[BUGFIX] Missing check if $row[t3ver_state] is set in IconUtility

As a result of a missing check if $row['t3ver_state'] exists,
an exception is thrown when IconUtility::getIcon() is called
with only the required params set.

This patch adds the missing check.

Resolves: #58846
Releases: 6.2
Change-Id: I70da9ee79a5c0ee1ad4fe8892e8ed28f904a11da
Reviewed-on: https://review.typo3.org/30152
Reviewed-by: Fabien Udriot
Tested-by: Fabien Udriot
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] indexed_search plugin cannot be translated

The experimental extbase plugin of indexed_search is not
translatable on Pootle because it is still using locallang.xml
instead of a XLIFF translation file.

Change-Id: Ia3a45573737f8be0f802bfdbf5bd4f36add66b07
Resolves: #58796
Releases: 6.2, 6.1
Reviewed-on: https://review.typo3.org/30103
Reviewed-by: Dmitry Dulepov
Tested-by: Dmitry Dulepov
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers
[BUGFIX] RTE Remove Format removes too much

The remove format function with msword selected removes too much
content when there is more than one style block in content.

Note: Thanks to Volker Burggräf

Resolves: #58310
Releases: 6.2, 6.1, 4.5
Change-Id: Ia29767239d92fde20ceee97ece47786d3fd3a9a5
Reviewed-on: https://review.typo3.org/30223
Reviewed-by: Stanislas Rolland
Tested-by: Stanislas Rolland
[SECURITY] Remove charts.swf to get rid of XSS vulnerability

The file charts.swf is vulnerable to XSS, is delivered
by ExtJS but not used in TYPO3 CMS at all.

Since the vendor of ExtJS did not fix this vulnerability,
we decided to remove it from TYPO3 sources.

Change-Id: Ib30cac84983f5a30956d0a09af933b0fbca1d6ff
Fixes: #54526
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 2402b6cfa3ab2a054ef3e28f3d8de8f7dfee17ec
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30300
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Session timeout can be circumvented once

Fix the AbstractUserAuthentication class to properly invalidate
the current session if it timed out.

Change-Id: Id50ee1abd197674fa9379b52b46b63ecf770c964
Fixes: #57673
Releases: 6.2
Security-Commit: 38e24be1ff26fa181f16b91c57a0fcbe4da5065a
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30301
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Encode URL for use in JavaScript

The url for the Open in New Window button must be quoted for
use in JavaScript to prevent XSS issues.

Change-Id: I3e55f31c3c857989d71a5ef1a0368b96aa5e2c31
Fixes: #48693
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 4d9cd3e6f589c77b5a366497a33f7eb2099dc749
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30302
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in Backend Layout Wizard

Change-Id: I096d26b3eee20493b146633bda11529890be59dc
Fixes: #57576
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: b49bd72b12f709e1c3dffd4f471d138ad1dcceb5
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30303
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in template tools on root page

Change-Id: I2b5214e666d1c9edc5354dd3983401038e9aaf66
Fixes: #54109
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: e17bc3297e95f6ffd5d1df682235bfaac7a5ad53
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30304
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in new content element wizard

Sanitize user-input colPos in new content element wizard.

Change-Id: Ifa90ea1ede3b6c2a5436c505993c533803306d01
Fixes: #48695
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: bad0160450fb5786e1cb1e393c76c3da38c2ffe7
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30305
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in (old) extension manager information function

Needs to be fixed also in 6.x, but the affected function is not
used anymore.

Change-Id: If10b0cf25015eada0657aaebc19da3e3364f738a
Fixes: #54111
Fixes: #54113
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: d23f0ccc8960832c184a0e6c5daced98a0b6d096
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30306
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Add trusted HTTP_HOST configuration

TYPO3 uses the values of HTTP_HOST in several
places without validating them. This could
lead to a situation where links are generated
using the host part from HTTP_HOST.

Since HTTP_HOST headers are user input and
can be spoofed by an attacker, it leads
into several potential and actual security issues.

To address this, a configuration option for
trusted hosts is added, which is evaluated every
time getIndpEnv('HTTP_HOST') is called.

The configuration option is

$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern']

and can contain either a regular expression or the
value "SERVER_NAME"

To properly output the exception message in case
the trustedHostPattern does not match,
we need to adapt the exception handlers slightly
to not log information in this case and to actually
show the message even in production context to not
confuse admins on what is currently going wrong.

To not break all existing installations, the default
pattern is set to 'SERVER_NAME' which allows all
HTTP_HOST values matching the SERVER_NAME (and
optionally the SERVER_PORT if a port is specified
in the HTTP_HOST value).

This will secure all installation which use properly
configured name based virtual hosts, but leaves
installations where the web server is not bound
to a specific host name still in an insecure state.

Change-Id: I42fe77fe919755942636108a71c31175647449a9
Fixes: #30377
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30307
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[RELEASE] Release of TYPO3 6.2.3

Change-Id: Ib7b6505d59bdec51f537afec80678c11c0ad0b89
Reviewed-on: https://review.typo3.org/30316
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team
[TASK] Set TYPO3 version to 6.2.4-dev

Change-Id: Ic42722b40b91e61dfd839241b91b9ff31a322259
Reviewed-on: https://review.typo3.org/30317
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team
[BUGFIX] Fix failing unit tests for HTTP host check in CLI mode

The unit tests for the recent HTTP host fix are failing
if executed in CLI mode.
In CLI mode no server environments and HTTP headers are available,
that's why the behavior needs to know about the
test execution process.

We solve this by mocking allowed request types.

Resolves: #59022
Releases: 6.2, 6.1, 6.0
Change-Id: I3c93d181dcec5f34064798e7c31240877fde610d
Reviewed-on: https://review.typo3.org/30323
Reviewed-by: Nicole Cordes
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] PathUtility::get...FileOrPath() does not work with basepath

PathUtility::getAbsolutePathOfRelativeReferencedFileOrPath()
Add a check to the function to identify a given basepath as described
in the function header.

Resolves: #57918
Releases: 6.2, 6.1
Change-Id: I8de12cb917b2f32490bb160686ce06a036abfd85
Reviewed-on: https://review.typo3.org/29467
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Fix relative path resolution in include static

Fix the usage of relative paths in INCLUDE_TYPOSCRIPT inclusions of
static templates from extensions.

EXT:myext/Configuration/TypoScript/setup.txt:
<INCLUDE_TYPOSCRIPT: source="DIR:./Setup/">

EXT:myext/Configuration/TypoScript/Setup/ holds some TS files.

Resolves: #57447
Releases: 6.2
Change-Id: I64ba190fa6959eb27a2d6f1c278cfb9c9c3cbfaf
Reviewed-on: https://review.typo3.org/29468
Reviewed-by: Stefan Neufeind
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Jan Kiesewetter
Tested-by: Jan Kiesewetter
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Wrong HTML in locallang_csh_pages.xlf

lang/4.5/locallang_csh_pages.xlf contains invalid
HTML structure a <p> tag should actually be a <b> tag.

Resolves: #58936
Releases: 6.2, 6.1, 4.5
Change-Id: Id37d424296628202d8d434e0cf9cafd8529da2c3
Reviewed-on: https://review.typo3.org/30220
Reviewed-by: Stefan Neufeind
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Fix url for youtube embeds

Additionally solve the problem when http:// is missing
due to usage of the link wizard.

Change-Id: I676d14b4ddf81d5d3ec0fc0d0ebb32d08910047a
Resolves: #58569
Resolves: #58986
Releases: 6.2
Reviewed-on: https://review.typo3.org/29952
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Set default permissions for new files to 0664

Change-Id: I4c71414dca763d9ba29ab93b18a0389941f51af7
Resolves: #58809
Releases: 6.2
Reviewed-on: https://review.typo3.org/30113
Reviewed-by: Dmitry Dulepov
Reviewed-by: Oliver Klee
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Fix saving non public export presets

Fix sql error "Column 'public' cannot be null" on saving
with unchecked box public.

Resolves: #57405
Releases: 6.2
Change-Id: I1582728cc56781fdc12409956008fc82a6cd0d03
Reviewed-on: https://review.typo3.org/30112
Reviewed-by: Fabien Udriot
Tested-by: Fabien Udriot
Reviewed-by: Markus Klein
Tested-by: Markus Klein