[SECURITY] XSS in beuser VH

The tree Display/* ViewHelpers introduce a XSS vulnerability by
using unescaped parameters in HTML.

Change-Id: I6b991e3cc3807551792e447c5ebe9bcdfe0cecc3
Fixes: #47086
Releases: 6.2, 6.1, 6.0
Security-Commit: 55d5ed4aa9e9c9887f978645b68ff66cb5c8d2ec
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26208
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in be_layout wizard

Usage of unverified input parameters in wizard URL leads to a possible
XSS vulnerability in backend_layout wizard.
The solution is the introduction of a hmac validation of the parameters
used in JavaScript.

Change-Id: I0cdaa75fcbdf8a71387702fcafe4775e7762eb99
Fixes: #36768
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 9322277a2154196de5d57a6a4ad42cb5a9ee6019
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26209
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Fix open redirection in openid extension

The eID script of the openid extension does not
validate the given redirect url, leading to
an open redirection vulnerability.

Add and verify hmac of the redirect url.

Change-Id: Id401c70ea96edb3979a11d72b7a499ab8d074a78
Fixes: #54099
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: a50ba077c411b21e05ee663f1065871938eb9cda
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26210
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader