[SECURITY] Extbase must not cache dynamic parts of queries

Do not cache the enable fields part of queries. This part
needs to be added on each query dynamically to reflect the
current context. (Time restrictions, User restrictions)

Resolves: #58369
Releases: 6.2
Change-Id: I492d5983ff6a06d72cd18cf9a08a0d62d304ac2b
Reviewed-on: https://review.typo3.org/29932
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Marcin Sągol
Reviewed-by: Jan Kiesewetter
Tested-by: Jan Kiesewetter
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer
[TASK] Update to phpunit 4.1

Do not forget to "composer update" test instances!

Updating from phpunit 3.7 to 4.1 is smooth, except two details:

* The mock framework dropped staticExpects, two test cases must
  be refactored to circumvent this.

* The mocker now tries to resolve method argument type hints, so
  those classes must exist and autoloaded, some FLOW dependencies
  are affected here.

Change-Id: Ie74bdad000182dde808d3771fa6eec4764a133da
Resolves: #58676
Releases: 6.2
Reviewed-on: https://review.typo3.org/29584
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Tymoteusz Motylewski
Tested-by: Tymoteusz Motylewski
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] DataProviderContext uses wrong member field in setter

Resolves: #58731
Releases: 6.2
Change-Id: Ic3c5417d19b165009ae500a19b565569e2d8b2b2
Reviewed-on: https://review.typo3.org/30028
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[BUGFIX] Remove failing extension installations

This patch takes care about removing extracted extension folders if an
installation fails. For new extensions the folder is simply removed, for
already existing ones a backup in typo3temp is done before the
installation process and restored if anything fails.

Resolves: #57606
Releases: 6.2
Change-Id: If6f251ebc5950aecfcdb97d722146d95cb7cfa74
Reviewed-on: https://review.typo3.org/29123
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Category tab not shown for file when filemetadata installed

As a result of the TCA caching changes the order of
the manipulations done in the sys_file_metadata TCA
have changed. As a result the categories tab disappears
when you install ext:filemetadata.

This patch ads an extra check in the TCA override and
adds the categories tab when sys_file_metadata is categorized.

Resolves: #58620
Releases: 6.2
Change-Id: I75c7d7ccf40d5a2cc200c7d0a4e69f674024f628
Reviewed-on: https://review.typo3.org/29945
Reviewed-by: Jan Kiesewetter
Tested-by: Jan Kiesewetter
Reviewed-by: Oliver Hader
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Sprite icons not shown

If first hit after clearing cache was not in BE context
some icons are not part of the sprite css.

This patch makes sure that these icons are registered
in every context.

Releases: 6.2
Resolves: #58758
Change-Id: I4c44c0f241f096c15e8257975b665ec89b60d2e4
Reviewed-on: https://review.typo3.org/30046
Reviewed-by: Fabien Udriot
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Invalid module token in openid wizard

Fix the double htmlspecialchars call by removing the one
in the controller. Fluid does it anyway.

Resolves: #58719
Releases: 6.2
Change-Id: I1a62c41b94150494e429cec913eb43e1ec3f7ca8
Reviewed-on: https://review.typo3.org/30026
Reviewed-by: Mathias Brodala
Tested-by: Mathias Brodala
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
Reviewed-by: Wouter Wolters
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] MM relations are not correctly resolved in Backend view

DataPreprocessor is taking care of preparing data for the form
view processed in the FormEngine. However, MM relations are not
correctly resolved in a workspace context.

The method DataPreprocessor::getDataIdList() is used for a mixed
kind of relations there, without properly applying the differences
for MM records. The rule is, to always use the live default id,
except for MM relations - use the specific workspace value.

Resolves: #58735
Releases: 6.2
Change-Id: I256969adb46bfea80681160e2901387a8c7c9a7d
Reviewed-on: https://review.typo3.org/30037
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer
Reviewed-by: Markus Klein
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Don't rely on not found database records impexp

The function exec_SELECTgetSingleRow could also return
FALSE in addition to NULL, so add a additional check.

Resolves: #58688
Resolves: #57348
Releases: 6.2
Change-Id: Ic04071f67f02cce12b11c34d46c084bc28ccc83a
Reviewed-on: https://review.typo3.org/29993
Reviewed-by: Marc Bastian Heinrichs
Reviewed-by: Nicole Cordes
Tested-by: Nicole Cordes
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Restore registers before early returns

Having an empty image list or a list of images with empty values
will not restore the loaded registers.
So we must restore the registers before any return.

Additionally, the $conf array does not need to contain any
values when calling RESTORE_REGISTER, since it won't handle
parameters anyway, so parameters would just waste memory.

Resolves: #56796
Releases: 6.2
Change-Id: I3e81c614b5c37a14da4b97e18a310e202ae7b766
Reviewed-on: https://review.typo3.org/28280
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Jo Hasenau
Tested-by: Jo Hasenau
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Wrong path reference for installToolPassword option

The [BE][installToolPassword] contains a suggestion to additionally
protect the Install Tool by protecting its folder by some server means.
The path specified is the legacy path /typo3/install/ which is only
a redirect to typo3/sysext/install/Start/, so the protection should
be on that folder.

Resolves: #58720
Releases: 6.2
Change-Id: I593b54878d0be7bd0307a6a5625173e6bbc58fa0
Reviewed-on: https://review.typo3.org/30027
Reviewed-by: Christian Ludwig
Tested-by: Christian Ludwig
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[BUGFIX] Wrong system requirements link

Resolves: #58842
Releases: 6.2, 6.1
Change-Id: Ibaf87d32778349d5a87009bcd2b365447e6488fa
Reviewed-on: https://review.typo3.org/30150
Reviewed-by: Johannes Kasberger
Tested-by: Johannes Kasberger
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[TASK] Unify DataHandler test structure

Resolves: #58868
Releases: 6.2
Change-Id: I0f5aeb1d211e542cb323fba11b07a0b8be7d3ed0
Reviewed-on: https://review.typo3.org/30175
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[TASK] Extend DataHandler IRRE functional tests

Extend CSV and ForeignField test with
* copyParentContentToDifferentPage
* modifyHotelChild

Resolves: #58854
Releases: 6.2
Change-Id: Iba332ccee1728bf1e28ff5719029b6ab73a30c53
Reviewed-on: https://review.typo3.org/30176
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[TASK] Cleanup DataHandler functional tests

Some DataHandler functional test cases are duplicated or are not
required anymore. Here's a list of what has changed and moved
into some existing testing structure:

Core:
* DataHandlerTest::canCreateTtContent
** Regular\Modify\ActionTest::createContents
* DataHandlerTest::canLocalizeTtContent
** Regular\Modify\ActionTest::localizeContent
* DataHandlerTest::canCopyPasteTtContent
** Regular\Modify\ActionTest::copyPasteContent
* DataHandlerTest::canCutPasteTtContent
** Regular\Modify\ActionTest::movePasteContentToDifferentPage
* IRRE\MtoNMMAsymetricLocalizationKeepTest::*
** IRRE\CSV\Modify\ActionTest::localizeParentContent*
** IRRE\ForeignField\Modify\ActionTest::localizeParentContent*
* IRRE\MtoNMMAsymetricLocalizationSelectTest::*
** IRRE\CSV\Modify\ActionTest::localizeParentContent*
** IRRE\ForeignField\Modify\ActionTest::localizeParentContent*

Workspaces:
* IRRE\MToNMMTest::*
** ManyToMany\Modify\ActionTest::*
** ManyToMany\Publish\ActionTest::*
** ManyToMany\PublishAll\ActionTest::*
* IRRE\OneToNCSVTest::*
** IRRE\CSV\Modify\ActionTest::*
** IRRE\CSV\Publish\ActionTest::*
** IRRE\CSV\PublishAll\ActionTest::*
* IRRE\OneToNForeignFieldTest::*
** IRRE\ForeignField\Modify\ActionTest::*
** IRRE\ForeignField\Publish\ActionTest::*
** IRRE\ForeignField\PublishAll\ActionTest::*

Resolves: #58870
Releases: 6.2
Change-Id: I0c75fcf826d05f8515a5609cb00c153992ba7b44
Reviewed-on: https://review.typo3.org/30177
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[BUGFIX] Missing check if $row[t3ver_state] is set in IconUtility

As a result of a missing check if $row['t3ver_state'] exists,
an exception is thrown when IconUtility::getIcon() is called
with only the required params set.

This patch adds the missing check.

Resolves: #58846
Releases: 6.2
Change-Id: I70da9ee79a5c0ee1ad4fe8892e8ed28f904a11da
Reviewed-on: https://review.typo3.org/30152
Reviewed-by: Fabien Udriot
Tested-by: Fabien Udriot
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] indexed_search plugin cannot be translated

The experimental extbase plugin of indexed_search is not
translatable on Pootle because it is still using locallang.xml
instead of a XLIFF translation file.

Change-Id: Ia3a45573737f8be0f802bfdbf5bd4f36add66b07
Resolves: #58796
Releases: 6.2, 6.1
Reviewed-on: https://review.typo3.org/30103
Reviewed-by: Dmitry Dulepov
Tested-by: Dmitry Dulepov
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers
[BUGFIX] RTE Remove Format removes too much

The remove format function with msword selected removes too much
content when there is more than one style block in content.

Note: Thanks to Volker Burggräf

Resolves: #58310
Releases: 6.2, 6.1, 4.5
Change-Id: Ia29767239d92fde20ceee97ece47786d3fd3a9a5
Reviewed-on: https://review.typo3.org/30223
Reviewed-by: Stanislas Rolland
Tested-by: Stanislas Rolland
[SECURITY] Remove charts.swf to get rid of XSS vulnerability

The file charts.swf is vulnerable to XSS, is delivered
by ExtJS but not used in TYPO3 CMS at all.

Since the vendor of ExtJS did not fix this vulnerability,
we decided to remove it from TYPO3 sources.

Change-Id: Ib30cac84983f5a30956d0a09af933b0fbca1d6ff
Fixes: #54526
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 2402b6cfa3ab2a054ef3e28f3d8de8f7dfee17ec
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30300
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Session timeout can be circumvented once

Fix the AbstractUserAuthentication class to properly invalidate
the current session if it timed out.

Change-Id: Id50ee1abd197674fa9379b52b46b63ecf770c964
Fixes: #57673
Releases: 6.2
Security-Commit: 38e24be1ff26fa181f16b91c57a0fcbe4da5065a
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30301
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader