TYPO3 v15 dev-main snapshot ()
This commit is contained in:
+39
@@ -0,0 +1,39 @@
|
||||
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _breaking-72931:
|
||||
|
||||
=================================================================================
|
||||
Breaking: #72931 - SearchFormController::pi_list_browseresults() has been renamed
|
||||
=================================================================================
|
||||
|
||||
See :issue:`72931`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
In order to make Indexed Search pi-based plugin PHP7 compatible, the `SearchFormController::pi_list_browseresults()` method has been renamed to `SearchFormController::renderPagination()`.
|
||||
Parameter types, order and count has been preserved. However the methods visibility has been changed to protected.
|
||||
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
Call to old method name will result in fatal error "Call to undefined method".
|
||||
|
||||
|
||||
Affected Installations
|
||||
======================
|
||||
|
||||
Any installation of TYPO3 7.6 or TYPO3 8 where SearchFormController is overloaded (XCLASSed) and new class contains call to old method name and
|
||||
any code that called the public method from outside the class.
|
||||
|
||||
|
||||
Migration
|
||||
=========
|
||||
|
||||
Rename `pi_list_browseresults()` to `renderPagination()`.
|
||||
|
||||
Calling the method from outside the class is no longer possible.
|
||||
|
||||
.. index:: PHP-API, Frontend, ext:indexed_search
|
||||
@@ -0,0 +1,38 @@
|
||||
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _breaking-73461:
|
||||
|
||||
=============================================================
|
||||
Breaking: #73461 - Import module disabled for non admin users
|
||||
=============================================================
|
||||
|
||||
See :issue:`73461`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
The import module of extension "impexp" has been disabled for non-admin users by default.
|
||||
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
For non-admin users who need that functionality, the userTsConfig option
|
||||
:typoscript:`options.impexp.enableImportForNonAdminUser = 1` must be set. This can have a
|
||||
negative security impact to the TYPO3 instance in core versions 7.6 and 6.2 and
|
||||
should only be enabled for "trustworthy" backend users in general.
|
||||
|
||||
|
||||
Affected Installations
|
||||
======================
|
||||
|
||||
Installations with non-admin users making active use of the import / export module
|
||||
|
||||
|
||||
Migration
|
||||
=========
|
||||
|
||||
Set userTsConfig option :typoscript:`options.impexp.enableImportForNonAdminUser = 1` to restore the old behavior.
|
||||
|
||||
.. index:: Backend, ext:impexp, TSConfig
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _breaking-84843:
|
||||
|
||||
==============================================================
|
||||
Breaking: #84843 - Use no-cookie domain for youtube by default
|
||||
==============================================================
|
||||
|
||||
See :issue:`84843`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
To improve the privacy of users the renderer for YouTube videos has been changed to use
|
||||
the no-cookie domain `www.youtube-nocookie.com` by default. The regular domain `www.youtube.com`
|
||||
is used if explicitly set by the following TypoScript configuration:
|
||||
|
||||
.. code-block:: typoscript
|
||||
|
||||
lib.contentElement {
|
||||
settings {
|
||||
media {
|
||||
additionalConfig {
|
||||
no-cookie = 0
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
The TypoScript configuration :typoscript:`lib.contentElement.settings.media.additionalConfig` is used
|
||||
as attribute :php:`additionalConfig` of the ViewHelper :php:`\TYPO3\CMS\Fluid\ViewHelpers\MediaViewHelper`.
|
||||
|
||||
If no configuration is provided, the domain `www.youtube-nocookie.com` is used.
|
||||
|
||||
|
||||
Affected Installations
|
||||
======================
|
||||
|
||||
Installations which require the usage of the domain `www.youtube.com` or setting cookies by YouTube.
|
||||
|
||||
|
||||
Migration
|
||||
=========
|
||||
|
||||
Use the TypoScript configuration :typoscript:`lib.contentElement.settings.media.additionalConfig.no-cookie = 0`
|
||||
|
||||
.. index:: TypoScript, ext:fluid_styled_content
|
||||
+41
@@ -0,0 +1,41 @@
|
||||
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _feature-69794:
|
||||
|
||||
============================================================
|
||||
Feature: #69794 - Support pecl-memcached in MemcachedBackend
|
||||
============================================================
|
||||
|
||||
See :issue:`69794`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
Support for the PECL module "memcached" has been added to the MemcachedBackend of the Caching Framework.
|
||||
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
The MemcachedBackend checks if either "memcache" or "memcached" is installed. If both plugins are installed, the
|
||||
MemcachedBackend uses "memcache" over "memcached" to avoid being a breaking change. An integrator may set the option
|
||||
`peclModule` to use the preferred PECL module.
|
||||
|
||||
Example code:
|
||||
|
||||
.. code-block:: php
|
||||
|
||||
$GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['my_memcached'] = [
|
||||
'frontend' => \TYPO3\CMS\Core\Cache\Frontend\VariableFrontend::class,
|
||||
'backend' => \TYPO3\CMS\Core\Cache\Backend\MemcachedBackend::class,
|
||||
'options' => [
|
||||
'peclModule' => 'memcached',
|
||||
'servers' => [
|
||||
'localhost',
|
||||
'server2:port'
|
||||
]
|
||||
]
|
||||
];
|
||||
|
||||
.. index:: PHP-API, LocalConfiguration
|
||||
@@ -0,0 +1,24 @@
|
||||
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _feature-73461:
|
||||
|
||||
==========================================================
|
||||
Feature: #73461 - Enable import module for non admin users
|
||||
==========================================================
|
||||
|
||||
See :issue:`73461`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
The new userTsConfig option :typoscript:`options.impexp.enableImportForNonAdminUser` can be used to enable
|
||||
the import module of EXT:impexp for non admin users.
|
||||
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
This option should be enabled for "trustworthy" backend users only.
|
||||
|
||||
.. index:: ext:impexp, Backend, TSConfig
|
||||
@@ -0,0 +1,38 @@
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _feature-84053:
|
||||
|
||||
===============================================
|
||||
Feature: #84053 - API to anonymize IP addresses
|
||||
===============================================
|
||||
|
||||
See :issue:`84053`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
A new API has been introduced which can be used to anonymize IP addresses.
|
||||
This shall help to comply with data protection and privacy laws and requirement.
|
||||
|
||||
:php:`\TYPO3\CMS\Core\Utility\IpAnonymizationUtility::anonymizeIp(string $ipAddress, int $mask = null)`
|
||||
|
||||
If :php:`$mask` is set to null (default value), the setting :php:`$GLOBALS['TYPO3_CONF_VARS']['SYS']['ipAnonymization']` is taken into account.
|
||||
|
||||
The following options for :php:`$mask` are possible:
|
||||
|
||||
- `0`: The anonymization is disabled.
|
||||
- `1`: For IPv4 addresses the last byte is masked. E.g. :code:`192.168.100.10` is transformed to :code:`192.168.100.0`.
|
||||
For IPv6 addresses the Interface ID. E.g. :code:`2002:6dcd:8c74:6501:fb2:61c:ac98:6bea` is transformed to :code:`2002:6dcd:8c74:6501::`
|
||||
- `2`: For IPv4 addresses the last two bytes are masked. E.g. :code:`192.168.100.10` is transformed to :code:`192.168.0.0`.
|
||||
For IPv6 addresses the Interface ID and SLA ID. E.g. :code:`2002:6dcd:8c74:6501:fb2:61c:ac98:6bea` is transformed to :code:`2002:6dcd:8c74::`
|
||||
|
||||
The default value for :php:`$GLOBALS['TYPO3_CONF_VARS']['SYS']['ipAnonymization']` is :php:`1`!
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
The core uses this API whenever IP addresses are stored, this includes:
|
||||
|
||||
- Indexed Search uses the new setting for its search statistics.
|
||||
|
||||
.. index:: PHP-API, ext:core, ext:indexed_search
|
||||
@@ -0,0 +1,34 @@
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _feature-84740:
|
||||
|
||||
====================================================
|
||||
Feature: #84740 - Make indexed_search ready for GDPR
|
||||
====================================================
|
||||
|
||||
See :issue:`84740`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
The following features have been added to the extension `indexed_search` to make it compatible with the GDPR law:
|
||||
|
||||
**Add table `index_stat_search` to the available garbage collector tasks**
|
||||
|
||||
Entries of the table `index_stat_search` can now be deleted after a given amount of days by using
|
||||
the scheduler task *Table garbage collection* of the extension `scheduler`.
|
||||
|
||||
**Make the IP tracking configurable**
|
||||
|
||||
Every successful search is tracked in the table `index_stat_search` which includes the IP address of the client as well.
|
||||
The :php:`\TYPO3\CMS\Core\Utility\IpAnonymizationUtility` is now used to mask the IP.
|
||||
The level of privacy can be configured in the extension configuration in the Install Tool with
|
||||
the setting `trackIpInStatistic`. By default it is set to `2`, which means that the host and subnet are masked.
|
||||
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
Configure your installation as needed. Define the tracking of the IP address and the removal of not needed search statistics.
|
||||
|
||||
.. index:: ext:indexed_search
|
||||
+40
@@ -0,0 +1,40 @@
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _feature-84781:
|
||||
|
||||
==========================================================================
|
||||
Feature: #84781 - Added scheduler task to anonymize IP addresses of tables
|
||||
==========================================================================
|
||||
|
||||
See :issue:`84781`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
A new scheduler task has been added which makes it possible to anonymize IP addresses stored in database tables.
|
||||
|
||||
The task *Anonymize IP addresses in database tables* is configured in the :file:`ext_localconf.php`.
|
||||
|
||||
.. code-block:: php
|
||||
|
||||
$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['scheduler']['tasks'][\TYPO3\CMS\Scheduler\Task\IpAnonymizationTask::class]['options']['tables']['<tableName>'] = [
|
||||
'dateField' => '<dateFieldName>',
|
||||
'ipField' => '<ipFieldName>'
|
||||
];
|
||||
|
||||
After the base configuration the table is available in the scheduler task with the following configuration options:
|
||||
|
||||
- Table
|
||||
- Minimum age an entry must have to be anonymized
|
||||
- IP mask level
|
||||
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
The following tables are available by default:
|
||||
|
||||
- index_stat_search
|
||||
- sys_log
|
||||
|
||||
.. index:: CLI, ext:scheduler
|
||||
+22
@@ -0,0 +1,22 @@
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _important-17904:
|
||||
|
||||
==============================================================================
|
||||
Important: #17904 - showAccessRestrictedPages does not work with special menus
|
||||
==============================================================================
|
||||
|
||||
See :issue:`17904`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
HMENU setting `showAccessRestrictedPages=NONE` now acts as documented in
|
||||
:ref:`t3tsref:menu-common-properties`.
|
||||
|
||||
Before: using the option renders `<a>Page title</a>` when page is inaccessible.
|
||||
|
||||
After: using the option renders `<a href="index.php?id=123">Page title</a>`
|
||||
when page is not accessible.
|
||||
|
||||
.. index:: Frontend, TypoScript
|
||||
@@ -0,0 +1,23 @@
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _important-75400:
|
||||
|
||||
============================================================
|
||||
Important: #75400 - New DataHandler command 'copyToLanguage'
|
||||
============================================================
|
||||
|
||||
See :issue:`75400`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
A new DataHandler command 'copyToLanguage' has been introduced. It behaves like 'localize' command
|
||||
(both record and child records are copied to given language), but does not set transOrigPointerField fields (e.g. l10n_parent).
|
||||
|
||||
The 'copyToLanguage' command should be used when localizing records in the "Free Mode". This command is used when localizing
|
||||
content elements using translation wizard's "Copy" strategy.
|
||||
|
||||
The 'localize' DataHandler command should be used when translating records in "Connected Mode" (strict translation of records from the default language).
|
||||
This command is used when selecting "Translate" strategy in content elements translation wizard.
|
||||
|
||||
.. index:: PHP-API
|
||||
@@ -0,0 +1,21 @@
|
||||
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _important-77411:
|
||||
|
||||
======================================================
|
||||
Important: #77411 - Removed extbase table column cache
|
||||
======================================================
|
||||
|
||||
See :issue:`77411`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
The extbase table column cache "extbase_typo3dbbackend_tablecolumns",
|
||||
which was used to store all database fields of all database tables,
|
||||
has been removed.
|
||||
|
||||
The associated configuration variable `$TYPO3_CONF_VARS[SYS][caching][cacheConfigurations][extbase_typo3dbbackend_tablecolumns]` can be removed.
|
||||
|
||||
.. index:: Database, ext:extbase, LocalConfiguration
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _important-77830:
|
||||
|
||||
==========================================================
|
||||
Important: #77830 - CSC-HeaderLinkRespectsGlobalPageTarget
|
||||
==========================================================
|
||||
|
||||
See :issue:`77830`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
Setting the global configuration :typoscript:`lib.parseTarget` was not respected by the header_link field.
|
||||
Now the configuration is properly applied and might change the output in the frontend.
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
If the global setting :typoscript:`lib.parseTarget` is set, the field header_link will now respect it.
|
||||
If in addition the target of header_link is set in a content element, it will take precedence over
|
||||
:typoscript:`lib.parseTarget`.
|
||||
|
||||
.. index:: Frontend, TypoScript
|
||||
@@ -0,0 +1,41 @@
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _important-83768:
|
||||
|
||||
=========================================
|
||||
Important: #83768 - Remove referrer check
|
||||
=========================================
|
||||
|
||||
See :issue:`83768`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
Browser vendors are considering or have already announced **not** to send the referrer URL/path in HTTP requests when
|
||||
links are followed or forms are submitted due to privacy reasons. TYPO3 used the referrer as a meagre CSRF protection
|
||||
for the backend. However, this has been replaced by proper CSRF protection tokens for every backend action and therefore,
|
||||
the referrer check became obsolete and has been removed.
|
||||
|
||||
Usages of the configuration option :php:`[SYS][doNotCheckReferer]` within TYPO3 Core have been removed, as this is not
|
||||
needed anymore. However, the option can still be set for extensions implementing this option.
|
||||
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
Backend users will not notice any differences.
|
||||
|
||||
|
||||
Affected Installations
|
||||
======================
|
||||
|
||||
All installations are affected.
|
||||
|
||||
|
||||
Migration
|
||||
=========
|
||||
|
||||
TYPO3 extensions that use option :php:`[SYS][doNotCheckReferer]` to implement a kind of CSRF protection, should use
|
||||
proper CSRF protection tokens provided by the core.
|
||||
|
||||
.. index:: Backend, FullyScanned
|
||||
@@ -0,0 +1,44 @@
|
||||
.. include:: /Includes.rst.txt
|
||||
|
||||
.. _important-85385:
|
||||
|
||||
=================================================
|
||||
Important: #85385 - Integrate Phar Stream Wrapper
|
||||
=================================================
|
||||
|
||||
See :issue:`85385`
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
In order to solve the issues mentioned in the `security advisory TYPO3-SA-2018-002`_
|
||||
a new `PharStreamWrapper` has been integrated that intercepts all according stream actions using the `phar://` stream prefix.
|
||||
|
||||
`PharStreamWrapper` only allows invocation of Phar files that are located in the usual extension directory located in
|
||||
`typo3conf/ext/` - Phar files stored at different locations cannot be invoked anymore.
|
||||
|
||||
When using Phar files in extensions PHP's `__DIR__` magic constant has to be avoided
|
||||
and replaced by according TYPO3 file resolving instead. This is required in order to
|
||||
allow extensions being referenced using symbolic links - when `__DIR__` points to
|
||||
the source which is probably outside of `typo3conf/ext/` and thus denies the expected
|
||||
Phar file invocation.
|
||||
|
||||
.. code-block:: php
|
||||
|
||||
// ...
|
||||
include_once 'phar://' . __DIR__ . '/Resources/bundle.phar/vendor/autoload.php';
|
||||
// ...
|
||||
|
||||
has to be adjusted to the following instead, using `ExtensionManagementUtility::extPath()` in order to resolve the proper path
|
||||
|
||||
.. code-block:: php
|
||||
|
||||
// ...
|
||||
include_once 'phar://' . \TYPO3\CMS\Core\Utility\ExtensionManagementUtility::extPath('my_extension')
|
||||
. '/Resources/bundle.phar/vendor/autoload.php';
|
||||
// ...
|
||||
|
||||
.. _security advisory TYPO3-SA-2018-002: https://typo3.org/security/advisory/typo3-core-sa-2018-002/
|
||||
|
||||
|
||||
.. index:: PHP-API, ext:core
|
||||
@@ -0,0 +1,45 @@
|
||||
:template: changelogOverview.html
|
||||
.. include:: /Includes.rst.txt
|
||||
.. _changelog-7-6-x:
|
||||
|
||||
7.6.x Changes
|
||||
=============
|
||||
|
||||
Changes after 7.6.0 LTS release.
|
||||
|
||||
**Table of contents**
|
||||
|
||||
.. contents::
|
||||
:local:
|
||||
:depth: 1
|
||||
|
||||
|
||||
Breaking Changes
|
||||
^^^^^^^^^^^^^^^^
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
:titlesonly:
|
||||
:glob:
|
||||
|
||||
Breaking-*
|
||||
|
||||
Features
|
||||
^^^^^^^^
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
:titlesonly:
|
||||
:glob:
|
||||
|
||||
Feature-*
|
||||
|
||||
Important
|
||||
^^^^^^^^^
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
:titlesonly:
|
||||
:glob:
|
||||
|
||||
Important-*
|
||||
Reference in New Issue
Block a user