[SECURITY] Implement Click Jacking Protection

To protect the backend from click jacking attacks
a HTTP header needs to be sent, which prevents
embedding backend pages in an iframe on domains
different than the one used to access the backend.

All recommended browsers respect this header
and prevents the backend page to be shown in an
iframe, so we do not need to implement further
JavaScript frame busting solutions.

Resolves: #54201
Documentation: #57144
Releases: 6.2
Change-Id: Ic83cae4917bb62ff8fe8b55a947ace7dba86d223
Reviewed-on: https://review.typo3.org/28601
Reviewed-by: Christian Kuhn
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
Reviewed-by: Ernesto Baschny
Tested-by: Ernesto Baschny
[TASK] Added .sass-cache to .gitignore

Releases: 6.2
Change-Id: I3278984b1a7aa4ee704b9568f01d3ff3edf94da9
Reviewed-on: https://review.typo3.org/28617
Reviewed-by: Wouter Wolters
Reviewed-by: Ernesto Baschny
Tested-by: Ernesto Baschny
[FEATURE] Introduce shadowColumnsForMovePlaceholders property

$TCA[<table>]['ctrl']['shadowColumnsForMovePlaceholders'] behaves
similar to shadowColumnsForNewPlaceholders but is only used for
move placeholders.

If shadowColumnsForMovePlaceholders is not defined in particular
for a table, but shadowColumnsForNewPlaceholders is defined,
then that value is used as a fallback - since that property
existed for a longer time already.

Resolves: #56994
Documentation: #56749
Releases: 6.2
Change-Id: Icdbd35234efae8162cfb2dc15a2838acd22370b1
Reviewed-on: https://review.typo3.org/28473
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[TASK] Refactor install tool enable file checks

As annotated in the files, a refactoring is made to
remove duplicated code.

Resolves: #57072
Releases: 6.2
Change-Id: Idef2c3c194aa1659603c8b6bcc0a515ccff13a23
Reviewed-on: https://review.typo3.org/28524
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Workspace toolbar styling fix (UL)

When you open the workspace toolbar, the bullets
of the list are shown. It should not.

Resolves: #57114
Related: #55819
Releases: 6.2
Change-Id: Ia58ddd1cd8005d6e2410c04e28a2a7b2111665c4
Reviewed-on: https://review.typo3.org/28591
Reviewed-by: Ernesto Baschny
Tested-by: Ernesto Baschny
Reviewed-by: Wouter Wolters
Tested-by: Wouter Wolters
[FEATURE] Save current workspace in ReferenceIndex

To reduce queries to accordant relations saved in the reference
index, add the current workspace that is used. This information
will be used later during publishing nested record sets (e.g.
for Inline Relational Record Editing).

Resolves: #56977
Releases: 6.2
Change-Id: I92851e243581a525bb99fafc9ed656fd613eeb82
Reviewed-on: https://review.typo3.org/28472
Reviewed-by: Wouter Wolters
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[TASK] Fetch folder and environment status through AJAX

Resolves: #57166
Releases: 6.2
Change-Id: I72aa55cff3322bbe46d271758fd04f3aba860ae7
Reviewed-on: https://review.typo3.org/28619
Reviewed-by: Ernesto Baschny
Tested-by: Ernesto Baschny
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[BUGFIX] FlashMessage styles missing in Reports module

When deleting the deprecation log file a not styled flash
message is shown afterwards. This is fixed by setting
renderMode to div.

Resolves: #57162
Releases: 6.2
Change-Id: I4ccc3620b008cd765b8fb1d124957e66aee448b5
Reviewed-on: https://review.typo3.org/28620
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Ernesto Baschny
Tested-by: Ernesto Baschny
[BUGFIX] Reduce length of identifier key in sys_file_processedfile

To support a smooth upgrade from a 6.0 or 6.1 system, we have to reduce
the length if the identifier field for the key "identifier".

Resolves: #57002
Releases: 6.2
Change-Id: Ic5928ceae1f288cfb3005ad271e493f356679c82
Reviewed-on: https://review.typo3.org/28622
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[BUGFIX] Support for static table titles in new record wizard

With a static table name the extension key is not updated which sets a
wrong table title for the extension before. This patch resolves table
title from configuration with a fallback to table name part and sets
group name and extension key. This helps to prevent any conflict between
different extensions.

Resolves: #23478
Releases: 6.2
Change-Id: I5f33b0a9ab616256f0b328a6d7c793677213531b
Reviewed-on: https://review.typo3.org/28510
Reviewed-by: Vladimir Podkovanov
Reviewed-by: Wouter Wolters
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[TASK] Speed up page ID resolving in Extbase BE

Extbase does some simple calls to determine the
page ID of the current request, and does not cache it.

This costs some mySQL calls, which are unneeded
once the current page ID is found. The page ID is
now stored in the ConfigurationManager to retrieve
with a simple runtime cache.

Resolves: #55566
Resolves: #57125
Releases: 6.2
Change-Id: Id5fe4a25591c77ce8a81cefa018a04e803ba7e8a
Reviewed-on: https://review.typo3.org/27243
Reviewed-by: Nicole Cordes
Tested-by: Nicole Cordes
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[TASK] Backport Flow JsonView

Change-Id: Ia750e9997bb69b00652a6cc30dd3442574c0b97b
Resolves: #56007
Releases: 6.2
Reviewed-on: https://review.typo3.org/27642
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[BUGFIX] Manipulation of file field migration config

This patch introduces new methods to the FrontendContentAdapterServer
that allow the manipulation of the file field migration configuration.
It is now possible to add additional (content) types for which the
migration should be active and to add custom migration configurations.

Releases: 6.2
Resolves: #46067
Documentation: #56365
Change-Id: Ibc23be8a414192c8795d9bb4f09316cf608e240b
Reviewed-on: https://review.typo3.org/23360
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Tested-by: Tom Peters
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[BUGFIX] Hide "new page buttons" for users who can't create new pages

There are 2 icons in the New Element wizard which should not belong there
and get the user into a blank page if the user got no access to create
page records.

- in the toolbar: icon to create a new page
- in the wizard: icon to create new page

Change-Id: I5ab638f17eebfc740ab64dd57ce655681552f901
Resolves: #56992
Releases: 6.2
Reviewed-on: https://review.typo3.org/28464
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer
Reviewed-by: Wouter Wolters
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Nicole Cordes
Tested-by: Nicole Cordes
[BUGFIX] Mandatory for Selectbox with TCA not possible

It's not possible to create a backend selectbox
that is mandatory with only 1 item selectable.

Releases: 6.2, 6.1
Resolves: #24925
Resolves: #24871
Change-Id: Idaef6475f61c70cd8c3f6074ccd0b0195d90c581
Reviewed-on: https://review.typo3.org/27169
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[TASK] Re-added the 1-2-3 bullets in the Step Installer

Resolves: #56941
Releases: 6.2
Change-Id: I5dfabf2c5df8c495fbdce30cb170260d2656e6b4
Reviewed-on: https://review.typo3.org/28425
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Nicole Cordes
Tested-by: Nicole Cordes
[FEATURE] Enable queries using "root" and "-1" for pidInList

The version preview in the frontend rendering process basically
selects only the live versions and then overlays those records
with possible versions. Since the MM handling is changed to
directly point to the most specific version in that regard (this
is an exception to the "always live, overlay then" approach), the
versions also need to be selected directly. ContentObjectRenderer
uses the method PageRepository::enableFields() which adds an
additional SQL WHERE part, like " AND tablename.pid<>-1" to
exclude possible versions.

Besides that, elements (like sys_catagory) that are stored on the
root-level cannot be queried at all which leads to custom code in
the end just to perform these queries.

This change allows selections on the root-level and disables the
"pid<>-1" constraint if the opposite has been defined in the
pidInList property.

Example:
select.pidInList = root,-1

Resolves: #57168
Documentation: #57171
Releases: 6.2
Change-Id: I6fb91f89f70614d59c83d808f07e890833248880
Reviewed-on: https://review.typo3.org/28623
Reviewed-by: Ernesto Baschny
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[BUGFIX] Invalid relations of IRRE records in workspaces

* general -> always use live id as pointer value
* create records -> automatically fill placeholder pointers
* copy records -> currently leads to problems with sorting
* move records -> follow and create child move placeholders
* delete records -> forward delete data in copy(!) process
* ReferenceIndex needs to hold the most specific relations
  since the CommandMap handler is based on this information
* ReleationHandler is extended for IRRE references to fetch
  the live default parent pointer automatically (this new
  behaviour can be disabled by public methods for each
  RelationHandler instance)
* The method version_swap_procBasedOnFieldType of the version
  DataHandlerHook is completely removed since IRRE records are
  now referenced using the live default parent pointer value
* UserTSconfig property options.workspaces.swapMode is set
  to "pages" per default - thus, if a page gets published all
  accordant records on that page are published as well

Resolves: #56376
Releases: 6.2
Change-Id: I75248d10b000de73ca623770f07e8c2e89d4cdd8
Reviewed-on: https://review.typo3.org/27774
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[BUGFIX] Invalid relations of MM records in workspaces

The basic problem with MM (ManyToMany) relations in workspaces is
that the intermediate table (MM table) does not have any
information about actually being a reference in a particular
workspace - there is no "t3ver_wsid" field. Thus, the meaning of
a relation needs to be determined from the entities on both sides
of the relation. The following is possible:

* both sides are live -> valid in live only
* exactly one side is versioned -> valid in a workspace only
* both sides are versioned -> valid in a workspace only

The difficulties now start with versioning one side first and
after some time the other side - thus the relation with exactly
one version and one live entity needs to be turned into an entry
pointing to both versions.

Resolves: #57169
Releases: 6.2
Change-Id: Idb043d520c30f15e85d54a016e52690f5f05cedc
Reviewed-on: https://review.typo3.org/28624
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[!!!][BUGFIX] Cast negative int to boolean (true) in BooleanNode

Currently Fluid treats negative integers as false which
results in <f:if condition="-9"> rendering else instead
of then.

When casting integers to boolean using php all integers
other than 0 (zero) are casted to true, just 0 results in
false. Therefore, casting of BooleanNode::convertToBoolean
must be adjusted to act like plain php.

This bugfix is a breaking change as people might have
deliberately used the wrong behaviour.

Releases: 6.2
Resolves: #54243
Resolves: #33597
Change-Id: Iebaa578cf071909610ca0e1abfc9bfaad7459231
Reviewed-on: https://review.typo3.org/26784
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
Reviewed-by: Stefan Neufeind
Reviewed-by: Nicole Cordes
Tested-by: Nicole Cordes