[SECURITY] Remove charts.swf to get rid of XSS vulnerability

The file charts.swf is vulnerable to XSS, is delivered
by ExtJS but not used in TYPO3 CMS at all.

Since the vendor of ExtJS did not fix this vulnerability,
we decided to remove it from TYPO3 sources.

Change-Id: I7d81fc44294473d041c8910e04c815d91efb409f
Fixes: #54526
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: fef11509739f8bddfeba0fc6f752ac93feb16f03
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30268
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Fix insecure unserialize in colorpicker

Change-Id: Iee9d2712ae3b489a89604cb7be8c2af27a924fe0
Fixes: #56458
Releases: 6.1, 6.0, 4.7, 4.5
Security-Commit: 36eb11e44d7faca68b3d6fefb1633a463cc22fac
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30269
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Encode URL for use in JavaScript

The url for the Open in New Window button must be quoted for
use in JavaScript to prevent XSS issues.

Change-Id: If3600662e79fb0945ca62b3a25feaf001180b88d
Fixes: #48693
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 8a9c1615f82cf0a8c3449ae37f47338da132e505
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30270
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in Backend Layout Wizard

Change-Id: I7e58e32a4d7146c2c341d756816c29f7c01ed31d
Fixes: #57576
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 7493eb3ec56903b00923dcabf00a04f34529ad18
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30271
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in template tools on root page

Change-Id: I6942457ce27ad22a33efd003ceaa96fa7460c0bf
Fixes: #54109
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 9abedcf7dc0fd59b602a2221ffd9a998636b8092
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30272
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in new content element wizard

Sanitize user-input colPos in new content element wizard.

Change-Id: I13ff938e7320c68c8ad3f88b0cb688bc4d43d839
Fixes: #48695
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 582087ad27cee5365ea36387bba28c1b62212564
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30273
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in (old) extension manager information function

Needs to be fixed also in 6.x, but the affected function is not
used anymore.

Change-Id: Iae077221a4a8ef8f3aacaeb9d679cc68e97799bd
Fixes: #54111
Fixes: #54113
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 6b746d50d9ee4fbf2eff3e3e4c0699100be983a2
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30274
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Add trusted HTTP_HOST configuration

TYPO3 uses the values of HTTP_HOST in several
places without validating them. This could
lead to a situation where links are generated
using the host part from HTTP_HOST.
Since HTTP_HOST headers are user input and
can be spoofed by an attacker, it leads
into several potential and actual security issues.
To address this, a configuration option for
trusted hosts is added, which is evaluated every
time getIndpEnv('HTTP_HOST') is called.
The configuration option is
$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern']
and can contain either a regular expression or the
value "SERVER_NAME"
To properly output the exception message in case
the trustedHostPattern does not match,
we need to adapt the exception handlers slightly
to not log information in this case and to actually
show the message even in production context to not
confuse admins on what is currently going wrong.
To not break all existing installations, the default
pattern is set to 'SERVER_NAME' which allows all
HTTP_HOST values matching the SERVER_NAME (and
optionally the SERVER_PORT if a port is specified
in the HTTP_HOST value).
This will secure all installation which use properly
configured name based virtual hosts, but leaves
installations where the web server is not bound
to a specific host name still in an insecure state.
Fixes: #30377
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Bulletin: TYPO3-CORE-SA-2014-001

Change-Id: Id210212e6fbd186a273f92b340d5060e9c6f900d
Reviewed-on: https://review.typo3.org/30275
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[RELEASE] Release of TYPO3 4.5.34

Change-Id: I296aa228d3d9ffda43cf99a41d3ac36d8b93f439
Reviewed-on: https://review.typo3.org/30308
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team
[TASK] Set TYPO3 version to 4.5.35-dev

Change-Id: Iffabf254620824d1d0b7a42e239576bd3aa73791
Reviewed-on: https://review.typo3.org/30309
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team
[BUGFIX] SoftReferenceIndex support for more values in class attribute

The SoftReferenceIndex parses and rebuilds typolink tags, but the
support for more than one value in class attribute is missing, because
the values don't get enclosed with quotes on rebuilding.
This leads to lost classes in typolinks in exports from impexp.

Resolves: #58484
Releases: 6.2, 6.1, 4.5
Change-Id: I12ed3be7f5be36254bcee57fcb24bf2a10f92f46
Reviewed-on: https://review.typo3.org/29853
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Wrong HTML in locallang_csh_pages.xlf

lang/4.5/locallang_csh_pages.xlf contains invalid
HTML structure a <p> tag should actually be a <b> tag.

Resolves: #58936
Releases: 6.2, 6.1, 4.5
Change-Id: Id37d424296628202d8d434e0cf9cafd8529da2c3
Reviewed-on: https://review.typo3.org/30331
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn