[FEATURE] Add new way to register a TCA wizard

Wizards used to be registered by defining a script path
to an entry script. Since we now aim to reduce
the number of entry scripts, wizards should be called
through mod.php and be registered accordingly.
However with the additional requirement of adding
CSRF protection for all mod.php calls, we cannot
hard code the script URLs for wizards any more.
Instead BackendUtility::getModuleUrl should be used,
which adds the CSRF protection token.
Since this token depends on the current user session
and TCA might be cached, we need a new way to register
a wizard by just specifying the module name in TCA.

FormEngine should then take care to call
BackendUtility::getModuleUrl()

Resolves: #56268
Releases: 6.2
Change-Id: I8dfd2f49257f673e0490e2553da63359a8e68776
Reviewed-on: https://review.typo3.org/27841
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[TASK] Use new way to register edit wizard

Resolves: #56272
Releases: 6.2
Change-Id: Idfcb04fac9f1c4e6637b7df929694b193266c825
Reviewed-on: https://review.typo3.org/27842
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[TASK] Form sysext entry script cleanup

The form sysext contains a wizard to provide help for form creation.
This script used the init.php entry script. This is no longer wanted,
but the API can be used to add wizards.

To do so, some files were moved around and follow the same schema
as shown in openid sysext.

Change-Id: I6b6c41de6c271c56404151b1ec95f45e6f7786af
Resolves: #55669
Releases: 6.2
Reviewed-on: https://review.typo3.org/27347
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[TASK] Deprecate unused methods in ElementBrowser

There are 3 methods in ElementBrowser which are never used in the core.
We deprecate them, so they can be removed two versions later.

The methods are:
 * checkFolder
 * isWebFolder
 * setRecordList

Releases: 6.2
Resolves: #55985
Change-Id: I3e4f34e7ebaba9e8eeb0332e9f43c0e4acd2e706
Reviewed-on: https://review.typo3.org/27847
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Oliver Klee
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[BUGFIX] URL-encoded title in link wizard

The security fix introduced a bug that the title is encoded
every time the link wizard is opened, leading to multiple
encoded strings.

Solution is to not encode it centrally but encode it just
before using it in the JavaScript context.

Fixes: #41413
Releases: 4.5, 4.7, 6.0, 6.1, 6.2
Change-Id: I6b08db290d5457761edc4506105672d79840764d
Reviewed-on: https://review.typo3.org/23740
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Oliver Klee
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[BUGFIX] Paginator in TER list not using ajax

The paginator in the extension list from TER is transformed into
using Ajax. This fails because this process searches for links inside
a class which is used by the frontend paginator widget. Changing it to
the id of the backend paginator widget makes the ajax calls work again.

Resolves: #56184
Releases: 6.2, 6.1, 6.0
Change-Id: I06c193b2657eb3edae623dc0126b06c240f486c6
Reviewed-on: https://review.typo3.org/27843
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[BUGFIX] Install Tool fatal with Oracle database

Installing TYPO3 with an Oracle database (oci8) fails.
After selecting oci8 and passing the credentials,
the install wizard crashes with:

PHP Fatal error: Cannot use object of type
TYPO3\CMS\Core\Configuration\ConfigurationManager as array in
typo3/sysext/install/Classes/Controller/Action/Step/DatabaseConnect.php
on line 93

Obviously $config got mixed up with $configurationManager.
Fix this typo.

Resolves: #56253
Releases: 6.2
Change-Id: I58c1bc27f56b9a527d1d8fde7cf39b4ecd3ef7b6
Reviewed-on: https://review.typo3.org/27846
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Wouter Wolters
Reviewed-by: Steffen Müller
Tested-by: Steffen Müller
[BUGFIX] Fix JS error in ElementBrowser

Fix for #41413 did not remove a superfluous parentheses.
This is causing a JS error now.

Backports of the original patch are fixed already.

Resolves: #56289
Releases: 6.2
Change-Id: Iff0e73a28c9428d931f44b538106b6120ccc4e6a
Reviewed-on: https://review.typo3.org/27854
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[CLEANUP] Superfluous Code in ElementBrowser and BrowseLinks

Resolves: #56290
Releases: 6.2
Change-Id: I85348aea9fd514b9774b63846f444fcb9a8310e4
Reviewed-on: https://review.typo3.org/27856
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[CLEANUP] Remove outdated $CLIENT[FORMSTYLE]

The functionality for having to deal with
browsers that did not support style="width: XYpx"
is not needed anymore, as any browser supported
in the TYPO3 universe can deal with that (even IE6).

This patch cleans up all the areas that dealt with
that part. Also, one dummy function in
FormEngine.php has been removed completely,
another in DocumentTemplate.php has been
deprecated.

Releases: 6.2
Resolves: #56254
Change-Id: I6f47a5f7cabfd340088c242f1ee15b83c7cba0fe
Reviewed-on: https://review.typo3.org/27824
Reviewed-by: Benjamin Mack
Tested-by: Benjamin Mack
[BUGFIX] Don't modify variables in tree view

The lowlevel array browser tries to modify the array that
is displayed if it's an object.
Now that TYPO3_LOADED_EXT is a simulated array (an object
which implements array access) modifying the data leads to
a fatal error. Instead the iterated value is now modified.

Releases: 6.2
Resolves: #54449
Change-Id: Ib1d3eb5cc76a4180ea0891d88c16191cd16f36e2
Reviewed-on: https://review.typo3.org/27850
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[BUGFIX] Wrong usage of intExplode in getTreeList

getTreeList calls intExplode which converts empty
arrays to 0. This patch removes empty arrays
within intExplode.

Resolves: #55384
Releases: 6.2
Change-Id: Id4ca1a15edf2cc2617d85bda765461c4cb1f105c
Reviewed-on: https://review.typo3.org/27089
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Benjamin Mack
Tested-by: Benjamin Mack
[TASK] Fixen broken tests for getTreeList

Resolves: #56294
Releases: 6.2
Change-Id: I1d86f1899447feaa301474f4ed247a0ecc6c1a6e
Reviewed-on: https://review.typo3.org/27859
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Followup: Ajax handler TYPO3_tcefile::process is broken

Upload action was taken care of, but the ajax handler can be just
for all commands that ExtendedFileUtility->processData can handle.

This change checks the result set and flattens
data only when needed.

Resolves: #56084
Releases: 6.2, 6.1
Change-Id: Ic1a0bd9084b9eb206b9b53960890d22d2a9c56f5
Reviewed-on: https://review.typo3.org/27739
Reviewed-by: Alexander Schnitzler
Tested-by: Alexander Schnitzler
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Allow record insert on rootlevel

The DataHandler function checkRecordInsertAccess() does
now check the configuration for the root level.

Resolves: #52386
Releases: 6.2, 6.1, 6.0
Change-Id: I1810ea847e631ea6b242346a0271f491fd60fdf9
Reviewed-on: https://review.typo3.org/24166
Reviewed-by: Leon de Rijke
Tested-by: Leon de Rijke
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[!!!][SECURITY] Add CSRF protection to mod.php

Add a token check in mod.php and token generation
to BackendUtility::getModuleUrl()

Adapt code to use BackendUtility::getModuleUrl()
in every place where links are hardcoded.

Releases: 6.2
Resolves: #55509
Change-Id: I952c40fc1004a0a8d77c929927d37e1d93dcfef4
Reviewed-on: https://review.typo3.org/27636
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Respect all filemounts in file collection

The directory selector in a file collection now displays the folders
of all filemounts of a user. Before only the folders of the first
filemount were displayed.

Resolves: #55414
Releases: 6.2
Change-Id: Ic47f5163e2cfc7c89edcba4119f06620ed0fd56e
Reviewed-on: https://review.typo3.org/27119
Reviewed-by: Wouter Wolters
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
Reviewed-by: Frans Saris
Tested-by: Frans Saris
[BUGFIX] Do not save failed token messages in session

In #30272 the backend formprotection has been changed
to not save flash messages in the user session if
the current request is an Ajax request.

Unfortunately the check for that is broken
since the TYPO3_AJAX global is reset in the
bootstrap now.

Introduce a method which uses the request type
constants and adapt the tests accordingly.

Resolves: #56357
Releases: 6.2
Change-Id: Idae8be036b3747ea71509cc37008a4d694390627
Reviewed-on: https://review.typo3.org/27879
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
[BUGFIX] Avoid to get a file object with the uid zero

At some points where a file object is retrieved, a check for
the interpretation as integer is done for the method
argument only. If the argument is 0 a exception will be
thrown from the ResourceFactory.
A file object should only be fetched if the uid is an integer
greater than zero.

Resolves: #55530
Releases: 6.2
Change-Id: I9399d58bac4a48344769ac00207b64e25eea630e
Reviewed-on: https://review.typo3.org/27304
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Fix module access regressions

During the addition of the token check for mod.php
some places have been missed where a correct
token needs to be added.

Resolves: #56359
Releases: 6.2
Change-Id: I435cb36641fe96ecf050c915d200f94cbb31ce9f
Reviewed-on: https://review.typo3.org/27883
Reviewed-by: Markus Klein
Tested-by: Markus Klein