TYPO3 9.5.12

Release Notes

Version 9.5.12

Stay secure and up-to-date with TYPO3 ELTS!

The TYPO3 CMS community supported from 2018-10-02 until 2021-09-30.
Extend your support now until 2024-09-30 to get access to the latest security and compatibility updates for this version.

Learn more about TYPO3 ELTS Browse the TYPO3 ELTS Portal

Release Notes for TYPO3 CMS 9.5.12

This document contains information about TYPO3 CMS 9.5.12 which was released on 17.12.2019.

Get TYPO3 9.5.12 now

News

This release is a combined bug fix and security release.

Find more details in the security bulletins:

Read TYPO3 9.5.12 Release News

Checksums of TYPO3 9.5.12

SHA256

8712628331b6228d65ffb42f3b32e2e05383e7211642ab79d940b6ea8b0b1c9a typo3_src-9.5.12.tar.gz
24f701b29e36fb74963f34f36e3002c092845b018c0f3ef3d7a8df305e9340c5 typo3_src-9.5.12.zip

SHA1

4cc7dea06afdad3b89575e58ef947e585ef37b4a typo3_src-9.5.12.tar.gz
eeed23b6f96e21ed5fd6fccf170437513c45702d typo3_src-9.5.12.zip

MD5

3e13812ded175a01f554f2fa321b8ab7 typo3_src-9.5.12.tar.gz
40399863ff39f99223b9becec695cd6b typo3_src-9.5.12.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/9.5.12/tar.gz
wget --content-disposition https://get.typo3.org/9.5.12/tar.gz.sig
gpg --verify typo3_src-9.5.12.tar.gz.sig typo3_src-9.5.12.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 9.5.11:

2019-12-17 efd84a5a50 [RELEASE] Release of TYPO3 9.5.12 (thanks to Oliver Hader)
2019-12-17 f474609588 [SECURITY] Avoid insecure deserialization in QueryGenerator & QueryView (thanks to Frank Naegler)
2019-12-17 0d975edaab [SECURITY] Prevent SQLi in ext:lowlevel QueryGenerator (thanks to Frank Naegler)
2019-12-17 ec053dc058 [SECURITY] Avoid directory traversal on archive extraction (thanks to Andreas Fernandez)
2019-12-17 fcc1bab070 [SECURITY] XSS in file list through file extension (thanks to Andreas Fernandez)
2019-12-17 64db88b9b6 [SECURITY] Avoid XSS by correctly encoding typolink results (thanks to Oliver Hader)
2019-12-17 9692bf83f8 [SECURITY] Prevent XSS in EXT:form error message output (thanks to Frank Naegler)
2019-12-17 b1626ad8fd [SECURITY] Avoid possible insecure deserialization in Extbase (thanks to Oliver Hader)
2019-12-17 d9fe9b20a1 [TASK] Streamline frontend user password recovery process (thanks to Oliver Hader)
2019-12-16 ccd86d4da7 [BUGFIX] Revert FolderCheck for clipboard actions (thanks to Guido Schmechel)
2019-12-16 41d29e6230 [BUGFIX] Avoid applying parameter inflation during route resolving (thanks to Oliver Hader)
2019-12-16 deb8db1e63 [BUGFIX] Ensure correct return values in Workspace middleware (thanks to Benni Mack)
2019-12-16 8744e748d0 [TASK] Add more tests for TypoLink handling in fluid (thanks to Frank Naegler)
2019-12-16 8664c5ec56 [BUGFIX] Name "default language" consistently (thanks to Benni Mack)
2019-12-16 e66a22f927 [BUGFIX] Use correct Plan name and key (thanks to Anja Leichsenring)
2019-12-16 3b7556a4ec [TASK] Simplify chunking of test-plan jobs (thanks to Markus Klösges)
2019-12-16 80125ffc5a [BUGFIX] Fix return value in command site:list (thanks to Georg Ringer)
2019-12-15 47b8da7a53 [DOCS] Extend docs of DeleteUploads finisher (thanks to Jonas Schwabe)
2019-12-15 93e0168b93 [BUGFIX] Always allow dividers in TCA auth mode check (thanks to Alexander Stehlik)
2019-12-15 1fa1916552 [BUGFIX] Convert URLs with ampersands in Linkvalidator (thanks to Sybille Peters)
2019-12-15 6b85d728dd [DOCS] Remove incorrect slash in extension paths (thanks to Ron Gebauer)
2019-12-15 53ee7312a6 [DOCS] Remove "Adding Your Own Content Elements" (thanks to Sybille Peters)
2019-12-15 969b012dd6 [DOCS] Adjust name for PageTitle API in documentation (thanks to Stefan Neufeind)
2019-12-14 60dcf280a5 [BUGFIX] Add VendorName to Fluid Ajax WidgetContext (thanks to Stefan Froemken)
2019-12-14 2b7170e120 [TASK] Mix test jobs in stages (thanks to Anja Leichsenring)
2019-12-13 d3af2afcf0 [TASK] Remove unused imports (thanks to Oliver Bartsch)
2019-12-13 4a8e8001fe [BUGFIX] Mark guzzlehttp/guzzle >= 6.5.0 as conflict (thanks to Benni Mack)
2019-12-13 dba630c458 [BUGFIX] Apply thumbscrews to sqlserver (thanks to Andreas Fernandez)
2019-12-12 89b35b580f [BUGFIX] Fix typo in cHash option description (thanks to Benni Mack)
2019-12-10 b45552ad80 [BUGFIX] Use existing API instead of ContentObjectRenderer (thanks to Michael Binder)
2019-12-10 c45986e5e5 [BUGFIX] Raise platform settings for tarball distributions (thanks to Benni Mack)
2019-12-10 3b44118e62 [BUGFIX] Remove leading slash from backendLogo path (thanks to Oliver Bartsch)
2019-12-06 dec3fdcd8c [BUGFIX] Add check if update of all language packs is possible (thanks to Oliver Bartsch)
2019-12-06 2c48f62769 [BUGFIX] Use RequestFactory for downloading mirrors and check response properly (thanks to Richard Haeser)
2019-12-06 22f5d2c9ea Revert "[BUGFIX] Set tasks backend:lock & backend:unlock as not schedulable" (thanks to Benjamin Franzke)
2019-12-06 4af8b40678 [TASK] Restructure nightly plans in stages a 50 jobs (thanks to Anja Leichsenring)
2019-12-06 3a814b6f50 [BUGFIX] Remove jumpToUrl function in LinkBrowser (thanks to Dennis Prinse)
2019-12-06 b8664f1903 [BUGFIX] Check if header variable is set before using it (thanks to Susanne Moog)
2019-12-05 03cb06860a [BUGFIX] Do not apply default node settings when invoking command (thanks to Andreas Fernandez)
2019-12-05 f6a59136f3 [BUGFIX] Fix broken Fluid templates (thanks to Patrick Broens)
2019-12-05 7c434372eb [TASK] Provide PHP 7.4 test run configuration (thanks to Anja Leichsenring)
2019-12-05 aa2aaf1766 [BUGFIX] Fix failing tests in 9.5 branch (thanks to Benni Mack)
2019-12-05 2971d61267 [TASK] Streamline test names (thanks to Oliver Hader)
2019-12-03 2a7fa091f0 [BUGFIX] Filter empty values from language list (thanks to Andreas Fernandez)
2019-12-02 fdaffe7bfd [TASK] Use mssql-2017-cu17 (thanks to Anja Leichsenring)
2019-12-02 4ab34654e7 [BUGFIX] Provide necessary info for NewContentElementWizardHook again (thanks to Jo Hasenau)
2019-12-02 b2458ce17f [BUGFIX] Do not send default data for page tree items (thanks to Tymoteusz Motylewski)
2019-11-29 ca69da23de [TASK] Update doctrine/annotations dependency (thanks to Benni Mack)
2019-11-29 42c563333f [BUGFIX] Open a new tab if window name in backend is newTYPO3frontendWindow (thanks to Andreas Fernandez)
2019-11-29 0064e94656 [BUGFIX] RTE: Link with anchor and params not working (thanks to Thorben Nissen)
2019-11-29 8377ac84d3 [BUGFIX] Use correct testing container for JS related tests -again (thanks to Anja Leichsenring)
2019-11-29 01516aff37 [BUGFIX] No longer include punctuation in CKEditor autolinks (thanks to Susanne Moog)
2019-11-29 a0c27a879c [TASK] Improve pre-merge test run configs (thanks to Anja Leichsenring)
2019-11-29 9735a3acac [BUGFIX] Fix translated shortcut target in menus (thanks to Mathias Brodala)
2019-11-29 6b56ef6129 [TASK] Update codemirror to v5.49.2 (thanks to Andreas Fernandez)
2019-11-29 bcb8bbbf2a [TASK] Restructure nighly test plan spec (thanks to Anja Leichsenring)
2019-11-29 737b1658d8 [BUGFIX] Allow to switch clipboard mode to copy without items (thanks to Benni Mack)
2019-11-28 3adc562fd7 [DOCS] Add example for saving uploaded files in SaveToDatabase finisher (thanks to dirnbauer)
2019-11-28 cc0ef16e0c [TASK] Future-proof Fluid template namespace imports (thanks to Claus Due)
2019-11-28 5bdd9baacb [BUGFIX] Render FlashMessages at ClearCache (thanks to Guido Schmechel)
2019-11-28 fd949cf3c8 [DOCS] Use correct filename in documentation of fluid styled content (thanks to Georg Ringer)
2019-11-27 7aa336624a [TASK] Update friendsofphp/php-cs-fixer to 2.16.1 (thanks to Alexander Schnitzler)
2019-11-26 a86f5e410f [BUGFIX] Fix double encoding of current page link in link wizard (thanks to Markus Klein)
2019-11-26 c51baa60fd [DOCS] Fix explanation of content element TypoScript example (thanks to Alexander Vidoni)
2019-11-26 b4070c6900 [BUGFIX] Use current site language in indexed search by default (thanks to Benni Mack)
2019-11-25 ea224f8709 [TASK] Refer to classes in typo3fluid in Changelog (thanks to Sybille Peters)
2019-11-25 5e7b8a042d [BUGFIX] Use correct ViewHelper namespace in PHPDoc of SubmitViewHelper (thanks to Tomas Norre Mikkelsen)
2019-11-25 86cfb1a937 [DOCS] Fix mistakes regarding RTE-configuration via TsConfig (thanks to Io Kon)
2019-11-24 5a937980d3 [BUGFIX] Write "PropertyGridEditor" default values as integer number (thanks to Ralf Zimmermann)
2019-11-24 23a97dcd42 [BUGFIX] Respect user mount points within FormPersistenceManager (thanks to Ralf Zimmermann)
2019-11-23 08644725c5 [DOCS] Fix some minor typos in Changelog (thanks to Björn Jacob)
2019-11-23 6ccbe2fbe6 [DOCS] Document date element in EXT:form (thanks to Björn Jacob)
2019-11-23 8610cb09b1 [BUGFIX] Document unsetting array property items in form variants (thanks to Christian Eßl)
2019-11-23 bcd5d63c6b [BUGFIX] Show form definitions with same filename from different storages (thanks to Christian Eßl)
2019-11-23 fec4172fd0 [BUGFIX] StaticRouteResolver returns 404 on invalid static route (thanks to Benni Mack)
2019-11-23 235ef3227c [BUGFIX] Respect unique form identifier for validators (thanks to Mathias Brodala)
2019-11-22 33a011f516 [BUGFIX] Disable browser autofill feature for the honeypot field (thanks to Christian Eßl)
2019-11-22 5d20d035b5 [BUGFIX] Unconfigured typeNums should result in 404 instead of 500 response (thanks to Benni Mack)
2019-11-22 9907a8926b [TASK] Add additional tests for Route VariableProcessor (thanks to Oliver Hader)
2019-11-22 a95a107f0b [BUGFIX] Only process arrays in BackendUserConfigurationUpdate (thanks to Daniel Goerz)
2019-11-22 79d57c99b3 [TASK] Make PHP code of TYPO3 Core PHP 7.4 compliant (thanks to Benni Mack)
2019-11-22 6b85947858 [BUGFIX] Cast id to integer in class BackendUserConfigurationUpdate (thanks to Christian Eßl)
2019-11-22 52e2bf3d4b [BUGFIX] Fix PHP error in SoftReferenceParserHook for missing form definitions (thanks to Stephan Großberndt)
2019-11-22 7d185b3a7a [TASK] Document variables assigned to mail templates (thanks to Björn Jacob)
2019-11-21 b9ed0d55ae [BUGFIX] Remove assignment to unused property in PageRenderer (thanks to Benni Mack)
2019-11-20 d777bf11e6 [TASK] Do not use constants in low-level classes (thanks to Benni Mack)
2019-11-20 e132be407b [BUGFIX] Synchronize TCA enable columns from workspace version (thanks to Oliver Hader)
2019-11-20 f16f98592f [BUGFIX] Do not add entries to cache_treelist when logged into BE (thanks to Benni Mack)
2019-11-18 485fdc531b [TASK] Update doctrine/dbal to 2.10.0 (thanks to Manuel Selbach)
2019-11-18 cf2bbe5b4c [BUGFIX] Ensures configuration for resolveAnchorLink is an array (thanks to Susanne Moog)
2019-11-17 d5c7615b6b [BUGFIX] Respect config.intTarget and extTarget in default ParseFunc (thanks to Benni Mack)
2019-11-17 d3fa861b21 [TASK] Add Maori locale and flag (thanks to Simon Gilli)
2019-11-17 d7895f2741 [TASK] Add examples to ext:backend ViewHelpers (thanks to Oliver Bartsch)
2019-11-14 b6df1bc538 [DOCS] Add missing semicolon in rst file (thanks to Franz Holzinger)
2019-11-14 e26157bbff [DOCS] Fix minor typos in form documentation (thanks to Chris Müller)
2019-11-14 0eadbf3809 [TASK] Update dependency CmsComposerInstaller (thanks to Benni Mack)
2019-11-13 ef0f06fd0e [TASK] Trigger nightly test builds with more time in between (thanks to Anja Leichsenring)
2019-11-12 f2631623e6 [BUGFIX] Fix exception in IpAnonymizationTask after upgrade from TYPO3 8 (thanks to Stephan Großberndt)
2019-11-10 ac7ffd0e25 [BUGFIX] Consider all elements in typo3temp/assets/ when clearing (thanks to Oliver Hader)
2019-11-09 2ee8a26279 [BUGFIX] Add fallback identifier to IRRE fields (thanks to Susanne Moog)
2019-11-09 837694bef2 [BUGFIX] Remove htmlspecialchars from path_Workspace (thanks to Devid Messner)
2019-11-09 0037e82b3e [BUGFIX] IRRE: Create a correct original value identifier (thanks to Andreas Fernandez)
2019-11-09 1963bdcd23 [BUGFIX] Respect language restrictions for direct page title editing (thanks to Gianluigi Martino)
2019-11-09 98ccbed132 [BUGFIX] Make EXT:backend independent of EXT:install (thanks to Daniel Siepmann)
2019-11-09 2a4993573c [BUGFIX] Deactivate link element's explanation toggle after change (thanks to Michael Straschek)
2019-11-09 3a1af2fc20 [BUGFIX] Allow usage of uid in slug generation via Ajax (thanks to Johannes Schlier)
2019-11-09 51174ee1e3 [BUGFIX] Set default controller name in ExtbasePluginEnhancer (thanks to Oliver Hader)
2019-11-09 d0bd9b7397 [BUGFIX] Log invalid hash generation in FAL Indexer (thanks to Susanne Moog)
2019-11-09 4582ae5662 [TASK] Add clarification and tests to SiteBasedRedirectResolver (thanks to Benni Mack)
2019-11-09 917c7d8bdf [BUGFIX] Decode tag attributes during HTML parsing (thanks to Helmut Hummel)
2019-11-09 5e4018fcdc [BUGFIX] RTE: Support anchors without href (thanks to Thorben Nissen)
2019-11-09 7422eff2ee [BUGFIX] Reenable input field for page ID when setting a link via RTE (thanks to Ioulia Kondratovitch)
2019-11-09 2ba16773ea [BUGFIX] Use correct icon for menu separator if hidden in menu (thanks to Karsten Nowak)
2019-11-09 433fac848e [TASK] Add additional workspaces tests covering enable fields (thanks to Oliver Hader)
2019-11-09 6fe5728031 [DOCS] Fix RTE preset example (thanks to Daniel Siepmann)
2019-11-09 bce22ba7d1 [BUGFIX] Respect cacheHash excludedParameters in TSFE::reqCHash() (thanks to Grigory Rechkin)
2019-11-09 a6b7e3236c [BUGFIX] Pluralize term dynamically (thanks to Frank Naegler)
2019-11-09 ff6c916fbd [BUGFIX] Prevent indexing of XML sitemaps by search engines (thanks to Chris Müller)
2019-11-08 0d53e80aa1 [TASK] Extend TCA shadowColumns instead of overriding them (thanks to Oliver Hader)
2019-11-08 489ea99d00 [BUGFIX] Don't escape decimal character group (thanks to Matthias Vogel)
2019-11-08 19fbdfae15 [BUGFIX] Remove references to "alternativeTempPath" (thanks to Benni Mack)
2019-11-08 bee275c3dc [BUGFIX] Streamline SoftReferenceIndex references (thanks to Nicole Cordes)
2019-11-08 8fafe43c23 [BUGFIX] Fix tests in ConditionMatcher regarding applicationContext (thanks to Benni Mack)
2019-11-07 8f3d8dde49 Revert "[TASK] Speed up DB query for tables with versions" (thanks to Oliver Hader)
2019-11-07 8a1679b494 [TASK] Enable php 7.4 for runTests.sh script (thanks to Anja Leichsenring)
2019-11-07 c0ed7925fe [TASK] Update Guzzle to latest version (6.4.1) (thanks to Benni Mack)
2019-11-07 5f05593e67 [BUGFIX] Improve accessibility of backend login (thanks to Georg Ringer)
2019-11-07 aa2052d17b [BUGFIX] SysLanguageViewHelper fetches proper DB connection (thanks to Benni Mack)
2019-11-06 d82d725a60 [BUGFIX] Use prepared statements for pdo_mysql per default (thanks to Manuel Selbach)
2019-11-06 deebd9f48e [BUGFIX] Do not fall back to routes on invalid “id” (thanks to Claus Due)
2019-11-06 9b09fae9ca [BUGFIX] Have backend layouts in DB respect workspace versions (thanks to Benni Mack)
2019-11-05 a6af4fd53b [BUGFIX] Check parsed url for query part in BE Shortcuts (thanks to Oliver Bartsch)
2019-11-05 874dde1697 [BUGFIX] Remove 2nd double quotes from exception messages (thanks to Daniel Siepmann)
2019-11-04 94da575514 [BUGFIX] SoftReferenceIndex parses new TypoLink format correct (thanks to Rémy DANIEL)
2019-11-04 e007089b06 [BUGFIX] Fix stdWrap.replacement boolean properties handling (thanks to Wolfgang Klinger)
2019-11-04 0130e53672 [BUGFIX] Don't process ifEmpty/ifBlank stdWrap if content is available (thanks to Wolfgang Klinger)
2019-11-04 05117f8722 [BUGFIX] Fix parameter descriptions of bulkInsert (thanks to Oliver Bartsch)
2019-10-30 9acd2032ca [TASK] Set TYPO3 version to 9.5.12-dev (thanks to Benni Mack)