-CORE-SA-2013-003
Reviewed-on: https://review.typo3.org/23596
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Refactor and fix FAL user permission handling

* User permissions are only applied to storage objects
  that are attached to a member variable of
  BackendUserAuthentication. This is error prone
  and leads to insufficient (no) checks if the code
  fetches a storage directly from the factory
  (like edit document controller does)
  Instead, apply the permissions by using a signal
  in StorageFactory directly after the storage object
  is built.

* Refactor the mount point handling, especially the
  user and group home directories, which was completely
  broken after the introduction of FAL. File mounts
  are now also applied to the storage on creation.

* Make fallback storage 0 read only and not browsable.

Fixes: #51327
Releases: 6.2, 6.1, 6.0
Change-Id: If1fa18486cf051a7f4489e36691d42786386df63
Security-Commit: 936dbaf5d16acd36b668dcf033eb343fc5e2f7bf
Security-Bulletin: TYPO3-CORE-SA-2013-003
Reviewed-on: https://review.typo3.org/23597
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Deny arbitrary code execution possibility for editors

Because the filename is sanitized in the driver
after the check for denied file extensions is
performed, it was still possible to rename files
with denied file extensions.

We now perform the file extension check
on the final filename which is going to be used
by the driver.

This change makes the sanitizing method public
and introduces a basic implementation in
AbstractDriver to not break existing driver
implementations.

Fixes: #51495
Releases: 6.2, 6.1, 6.0
Change-Id: I2c055b7b070a5e13c2172d1f20fdcd83ee597e08
Security-Commit: de60d4ef37fc582e6349d5fa8ed13ec30d4892ff
Security-Bulletin: TYPO3-CORE-SA-2013-003
Reviewed-on: https://review.typo3.org/23598
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Identifiers may refer to resources outside the storage

The Driver needs to canonicalize all incoming identifiers at first,
and than check for their validity on every action performed.
If a canonicalized path resided inside a storage it does not contain
any ../ anymore.
An exception is thrown in that case.

Change-Id: I6114be2a517bb44753f92bea1b3b7dfdd42a2f1f
Releases: 6.2, 6.1, 6.0
Fixes: #50883
Security-Bulletin: TYPO3-CORE-SA-2013-003
Reviewed-on: https://review.typo3.org/23607
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Prohibit accessing storage 0 from backend UI

Manually accessing backend entry-points regarding files passing
an identifier with storage 0 may allow unfiltered access for read,
write, rename, create and delete actions.

The user interface must never deal with storage 0. Therefore
implement checks for storage 0 as protection.

Change-Id: Ia387dfac3057760800171163ff91cd9f55cab4b5
Releases: 6.2, 6.1, 6.0
Fixes: #50886
Security-Commit: b813a875ad76aa7860b76602eb1f32dcfc9fadcd
Security-Bulletin: TYPO3-CORE-SA-2013-003
Reviewed-on: https://review.typo3.org/23608
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[BUGFIX] mounts of same storage had same subfolder count in Filelist

When you opened the filelist module as user who just was allowed to see
a bunch of filemounts, the filemounts had either all or none the expand-
icon, based on the first file-mount of this storage the user has access
to.

Resolves: #48467
Releases: 6.2, 6.1, 6.0
Change-Id: I1e6a29e351a643f52c0f7a42fde38c9d9b2fc5cb
Reviewed-on: https://review.typo3.org/20981
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[BUGFIX] Do not register storage factory slot during install

In install tool context TYPO3_MODE is set to BE
but there is no backend user initialized.
Because of that the storage permission aspect
fails as it requires a valid backend user object.

Do not register the slot when in install tool context.

Releases: 6.0, 6.1, 6.2
Resolves: #51733
Change-Id: I2da95ccd357b730b97bcf99bef21b18c04469274
Reviewed-on: https://review.typo3.org/23621
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Recreate processig folder without permission checks

When fetching the processing folder and it does not
exist, it is created on the fly. This should be done
without checking permissions. However by making
storage 0 not browsable, permissions will be checked
when fetching subfolders.

Instead we now fetch the folder objects directly
from the driver, where no permission checks are done.

Resolves: #51747
Releases: 6.0, 6.1, 6.2
Change-Id: I1a4c3b183323151c436969a478c669adb3856476
Reviewed-on: https://review.typo3.org/23633
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Replace old images by sprite

Adding new images to sprite

Resolves: #50573
Releases: 6.2
Change-Id: I586c206bc84dd44230a6b56ea6e9deaf1d63849f
Reviewed-on: https://review.typo3.org/23546
Reviewed-by: Tymoteusz Motylewski
Tested-by: Tymoteusz Motylewski
Reviewed-by: Piotr Molewski
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[BUGFIX] Suggest wizard broken when used in a repeating flexform element

Get correct fieldConfig when in repeating flexform. Adjust
JavaScript a bit to make this work.

Resolves: #48474
Releases: 6.2, 6.1, 6.0
Change-Id: I7c8a5ecfc2f1d7cfb10ca86a40a3429d3a60ee1f
Reviewed-on: https://review.typo3.org/20990
Reviewed-by: Zach Davis
Tested-by: Zach Davis
Reviewed-by: Mattias Nilsson
Tested-by: Mattias Nilsson
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[BUGFIX] Enable ProcessedFiles to do file exists

Make storage 0 folder readable, browsable and writable
to mitigate the problems that arise with non
readable processing directories.

Also allow file exists in general if the
identifier in subject is in processing folder.

Resolves: #51808
Releases: 6.0, 6.1, 6.2
Change-Id: I1959d7911d955592db1771d608e8fafcc26c45e9
Reviewed-on: https://review.typo3.org/23660
Reviewed-by: Horst-Dietrich Frank
Tested-by: Horst-Dietrich Frank
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
Reviewed-by: Jakob Hombsch
Tested-by: Jakob Hombsch
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[BUGFIX] Disable caching for ADMCMD_view parameter

This prevents that previewing a page leads to an entry for this page
in the TYPO3 cache table because contents on this page might be set
hidden.

Resolves: #51682
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I154d790454bf6bf0215b83e493919107a6c5bd93
Reviewed-on: https://review.typo3.org/23558
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[BUGFIX] Follow-up to IRRE override strategy

In #49685 a more usable behavior of the override strategy
has been introduced for FAL usages. The new output from
TCEforms (FormEngine) lacks proper escaping of JavaScript
and HTML-Code.

This followup adds proper encoding and makes the
newly introduced isNew() method more robust.

Backports of the original patch will have to include
this patch-set directly.

Resolves: #51818
Related: #49685
Releases: 6.2
Change-Id: I2914b4606de4bee0f93861a2de0574362c98d166
Reviewed-on: https://review.typo3.org/23526
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[TASK] Check whether data was successfully imported in the functional test

Exception is thrown when fixture data can not be loaded into database.

Resolves: #51783
Releases: 6.2
Change-Id: If23657555940cb98954e0ec72ee7d8be53bea1b4
Reviewed-on: https://review.typo3.org/23640
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
[BUGFIX] Filename not displayed in selector (file_reference)

The selector values in BE-fields with type group->file_reference are
empty. The filename should be displayed at this place.

Resolves: #47414
Releases: 6.2, 6.1, 6.0
Change-Id: I9fa237d2cd14ff0e9b347736090bd2171eb8a747
Reviewed-on: https://review.typo3.org/23058
Reviewed-by: Steffen Ritter
Tested-by: Steffen Ritter
Reviewed-by: Frans Saris
Tested-by: Frans Saris
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[BUGFIX] Fix viewObjectNamePattern regression in Extbase

http://forge.typo3.org/issues/47609 introduced an Extbase
regression by changing the behaviour of viewObjectNamePattern
in the ActionController without deprecating it first.

This patch fixes this regression but keeps the wanted behaviour
by resetting the value of viewObjectNamePattern and introducing
a namespacedViewObjectNamePattern with the namespaced pattern.

Resolves: #51758
Releases: 6.2, 6.1, 6.0
Change-Id: Ie32b178e1799c396e969fd48f81f9fe6243f6e70
Reviewed-on: https://review.typo3.org/23668
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
Reviewed-by: Mattias Nilsson
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[FEATURE] Enhance youtube id getting

The preg_match to fetch the video id from an url do cover only a few
variation. The enhancement covers a lot more possibilities

Releases: 6.2
Fixes: #51728
Change-Id: Ie9d0b3b5dbfff4e129d37fcf351d1d8c5fcdfc98
Reviewed-on: https://review.typo3.org/23616
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
[FEATURE] Show upload form for extensions in Get Extensions section

This patch adds the upload form to the "Get Extensions" section in the
ExtensionManager.

Change-Id: Id8e698ba0d1c2cc1dddec61bba902d4913e1b01c
Resolves: #51776
Releases: 6.2
Reviewed-on: https://review.typo3.org/23639
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Do not add trailing slashes to files

In the security fix #50883 a canonicalize method
for folders has been used where items could
either be files or folders.

This added a trailing slash to files which triggered
a basedir PHP warning if basedir is configured
in PHP.

Use the canonicalize method for file paths instead
to fix this issue.

Resolves: #51761
Releases: 6.0, 6.1, 6.2
Change-Id: I9ef4b6a90ca257ad0104115bd7d48c4de68f135f
Reviewed-on: https://review.typo3.org/23696
Reviewed-by: Simon Schick
Tested-by: Simon Schick
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel