[SECURITY] XSS in be_layout wizard

Usage of unverified input parameters in wizard URL leads to a possible
XSS vulnerability in backend_layout wizard.
The solution is the introduction of a hmac validation of the parameters
used in JavaScript.

Change-Id: I55608bbbc587446f39b4012c9fed986a3e58fbaf
Fixes: #36768
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: e9ef9bcf819f4b384d88a93f28bb8a22ebe2cfca
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26187
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] feuser_adminLib.inc allows to set arbitrary fields

The CMS core ships a utility class helping extension authors
to create frontend-extension which need a mail-based opt-in.
This class is neither used by core nor really maintained.

In the opt-in process the fields which should be updated to
activate the user are put as URL parameter into the
activation link. In the default configuration this feature
set allows to set any values of any field to this record.

As a result a user could manipulate his activation link and
therefore extend his usergroups.

This patch ensures that all fields which are about to update
are added to the hash as well as only taking the values
from TypoScript so even if the fields match no harm can be
done.

Change-Id: Ic2325cbe714297e6d83e6a6d7436abe4981e8cb1
Fixes: #48187
Releases: 6.0, 4.7, 4.5
Security-Commit: 8bdaffd51a244657215c1d37150f749cbb7a8c79
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26188
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Fix open redirection in openid extension

The eID script of the openid extension does not
validate the given redirect url, leading to
an open redirection vulnerability.
Add and verify hmac of the redirect url.

Change-Id: Ic210b54b45dc275d684cd629d30819f09d3f1ca1
Fixes: #54099
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 5d4db5190b053b32ee4aacad04ea6a1486bd7c74
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26189
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader