[SECURITY] Prevent XSS in scheduler form

The class name is submitted in a hidden form and is susceptible to XSS.
The patch introduced htmlspecialchars to prevent XSS possibility.

Resolves: #57603
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I4979e66f28a581e168c56d91327a1bbe2672448d
Reviewed-on: https://review.typo3.org/29154
Reviewed-by: Nicole Cordes
Tested-by: Nicole Cordes
[TASK] Integrate default README.txt

This file is a modified and updated version like it has been
releases with every package in the past. Since these files have
been taken from git.typo3.org/TYPO3CMS/Distributions/Base.git,
which is target to be cleaned up, the file is explicitely put
to old branches as well.

Resolves: #57656
Releases: 6.1, 6.0, 4.7, 4.6, 4.5
Change-Id: I3b696895deaf03b2f630e12f1bd7b17b649b985c
Reviewed-on: https://review.typo3.org/29173
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[BUGFIX] SoftReferenceIndex typolink lacks support for title attributes

The SoftReferenceIndex parses and rebuilds typolink tags, but the
support for the title attributes was missing.
This leads to lost title attributes on typolinks in exports from impexp.

Resolves: #56580
Releases: 6.2, 6.1, 6.0, 4.5
Change-Id: I9bf5c02b79ae4c9024322f0da99dcca37b678daa
Reviewed-on: https://review.typo3.org/28799
Reviewed-by: Marc Bastian Heinrichs
Tested-by: Marc Bastian Heinrichs
[TASK] Updates prototype and scriptaculous, fixing IE9+ issues

Upgrades prototype from 1.6.0.3 to 1.7.1 and scriptaculous
from 1.8.2 to 1.9.0.

Solves the problem with sorting IRRE elements in IE9+, for example.

Resolves: #51768
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I5ea11b2e926ae0f23d1c6d85a0ff5ba24995eebb
Reviewed-on: https://review.typo3.org/29473
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[RELEASE] Release of TYPO3 4.7.18

Change-Id: I39026ef5431906708c366825da780eb43a04848f
Reviewed-on: https://review.typo3.org/29516
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team
[TASK] Set TYPO3 version to 4.7.19-dev

Change-Id: I292cd3c1eb37674685f3f03e33829cff1b7f19ca
Reviewed-on: https://review.typo3.org/29517
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team
[SECURITY] Remove charts.swf to get rid of XSS vulnerability

The file charts.swf is vulnerable to XSS, is delivered
by ExtJS but not used in TYPO3 CMS at all.

Since the vendor of ExtJS did not fix this vulnerability,
we decided to remove it from TYPO3 sources.

Change-Id: Idbf156686d55c7bcbf1f185b4c17aa0771ce9b0e
Fixes: #54526
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 9a75c13e0a46545ca55967c00e058103b9454c9f
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30276
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Fix insecure unserialize in colorpicker

Change-Id: I78b29a745c23c1b1d5359226a24150aad0dff764
Fixes: #56458
Releases: 6.1, 6.0, 4.7, 4.5
Security-Commit: 068217be9a0752cfa75ac2b4e35dfa57b52f68bf
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30277
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Encode URL for use in JavaScript

The url for the Open in New Window button must be quoted for
use in JavaScript to prevent XSS issues.

Change-Id: I5b143137e90b6f4c774af8a1a219eea2b1a73d81
Fixes: #48693
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 1535ed05e1c64b36b225d9f118325b4f985f5ddf
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30278
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in Backend Layout Wizard

Change-Id: Iff1e645df4fe3e85e064730acddaf4d29a5e5bce
Fixes: #57576
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: 32a5246e96fd21432ff7fabbe1d060f28b22d81c
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30279
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in template tools on root page

Change-Id: If78f319f61a3d064a4f25f30c7e8971ba761fde4
Fixes: #54109
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: f63af96531533744fe7bafd7d23f672c88b12967
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30280
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in new content element wizard

Sanitize user-input colPos in new content element wizard.

Change-Id: Ieb45500aa10b65c82fd8fff59204eb1503c90a22
Fixes: #48695
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: f0b7dc3b322d78b7e91a306936dc1ec9f88b96a5
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30281
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] XSS in (old) extension manager information function

Needs to be fixed also in 6.x, but the affected function is not
used anymore.

Change-Id: Ib8d753d707d2ff2b7f8e634311aa35de71ead741
Fixes: #54111
Fixes: #54113
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Commit: afbcb3d748190cd01c25d39539a3d7bb283758e8
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30282
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Add trusted HTTP_HOST configuration

TYPO3 uses the values of HTTP_HOST in several
places without validating them. This could
lead to a situation where links are generated
using the host part from HTTP_HOST.
Since HTTP_HOST headers are user input and
can be spoofed by an attacker, it leads
into several potential and actual security issues.
To address this, a configuration option for
trusted hosts is added, which is evaluated every
time getIndpEnv('HTTP_HOST') is called.
The configuration option is
$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern']
and can contain either a regular expression or the
value "SERVER_NAME"
To properly output the exception message in case
the trustedHostPattern does not match,
we need to adapt the exception handlers slightly
to not log information in this case and to actually
show the message even in production context to not
confuse admins on what is currently going wrong.
To not break all existing installations, the default
pattern is set to 'SERVER_NAME' which allows all
HTTP_HOST values matching the SERVER_NAME (and
optionally the SERVER_PORT if a port is specified
in the HTTP_HOST value).
This will secure all installation which use properly
configured name based virtual hosts, but leaves
installations where the web server is not bound
to a specific host name still in an insecure state.
Fixes: #30377
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Security-Bulletin: TYPO3-CORE-SA-2014-001

Change-Id: Ie1763f2928c2088d18c8214cd2d9520d3bd845fb
Reviewed-on: https://review.typo3.org/30283
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[RELEASE] Release of TYPO3 4.7.19

Change-Id: I81bf2c94f0c4a8157788d3b3f0acf64eae2ce6c6
Reviewed-on: https://review.typo3.org/30310
Reviewed-by: TYPO3 Release Team
Tested-by: TYPO3 Release Team
Merge commit '4886615a69f82169bf21e9aa6a097dba4ef6dd1e' into Enterprise/TYPO3_4-7
Merge commit 'a1382a884c71f5991c7e484d6a6bde38db893207' into Enterprise/TYPO3_4-7