TYPO3 Core

This is related to the 'shortcut-icon' problem in #20381 and boils down to the fact that we do not have an API in FE to determine a valid domain name.

We have ideas to make for example 'domain records' required somehow, but we must tackle possible server scenarios carefully.

Patch set 2 for branch master_new has been pushed to the review server.
It is available at http://review.typo3.org/13100

Patch set 3 for branch master_new has been pushed to the review server.
It is available at http://review.typo3.org/13100

Patch set 4 for branch master_new has been pushed to the review server.
It is available at http://review.typo3.org/13100

This is related to the 'shortcut-icon' problem in #20381.

Main issue is that _SERVER['HTTP_HOST'] can not be trusted, see

http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html
http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released

Domain records can not be used as they are restricted to FE, but we must fix this issue in BE and install tool, too.

Discussion during security sprint hh 2013:

We will implement a new config LocalConfiguration ['SYS']['TRUSTED_HOSTS'] parameter (possible regex), that can be set and is used in GeneralUtility::getIndpEnv() (main patch). Default is a "catch-all".

We should push information about this attack vector into the wild.

In the public there should follow further patches to add wizards/install-procedures/report-module/tce-main-domain-record-hooks/more. Their goal is to make the administration of this parameter as convenient as possible.

Patch set 1 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 2 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 3 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 4 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 5 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 6 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 7 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 8 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 9 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 10 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 11 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 12 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 13 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 14 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 1 for branch TYPO3_6-1 of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/30206

Patch set 1 for branch TYPO3_6-0 of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/30207

Patch set 15 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 2 for branch TYPO3_6-0 of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/30207

Patch set 2 for branch TYPO3_6-1 of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/30206

Patch set 1 for branch TYPO3_4-7 of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/30211

Patch set 1 for branch TYPO3_4-5 of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/30213

Patch set 2 for branch TYPO3_4-5 of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/30213

Patch set 2 for branch TYPO3_4-7 of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/30211

Patch set 16 for branch master of project Teams/Security/TYPO3v4-Core has been pushed to the review server.
It is available at https://review.typo3.org/25801

Patch set 1 for branch TYPO3_4-5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/30275

Patch set 1 for branch TYPO3_4-7 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/30283

Patch set 1 for branch TYPO3_6-0 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/30291

Patch set 1 for branch TYPO3_6-1 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/30299

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/30307