[SECURITY] feuser_adminLib.inc allows to set arbitrary fields

The CMS core ships a utility class helping extension authors
to create frontend-extension which need a mail-based opt-in.
This class is neither used by core nor really maintained.

In the opt-in process the fields which should be updated to
activate the user are put as URL parameter into the
activation link. In the default configuration this feature
set allows to set any values of any field to this record.

As a result a user could manipulate his activation link and
therefore extend his usergroups.

This patch ensures that all fields which are about to update
are added to the hash as well as only taking the values
from TypoScript so even if the fields match no harm can be
done.

Change-Id: Id7d5e68d10c862aab0086755f880b5856f2141c5
Fixes: #48187
Releases: 6.0, 4.7, 4.5
Security-Commit: 57a6a356f33dcc7ec5fdb52b6857a010dd068936
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26199
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Fix open redirection in openid extension

The eID script of the openid extension does not
validate the given redirect url, leading to
an open redirection vulnerability.

Add and verify hmac of the redirect url.

Change-Id: I5d11061ad8d0059180942c62e016f81868f56e65
Fixes: #54099
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: c3e938848d92334b37e9b4f3793d844f52291662
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26200
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Information Disclosure in Wizards

It has been possible for authenticated editors
to show content of arbitrary tables and fields
that are defined in TCA by manipulating
GET parameters of the forms and table wizard.

This change adds a check if the editor has access
to the given record.

Change-Id: I3d3b318cefed36888d4cbbc00badad6c0818454c
Fixes: #41714
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
Security-Commit: 3c38aa1115a3a14e4fcd3408362d6a1bebe75155
Security-Bulletin: TYPO3-CORE-SA-2013-004
Reviewed-on: https://review.typo3.org/26201
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader