[SECURITY] Remove possible XSS from ActionController Error output

As parameters passed to an ErrorObject can be user input, the
output of those parameters in the ActionController::errorAction() method
could lead to a cross side scripting possibility.

The offending output has been removed without substitution.

Change-Id: I7cd09466af55f4b5b83581dcf164c5b8037cd45c
Fixes: #54074
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 2f2bd2db81f2a2b4de34839cce7d54e792572402
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26196
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in beuser VH

The tree Display/* ViewHelpers introduce a XSS vulnerability by
using unescaped parameters in HTML.

Change-Id: I2cb3ed3383e2feab4462d63c177c78917568cc12
Fixes: #47086
Releases: 6.2, 6.1, 6.0
Security-Commit: 860c3c0134cded680e5beb394ed89ef0ef6a81d2
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26197
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in be_layout wizard

Usage of unverified input parameters in wizard URL leads to a possible
XSS vulnerability in backend_layout wizard.
The solution is the introduction of a hmac validation of the parameters
used in JavaScript.

Change-Id: I58e9c9845ee88d374d3f06cf99d155a6816c1b35
Fixes: #36768
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 0960c276be49c555e6fd7c1fc4a65950b8a0af95
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26198
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader