[TASK] Set TYPO3 version to 4.5.39-dev

Change-Id: I1f43bd5fc9f1197ca7f6fdfd6f68c84f7f6214ff
Reviewed-on: http://review.typo3.org/34679
Reviewed-by: TYPO3 Release Team <typo3v4@typo3.org>
Tested-by: TYPO3 Release Team <typo3v4@typo3.org>
[BUGFIX] Exclude CDATA from t3lib_parsehtml->XHTML_clean

Due to commit https://review.typo3.org/#/c/30240/ the comments from
javascript is removed and now the javascript is parsed with
config.xhtml_cleaning = all. This patch prevents any CDATA content from
being parsed.

Resolves: #62967
Releases: master, 6.2, 4.5
Change-Id: Ib024c5c8f2b056e47d9222b9767b7a5e6923af8c
Reviewed-on: http://review.typo3.org/35039
Reviewed-by: Nicole Cordes <typo3@cordes.co>
Tested-by: Nicole Cordes <typo3@cordes.co>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
[!!!][SECURITY] Fix link spoofing in prefixLocalAnchors

Specially crafted request could lead to anchors prefixed
with URLs to domains controlled by the attacker on the
domain root page (home page). No other pages are affected!

Fix this by prefixing the anchors with a canonical URL
to the current request. This could lead to the situation
that the prefix does not match the current REQUEST_URI
which leads to a page reload instead of just "jumping" to the page section.

Additionally this change assures that REQUEST_URI always starts
with a slash, which mitigates similar attack vectors when using
getIndpEnv('REQUEST_URI')

To mitigate the impact of this breaking change, the REQUEST_URI
is used for anchor prefix if a backend user is logged in,
to not disturb the preview functionality of the home page.

In case prefixLocalAnchors is used in the HTML parser configuration
with prefixLocalAnchors = 2, always the canonical URL is used as prefix.

This change does *not* fix, that arbitrary (non functional) GET parameters
will be included in the generated prefix URL. To fix this it is recommended
to use absRefPrefix instead of baseUrl and prefixLocalAnchors.

Resolves: #62723
Releases: 4.5, 6.2, master
Security-Commit: 16003fd71982a9da3fde04c7cc298425d8b539dc
Security-Bulletin: TYPO3-CORE-SA-2014-003
Change-Id: I120f7a0fa32e48644c88d54d65863a6ac96acf4c
Reviewed-on: http://review.typo3.org/35222
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
[RELEASE] Release of TYPO3 4.5.39

Change-Id: I5706e9296860dc95e0056a47d97fed6533ccc985
Reviewed-on: http://review.typo3.org/35230
Reviewed-by: TYPO3 Release Team <typo3v4@typo3.org>
Tested-by: TYPO3 Release Team <typo3v4@typo3.org>
[FEATURE] Enhance info array provided to services

In t3lib_div::makeInstanceService() the info array passed to
the instanciated service class is enhanced with information about
the requested service type, service sub type and the excluded service
keys.

Deprecated references to global vars have been replaced with $GLOBALS
array.

Change-Id: I45d39b3a526ab2c9a2ce273784ecdc4c3f03affd
Resolves: #26410
Reviewed-on: http://review.typo3.org/1776
Reviewed-by: Markus Klein
Reviewed-by: Stefan Neufeind
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Jigal van Hemert
Tested-by: Jigal van Hemert
[+FEATURE] Extbase (Persistence): Allow pid of object to be set from action-controller

If pid of an object is set then
Tx_Extbase_Persistence_Backend->determineStoragePageIdForNewRecord()
needs to give it priority.

Thanks to Michael Budnick and Balisky Christophe.

Change-Id: Ib99400eb6947044dd190d47de5dce0c63444bb20
Resolves: #7572
[TASK] Translate labels in paginate widget

The previous / next labels in the paginate widget are replaced with
translations.

Resolves: #27516
Releases: master
Change-Id: I0cad4e7d6b92a7890158edc00604ac142c791e80
[BUGFIX] Removed dependency on TYPO3_MODE in saltedpasswords

Removed dependency on TYPO3_MODE constant in saltedpasswords which was
used to determine if the extension is enabled and which table (fe_users
or be_users) should be updated.

Since the mode is required in the init process of saltedpasswords where
the parent auth object is not available the new data in the info
array (introduced in #26410) is used.

Change-Id: I04180d283d6818b2e09d33f82036f6f88a5cb26c
Resolves: #22881
Reviewed-on: http://review.typo3.org/1778
Reviewed-by: Markus Klein
Reviewed-by: Stefan Neufeind
Reviewed-by: Steffen Ritter
Reviewed-by: Dmitry Dulepov
Tested-by: Dmitry Dulepov
[TASK] Extbase (Persistence): Remove duplicate registration in identity map

Remove identity-map registration from
Tx_Extbase_Persistence_Repository->findByUid()
since the object has already been registered in the DataMapper
in mapSingleRow().

Thanks to Alexander Stehlik.

Change-Id: I76382f6f12cbcc290f70cd52a465f2c92f7bf4c2
Resolves: #26875
[BUGFIX] Fix PHP warning when writing to Backend user log

The writelog method for the BackendUserAuthentication object is now
checking if there is actually an uid available in the user array
before it tries to access it.

This prevents a PHP warning about an illegal string offset when writing
log messages in an authentication service.

Releases: 6.0, 6.1, 6.2
Resolves: #49328
Change-Id: I3eb028ab3ee00626328ebd2bbf2ad62a22773ac3
[TASK] Collection of unofficial fixes

Fixes that are not meant to be commited to the core or are custom
workarounds for specific problems:

Tables starting with user_piwikintegration_ are ignored in the install
tool schema comparator.

The $isModified property of the ObjectStorage is set to TRUE by
default to fix problems with non persisted changes.

The handling of union statements for ORDER BY usage in the
Typo3DbBackend is improved.

The form.errors view helper merges all property errors.

Change-Id: I91a37be041637d2779178355530dde3f27be5a7f