[SECURITY] Unsafe unserialize of GET parameter in Add-Wizard

If the TCEforms wizard "add" is used, the original opened document
is closed and a new one is created in which you then add a new
element to be related.

In order to "store" the originating document which has been
edited, the Wizard/AddController and EditDocumentController
exchange state data in an URL-parameter.

This state-array is serialized in the EditDocumentController
and again unserialized in the Wizard/AddController from that
GET parameter. Without any checks, every code can be injected
to be unserialized here - even though we just need an array
with some data.

This patch changes serialize/unserialize to json_encode and
json_decode. Since the GET parameter only is used in
conjunction of these two classes it is save to changes the
format how the URL parameters are serialized.

Change-Id: I3b41bd0a688f067af2ea4a345ce0264f61bdecf7
Fixes: #54073
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 7148349140f9c8ccb6d847ef58cf1e032711315b
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26216
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Remove possible XSS from ActionController Error output

As parameters passed to an ErrorObject can be user input, the
output of those parameters in the ActionController::errorAction() method
could lead to a cross side scripting possibility.

The offending output has been removed without substitution.

Change-Id: I01385c54bb384a86fc6428f67171e7010b821cc2
Fixes: #54074
Releases: 6.2, 6.1, 6.0, 4.7. 4,5
Security-Commit: ec947ba22bd673827899c5e82857b293dff8b4b0
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26217
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in beuser VH

The tree Display/* ViewHelpers introduce a XSS vulnerability by
using unescaped parameters in HTML.

Change-Id: I0dadb03105d3eaa520f10f0375a46c83fa56c269
Fixes: #47086
Releases: 6.2, 6.1, 6.0
Security-Commit: 1e0f51f204efd9efacec8aef8ea08e2a8122177b
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26218
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in be_layout wizard

Usage of unverified input parameters in wizard URL leads to a possible
XSS vulnerability in backend_layout wizard.
The solution is the introduction of a hmac validation of the parameters
used in JavaScript.

Change-Id: I48f89309fc062d132e283d4fd9179ccbfdcfda4c
Fixes: #36768
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: a3ac48f5d66c566d241295d87cc8d7eb4d10c274
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26219
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Fix open redirection in openid extension

The eID script of the openid extension does not
validate the given redirect url, leading to
an open redirection vulnerability.

Add and verify hmac of the redirect url.

Change-Id: I0d65390b61dd5cf92151d36e490a194624b98b8f
Fixes: #54099
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 5c6a45c0f843a93ab048a3df4bb352b8e02099b2
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26220
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Information Disclosure in Wizards

It has been possible for authenticated editors
to show content of arbitrary tables and fields
that are defined in TCA by manipulating
GET parameters of the forms and table wizard.

This change adds a check if the editor has access
to the given record.

Change-Id: I8e27e5ffbccf148d951b50b21d9e15cc8e317442
Fixes: #41714
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
Security-Commit: 52d4e3eced81639820db6d75f3d65d14c5234072
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26221
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in backend user adminstration

Change-Id: I88807af69635d75f1fbefc62b4672e945397fb07
Fixes: #48691
Releases: 6.2, 6.1, 6.0
Security-Commit: 715b2c58c53f0109acce8c52df08d5dffea79f49
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26222
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Prevent editor controlled hmac content

An hmac of the editor controlled auto respond message was used to verifiy
the correctness of this message on submit. To prevent this, we add an
additional secret.

Change-Id: I1551feebd4dd84abeb3fb098175384f425f605a9
Fixes: #45043
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
Security-Commit: 344975268f4b9eb4ce7c664958647b9268ea03a8
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26223
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in colorpicker wizard

Encode user-input in JavaScript context for colorpicker.

Change-Id: I1121d6d20c90e476a2d0ea4f000b180e843a4ce0
Fixes: #42772
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: b6fec0611604ccdce95d4d33cd7dcae0911a5d9a
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26224
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in header link of all content elements

The second typolink parameter, that is the target, can be abused to
introduce XSS code into the generated link. Escaping the parameter
with quoteJSvalue solves the problem.

Change-Id: Ie91b022a2ffed039fb365e6b0be2ea39f7096514
Fixes: #31206
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 484cf1aea8d3e66db547325fe4d843d50a668162
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26225
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[BUGFIX] Use correct file data variable in Indexer

The processChangedAndNewFiles() method in the Indexer class now uses
the $fileIndexEntry variable for retrieving a file object from the
resource factory instead of the invalid $data variable which is NULL.

Resolves: #54312
Releases: 6.2
Change-Id: I3b9c2ce99f7b4b7c575cc4055c02912c306ed789
[BUGFIX] Clear statcache after writing file contents

To make sure calls to filesize() etc. return correct values the PHP
method clearstatcache() is called in the LocalDriver after contents
were written to a file.

Resolves: #54302
Releases: 6.2
Change-Id: Ia30e519d17aa3cf37856096f1cdac567b5729aec
[BUGFIX] Create valid file reference index data

This patch prevents the creation of sys_refindex entries that point to no
table and no record.

Additionally it fixes the array structure for the creation of
sys_refindex records for sys_file relations.

For deleted file references no reference will be created between
sys_file and the referenced table.

The configuration for the uid_foreign field was changed from a select
field for tt_content records to a normal input field to prevent the
creation of invalid refindex data. To which table uid_foreign is
pointing depends on the tablenames field.

To make sure both sides of the relation of a sys_file_reference appear
in the refindex table the exclusion of sys_file_reference as
foreign_table is removed.

Resolves: #53712
Releases: 6.2, 6.1, 6.0
Change-Id: Ic864ade10e4e97fbd9017b9c779be68d911dd626
[TASK] Use FAL functions for image rendering

Instead of relying on the backward compatiblity layer of the
FrontendContentAdapterService when rendering images with
css_styled_content the render_textpic method is modified so that it
is also be possible to use FAL functions and properties for image
rendering.

The captionsSplit / imageTextSplit constants are removed because
every image has its own properties for that with FAL and they are
not needed any more.

The globalCaption rendering was removed because the captions are now
always attached to a single image.

The longdescURL handling was also removed because the files do not
have this property at the moment and the longdescURL field for
tt_content records is also not visible in the Backend.

Resolves: #53764
Releases: 6.2
Change-Id: I1d9c8ad1d7a498816e724960613818a05d587d4f
[FEATURE] Custom active tab in RTE element browser

Introduce a flag that prevents the element browser of rtehtmlarea
from overwriting the active tab that was set by a hook object.

Resolves: #49036
Releases: 6.2
Change-Id: Iebfda39714caa98c0d2023992bbf63a2f5b9b01a
[TASK] Non extension dirs in llXmlAutoFilename

Allow non extension dirs (e.g. fileadmin) in
\TYPO3\CMS\Core\Utility\GeneralUtility::llXmlAutoFilename()

Fixes: #34728
Releases: 6.2, 6.1, 4.7, 4.5
Change-Id: I073f42ec8b6d733246151df331201031187e1baf
[FEATURE] Allow escaping of dots in TypoScript key

This patch allows the use of backslashes to escape
dots in TypoScript keys, for example:

my\.escaped\.key = test

will result in a single key "my.escaped.key" with the
value "test".

Resolves: #29461
Releases: 6.2
Change-Id: Idcaae75d9a8800134f4a82e0740ddabe35b3df89
[BUGFIX] Correct order of key / field deletion

Prevent a SQL error when deleting a key and the field belonging
to the key in the install tool at the same time.

Therefore the order for deleting keys and fields is changed from
field first and key second to key first and field second.

Resolves: #50450
Releases: 6.2
Change-Id: I30aff6ea6c2bf01dec6197eec8fd3aa7306cfcbb
[BUGFIX] Prevent exclude field mixup in FromEngine

Use a local variable for storing the excluded fields in the
FormEngine to prevent the configuration from being overwritten
by the inline form element renderer.

Fixes: #47359
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I5a7a2de16d767f854b4d3f89d599deec28266092
[BUGFIX] URL encode special characters in getPublicUrl()

The FAL method getPublicUrl() in the ResourceStorage should return a
valid URL. To archive this special characters and spaces are URL
encoded in the LocalDriver.

Resolves: #52806
Releases: 6.2
Change-Id: If1f3b6513b6feb0f24cd91be6998a686b54c467e