[SECURITY] Information Disclosure in Wizards

It has been possible for authenticated editors
to show content of arbitrary tables and fields
that are defined in TCA by manipulating
GET parameters of the forms and table wizard.

This change adds a check if the editor has access
to the given record.

Change-Id: I99049be542c2c63b4b2a1699b0d0bea1f15454f4
Fixes: #41714
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
Security-Commit: 61344c8c36a4cedc0baaf3bd829ae27a986fcacd
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26190
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS vulnerability in extension manager

Add escaping on extension meta data when rendering.

Change-Id: I6f65cb5fb4f0d290349c15c03a3d52f4b0d18fda
Fixes: #20811
Releases: 4.7, 4.5
Security-Commit: 37665425f8e738cf6cd34e10f9efc3c45d5a53fb
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26191
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in header link of all content elements

The second typolink parameter, that is the target, can be abused to
introduce XSS code into the generated link. Escaping the parameter
with quoteJSvalue solves the problem.

Change-Id: I97726d35eaad8b6229efbe0b2127ac360b948bc9
Fixes: #31206
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 9a1154d09e9edff7480a3ef2431869068f174cca
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26192
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader