TYPO3 9.5.8

31 July 2019

TYPO3 version 9.5.8 is now available (major release).

What's New in TYPO3 9.5.8

• Disallow insecure deserialization for l18n_diffsource (thanks to Oliver Hader)
  
• Deny pages' TSconfig and tsconfig_includes for non-admins (thanks to Oliver Hader)
  
• Disallow session data transfer on frontend user logout (thanks to Oliver Hader)
  
• Deny access to import module for non-admin users (thanks to Oliver Hader)
  
• Conflict insecure versions symfony/cache component (thanks to Frank Naegler)
  
• Disallow javascript & data scheme in URL link handler (thanks to Oliver Hader)
  
• Check record permissions in record information popup (thanks to Andreas Fernandez)
  

• Upgrade typo3/phar-stream-wrapper to v3.1.2
  
• Set TYPO3 version to 9.5.7-dev
  

• Fix record preview
  
• Avoid realpath resolving in PharStreamWrapperInterceptor
  
• Remove non existing source map reference
  
• Remove unused variable
  
• Ignore PATH_INFO in NormalizedParams scriptName calculation
  
• Properly initialize image property of FrontendUser
  
• Make php-intl work with older ICU versions
  

• Enclose file type scope when invoking ImageMagick
  
• Destroy sessions on password change
  
• Avoid logging sensitive information during authentication
  
• Hide items in page tree a user does not have access to
  
• Raise Fluid Standalone dependency
  

• Re-introduce mixed overlay mode for content fallback
  
• API to search for files including meta data based on folder
  
• Add custom generator options via hook
  

• Fix RST rendering in Documentation file
  
• Avoid showing password on MacBook touch bar in backend forms
  
• Do not apply stdWrap on USER_INT
  
• Respect uniqueInSite when moving records
  
• Add functional tests for hreflang tag generation
  
• Do not remove page cache for redirects issued by plugins
  
• Remove duplicated types of AbstractFileFolder::$originalResource
  
• Upgrade and streamline typo3/phar-stream-wrapper to v3.1.1
  
• Support concurrent requests without 503 responses
  
• bamboo plan for security pre-merge tests
  
• Do not open EditDocumentController in modal
  
• Allow TypoScript conditions to access PageArguments
  
• Unhide page translations by default
  
• Mitigate migration of EXT:sv and saltedpasswords into core
  
• Make sure a twitter:card metatag is rendered
  
• Check correct setting on extension upload
  
• Avoid raising a warning in SimpleLockStrategyTest
  
• Sanitize undefined TCA columns required for data integrity
  
• Only show records from current language in XML Sitemap
  
• Have RecordState support versioning
  
• Invoke delete command via AJAX
  
• Use correct ViewHelper argument description
  
• Let Install Tool use core's bootstrap
  
• Document property "elementDescription"
  
• Move backend translations into Database.xlf
  
• Fix structure of generated finisher FlexForm fields
  
• Document variants of form framework
  
• Add arguments to the MimeTypeValidator error object
  
• Use form specific flexform sheets within the frontend
  
• Add guard clause to preFileAdd form hook
  
• Catch form errors and display speaking error message
  
• Add clarification for link.editRecord ViewHelper
  
• Change finisher override display behavior
  
• Add missing translation of validator
  
• Add id to confirmation finisher template
  
• Pass error arguments to translator
  
• Document validators of form framework
  
• Fluid viewhelper f:format.date() uses timestamp from context aspect
  
• Fix header levels for ViewHelper class comments
  
• Fix docs of FlashMessage finisher
  
• Show "FlashMessage" finisher output
  
• Make AdvancedPassword confirmation error translatable
  
• Render content element in ConfirmationFinisher
  
• Ensure Lowercase folders on non-case-sensitive file system
  
• Close file resource in FileLockStrategy if acquire failed
  
• Raise twitter bootstrap to 3.4.1
  
• Incorporate changes of jQuery version to 3.4.0
  
• Document proposed folder structure
  
• Add extension suggestions to EXT:form
  
• Transliterate accented characters
  
• Remove Windows line breaks
  
• Properly handle quotes in plaintext mails
  
• Update Settings.cfg to recent TYPO3 version
  
• Fix DeleteUploadsFinisher with recyclers
  
• Make filter in workspace module work again
  
• Fix alias of SaltedPasswordsService
  
• Use correct value for remove function
  
• Overlay workspace records in Live Search
  
• Correction of the userdefined time range
  
• Make loading of depth in workspace module work for 0
  
• Add missing fe_login hooks to docs
  
• URL without base runs into a redirect loop
  
• Make CodeMirror search persistent
  
• Mark symfony/routing 4.2.7 as conflict
  
• Don't show new button when adding a new record
  
• Ensure www.mydomain.com/index.php works
  
• Repair depth selection in workspace module
  
• Ensure PageRouter only operates with previous result
  
• Allow to check/uncheck all recipients in Workspace stage dialog
  
• Store depth selector in workspace module in uc
  
• Check if language is accessible before uri generation
  
• Simplify UX in Workspace Module
  
• Apply quality settings for images
  
• Fix labels and field ordering of workspaces TCA
  
• Fix serialization of loggers
  
• Use proper TYPO3_CONF_VARS IM option
  
• Prevent throwing warnings when extract svg image sizes
  
• Use finder instance correctly
  
• Do not send empty scheduler status mails
  
• Add tests for SiteBased translations in Extbase records
  
• Populate href lang URI only if the link is available
  
• Catch TypeError on inlineCSS files
  
• Add tests for pages.slug in workspaces tests
  
• Do not use LSB in
  
• Fix typo in form documentation
  
• Use proper path to install cli binary
  
• Add table name as prefix for language DB selection
  
• Allow FileInterface for ClickEnlarge ViewHelper
  
• Use PageTitle API for indexed_search
  
• Ensure to properly catch any connection exception
  
• Fix handling menuConfig of LanguageMenuProcessor
  
• Update columns in DocHeader bar
  
• Reenable Page TSconfig setting mod.web_list.hideTranslations
  
• Fix null coalesce evaluation in PageLayoutView::getLocalizedPageTitle()
  
• DB check - search query, array handling on operator change
  
• Use SiteFinder in SearchController for getting all languages
  
• Remove superfluous function calls in page module
  
• Handle configured error level only in error handler
  
• Remove limit in be_groups fields
  
• Do not use native closest() due to missing browser support in IE
  
• Adjust documentation for custom routing enhancer registration
  
• Improved visibility error message in install tool
  
• Remove hard coded path to LocalConfiguration.php
  
• Show correct timestamp in file replace dialog
  
• Avoid PHP notice in DataHandler
  
• Prepare Frontend Tests for additional site handling tests
  
• Enable preview of hidden page translations
  
• Check if fileObject width is greater than 0, if not use maxWidth
  
• Documentation links to invalid URL
  
• Use SiteMatcher in TranslationConfigurationProvider
  
• Fix Changelog associated with extension scanner for services
  
• DB check > Search: Convert --div-- to optgroup
  
• Update ColorPicker to use cleaned minicolors hex value
  
• Use live record uid for preview in workspace
  
• Resolve and link modified slugs in workspaces properly
  
• Avoid cHash mismatches when previewing workspace changes
  
• Add be_user id to LinkGenerator page-version test context
  
• Update SYS_LASTCHANGED for the right language page record
  
• Update topbar when switching BE language
  
• Do not overwrite status code of received response
  
• Remove @internal from ConnectionPool::resetConnections()
  
• Re-enable target attribute for links in menus
  
• Respect sorting in section menus
  
• Mark input fields edited by datepicker as changed
  
• Ensure parse_str method argument is valid for BE shortcuts
  
• Add additionalFields to cache identifier in getPageForRootline
  
• Show typo3link module in ckeditor if href attribute is empty
  
• Ensure result is string in __toString of CropVariantCollection
  
• Prevent empty new form from being closed without confirmation
  
• Rename PageParameterValidator to PageArgumentValidator
  
• Upgrade ckeditor to 4.11.3
  
• Add jquery.clearable to backend page tree filter
  
• Add field static_page_arguments to group by of query
  
• Allow umlaut domains for site domain resolving
  
• Include Records with "All Languages" in default language
  
• Add slug field to page-related DataHandler tests
  
• Use correct default value for sys_file_storage|is_public
  
• Do not treat all classes as entities in ClassSchema
  
• GifBuilder returns already generated images
  
• Fix typos in PHP comments
  
• Access correct event variable in ContextMenu.ts
  
• Add requireJs for Inline JavaScript in file replace view
  
• Prevent exception in file list
  
• Fix strict type error in recursive mount point resolving
  
• Remove invalid sort link in filelist module
  
• Catch ExpressionLanguage exception for invalid base variants
  
• Prevent various PHP notices
  
• Use TSConfig defaults for DataHandler
  
• Do not use named parameter for list of ids in plain data resolver
  
• Reduce strictness for .pl files in fileDenyPattern
  
• Check existence of OEmbed title
  
• Properly render hidden fields for IRRE records
  
• Fix @var comment in AbstractFileCollection
  
• Add missing licence header to viewhelper classes
  
• Change abandoned package mso/idna-convert
  
• Access and update attribute data-action explicitly in Core Updater
  

• Fallback options for slug fields
  
• Add SiteProcessor
  

• Catch possible error due to wrong redirect regex
  
• Reintroduce removed page tree TSconfig settings
  
• Fix fallback language handling
  
• Force closing tag in PageViewHelper
  
• Add check for string to prevent PHP warning
  
• Streamline base variants for sites
  
• Fix indexing of pages using route enhancers
  
• Calc permissions for edit links correctly
  
• Update to phpunit 7.5
  
• Make slugs unique when copying pages
  
• Properly use requirejs-loader.js in frontend context
  
• Abort slug proposal request on rapid typing
  
• Support non ASCII url slugs
  
• Exclude logger from serialize on save for Extbase scheduler task
  
• Tighten rst validation rule for keyword
  
• Relax rst validation rules for Feature and Important
  
• Remove PageRenderer debug code
  
• Do not treat all classes as entities in ClassSchema"
  
• htaccess does not allow pages that end with "rc"
  
• Do not treat all classes as entities in ClassSchema
  
• Respect no_cache in PageLinkBuilder
  
• Mock FileRepository Singletons in unit tests
  
• Migrate existing ViewHelper docs to valid rst
  
• Allow type 'check' in site configuration
  
• Use real ObjectManager stubs in unit tests
  
• Mock ResourceFactory Singletons in unit tests
  
• Mock SignalSlot\Dispatcher Singletons in unit tests
  
• Do not render unused attribute in Checkbox element
  
• LegacyDomainResolver must ignore hidden domain records
  
• Prevent int range escalation in language sorting
  
• Catch orphaned language related exception
  
• Do not use ObjectManager to instantiate PageTitleProviderManager
  
• Update tslint.json and fix build
  
• Replace IRC with Slack in composer support section
  
• EXT:opendocs - Remove bogus initial document count
  
• Have stdWrap.lang use Site concept
  
• Remove empty TsDebug.js
  
• Document rte_ckeditor
  
• Add missing interface to AdminPanel Cache Module
  
• Cast lastMod property to int
  
• Commit missing composer.lock changes
  
• Raise php-cs-fixer version
  
• Update doctrine/dbal to ~2.8.0
  
• Keep language reference for children using l10n_mode=exclude
  
• Scheduler: Remove label from progress bar
  
• Allow strings in site configuration type "select"
  
• Cast fallback language uids to integer
  
• Revert Set controller in ExtbasePluginEnhancer"
  
• Set controller in ExtbasePluginEnhancer
  
• Corrected tooltip for pages with nav_hide
  
• Use proper argument for options in SendEmailCommand
  
• Add language synchronization tests for TCA type inline/CSV
  
• Show hidden subgroups of fe_group
  
• Reduce information disclosure of the used TYPO3 version
  
• Reuse entities of overridden classes in persistence session
  
• Add support for language -1 to TCA field type slug
  
• Use proper exception messages for Scheduler::fetchTask()
  
• Mark scheduler tasks as executed on PHP-level errors
  
• Update typo3fluid/fluid to 2.6.0
  
• Use real finisher identifier in form element variants
  
• Fix return type of determineSiteScript
  
• Resolve site correctly in nested site structure
  
• Increase field name of table sys_file_storage
  
• Use overridden field label in list view
  
• Add correct description for CType menu_sitemap
  
• Improve indexed_search manual
  
• Prevent selection of pagetree loader animation
  
• bamboo: db dependency loop needs break condition
  

• Extend file deny pattern
  
• Use a fluid template for the ConfirmationFinisher message
  
• Raise bootstrap 3.4.0 to fix XSS in JS components
  
• XSS issues in Fluid view helpers
  
• Prevent possible XSS in install tool
  
• Avoid creation of backend users without password
  
• Avoid disclosing loaded extensions
  

• Support feature toggle in expression language
  
• Support feature toggle in expression language
  
• Make SiteLanguage available in TypoScript
  

• and dozens of bug fixes
  

• Fix positioning of arrows in Element Browser
  
• Properly separate markup for modal windows in extension manager
  
• Fix HTML in modal of OnlineMedia.ts
  
• Fix HTML in drag-title of PageTreeDragDrop.js
  
• getTreeList inserts duplicate keys in cache_treelist
  
• Revert bugfix Remove surrounding &nsbp; in the tables with ol or ul in CKEditor
  
• Do not rewind Generator in DebuggerUtility::var_dump()
  
• Silence composer install progress in bamboo
  
• Allow custom namespace in ExtbasePluginEnhancer
  
• Remove @ in doc comment of TypoScriptParser
  
• Add filter for be_users and be_groups
  
• Set TYPO3 version to 9.5.3-dev
  

• Avoid DoS in Online Media Helper
  
• Remove TYPO3 version from installer
  
• Make InstallTool session cookie HTTP-only
  
• Prevent XSS with fe_users data in felogin/TSFE
  
• Prevent XSS in modal component and PageTree
  
• Properly escape videoId for YouTube/Vimeo
  
• Update library CKEditor to 4.11.1
  

• Allow replacing strings in slug
  
• Allow to override htmlTag attributes
  
• Support recursive in record sitemap
  
• Improve creation of URL query strings from arrays
  

• and dozens of bug fixes
  

• Remove X-UA-Compatible from HTML of backend
  
• and dozens of bug fixes
  

• Add stdWrap to config.additionalHeaders"
  
• Introduce PageTypeEnhancer
  
• Make prepending slash in TCA slug configurable
  
• Introduce RouteEnhancers for Page-based Routing
  
• Allow site in TypoScript getText
  
• Allow environment variables in site config
  
• Allow multiple domain variants per site
  
• Allow static route resolving
  
• Add support for the "canonical" tag
  
• Use utf8mb4 on mysql for new instances
  

• and dozens of bug fixes
  

• Deny direct FAL commands for form definitions
  
• Ensure validity of parameters submitted to ThumbnailController
  
• Remove support for native PHP yaml extension
  
• Filter disallowed properties in form editor
  
• Explicitly deny object deserialization
  
• Mitigate phar stream wrapper
  
• Introduce PHP stream wrapper for phar:// protocol
  
• Deny authentication bypass using blowfish/md5 encryption
  

• Add property to disable form elements/finishers
  
• Add hreflang support
  
• XML Sitemap
  
• New API for UpgradeWizards
  
• Add PageTitle API
  
• Add commands for listing and showing sites
  
• Add inline AJAX validation for TCA type slug
  
• Add pagination and filtering to the redirects module
  
• Show extensions via CLI
  
• Add symfony expression language for TypoScript conditions
  
• Refactor AdminPanel API to use composition
  
• Move workspaces scheduler tasks to native symfony commands
  
• Allow symfony commands to be non-schedulable
  
• Add Upgrade Wizard to migrate to pagepath segment for pages
  
• Introduce Page-based URL handling
  
• Add SQL Logging to AdminPanel
  
• Add a new TCA type "slug"
  
• Show only sys_languages in Backend which are available
  
• Add "Pseudo" Site functionality
  
• Add feature toggle interface to Settings
  
• Enable/disable a specific SiteLanguage in Frontend
  
• Add path where reference records are located to record info
  
• Move expression language handling into EXT:core
  
• Add Log Module to AdminPanel
  
• Use symfony/routing for Site Resolving
  
• Select first element of PageTree toolbar on initialization
  
• Add hooks for DatabaseRecordList CSV actions
  
• Open specific field when fixing links
  
• Add TCA 'saltedPassword' eval for type=input
  
• Re-Design the AdminPanel
  
• Add infix option for filenames used by FileWriter
  
• Allow TCA description property
  
• Add getEnv value modifier to TS parser
  
• Add context check for TypoScript
  
• Introduce conditional variants for form elements
  
• Add Contexts for storing data access modes
  
• Add support to CurrencyViewHelper for mdash
  
• Use HTML5 field types and attributes in FormEngine
  
• Add interval presets for cron command field of scheduler task
  
• Load merged JS files asynchronous
  
• Enable SQLite in installation process
  
• Add trait to detect public deprecated methods
  

• Merge salted passwords auth service into default service
  
• Drop "documentation" extension
  
• and dozens of bug fixes