TYPO3 9.5.2

Release Notes

Version 9.5.2

Stay secure and up-to-date with TYPO3 ELTS!

The TYPO3 CMS community supported from 2018-10-02 until 2021-09-30.
Extend your support now until 2024-09-30 to get access to the latest security and compatibility updates for this version.

Learn more about TYPO3 ELTS Browse the TYPO3 ELTS Portal

Release Notes for TYPO3 CMS 9.5.2

This document contains information about TYPO3 CMS 9.5.2 which was released on 11.12.2018.

Get TYPO3 9.5.2 now

News

This release is a combined bug fix and security release.

Find more details in the security bulletins:

Read TYPO3 9.5.2 Release News

Checksums of TYPO3 9.5.2

SHA256

d1de29b2ded9703a288408cc16479d170c1d144a9d44e7981feb307f48f32482 typo3_src-9.5.2.tar.gz
c8d6f52049037990870131d3cf0eb24ecd3c37195c2c24a2f7e200f00f9eca90 typo3_src-9.5.2.zip

SHA1

f96142ed7cec14f61de624347cb2b945bf458347 typo3_src-9.5.2.tar.gz
bad140b4143b761ce84ee1733127162b10f400d0 typo3_src-9.5.2.zip

MD5

a5a1013e0394db2b462634a97943d920 typo3_src-9.5.2.tar.gz
b19b7e399c69ba880d96bc906b6e2c28 typo3_src-9.5.2.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/9.5.2/tar.gz
wget --content-disposition https://get.typo3.org/9.5.2/tar.gz.sig
gpg --verify typo3_src-9.5.2.tar.gz.sig typo3_src-9.5.2.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 9.5.1:

2018-12-11 8f51a81f5b [RELEASE] Release of TYPO3 9.5.2 (thanks to Oliver Hader)
2018-12-11 be0a1ba0f5 [BUGFIX] Adjust modal window processing and RequireJS loading (thanks to Oliver Hader)
2018-12-11 16567366e2 [SECURITY] Avoid DoS in Online Media Helper (thanks to Oliver Hader)
2018-12-11 232d0a6428 [SECURITY] Remove TYPO3 version from installer (thanks to Benni Mack)
2018-12-11 13328b0f74 [SECURITY] Make InstallTool session cookie HTTP-only (thanks to Andreas Wolf)
2018-12-11 1c85fe7026 [SECURITY] Prevent XSS with fe_users data in felogin/TSFE (thanks to Benni Mack)
2018-12-11 02cd5c9722 [SECURITY] Prevent XSS in modal component and PageTree (thanks to Frank Naegler)
2018-12-11 a32a9a746f [SECURITY] Properly escape videoId for YouTube/Vimeo (thanks to Susanne Moog)
2018-12-11 6959fc7c9c [SECURITY] Update library CKEditor to 4.11.1 (thanks to Benni Mack)
2018-12-11 412666d960 [BUGFIX] Check for valid FrontendInterface for page title cache (thanks to Richard Haeser)
2018-12-10 9988b62b3c [BUGFIX] Respect GET parameters when generating canonicalized URLs (thanks to Richard Haeser)
2018-12-10 33c0a0349d [TASK] Add default icon overlay fields to rootline (thanks to Tim Karliczek)
2018-12-10 ab9f9d6300 [BUGFIX] Add proper scope for styling of DebugExceptionHandler (thanks to Georg Ringer)
2018-12-10 a9f7298521 [BUGFIX] Accept Unicode characters in email spam protection (thanks to Oliver Bartsch)
2018-12-08 3cc23f9091 [TASK] Display exact error message of handlePageError() (thanks to Peter Kraume)
2018-12-08 3d5456e33b [BUGFIX] Ignore wizards with no upgrades in report (thanks to Alexander Stehlik)
2018-12-08 0ee9300242 [BUGFIX] Remove composer max update from regular randomizer (thanks to Anja Leichsenring)
2018-12-08 2af6a4646c [TASK] Simplify bamboo variable to label handling (thanks to Christian Kuhn)
2018-12-08 591da85d3f [BUGFIX] Do not resolve languageFilePath to absolutePath (thanks to Achim Fritz)
2018-12-07 aad4efd3fe [BUGFIX] Avoid overwriting page context in TSFE->cObj by f:cObject (thanks to Thorben Nissen)
2018-12-07 c17978d05a [BUGFIX] Swap mixed up labels in admin panel page cache info (thanks to Nikita Hovratov)
2018-12-07 c220c97d22 [TASK] Add full configuration to SiteLanguage::toArray (thanks to Georg Ringer)
2018-12-07 c443d5cc0f [BUGFIX] Fix nested arrays in conditions (thanks to Wolfgang Klinger)
2018-12-07 1e94de8cbf [BUGFIX] Styling of TCA description text with custom css selector (thanks to Joerg Boesche)
2018-12-07 19ac9a7dd0 [BUGFIX] Mark changes in selectMultipleSideBySide (thanks to Andreas Fernandez)
2018-12-07 f4a9323b8c [BUGFIX] Set active tab when DOM is ready (thanks to Andreas Fernandez)
2018-12-07 5663193a44 [TASK] Update package doctrine/instantiator (thanks to Romain Canon)
2018-12-07 82ce1afc74 [BUGFIX] Prevent double pointer parameter in record list (thanks to Vladimir Falcon Piva)
2018-12-07 6208be93c8 [BUGFIX] Revert UrlEncoding for GeneralUtility functions (thanks to Anja Leichsenring)
2018-12-07 082413df20 [BUGFIX] Add missing translation value for Modals (thanks to Preben Rather Sørensen)
2018-12-07 8306763faf [BUGFIX] Disable file compression for external urls in js and css includes (thanks to Benjamin Kott)
2018-12-07 2c65392280 [BUGFIX] PageLayoutView - Keep copy settings if disabled (thanks to André Schließer)
2018-12-07 1618bd19e7 [FEATURE] Allow replacing strings in slug (thanks to Georg Ringer)
2018-12-07 320d0b2658 [BUGFIX] Fix return type annotation in ResourceStorage::sanitizeFileName() (thanks to Andreas Fernandez)
2018-12-06 7cbb929cfd [TASK] Add missing RsT about existing language update tasks (thanks to Josef Glatz)
2018-12-06 90fc5cd48e [BUGFIX] Fix date generation in AdminPanel preview (thanks to Andreas Fernandez)
2018-12-06 4766a6f969 [BUGFIX] Upgrade linkhandler syntax to new link syntax (thanks to Johannes Kasberger)
2018-12-06 7a1b9b61ca [BUGFIX] Add missing ' in InstallTool and docs (thanks to Georg Ringer)
2018-12-05 702dded041 [BUGFIX] Fix name and location of demo .htaccess file in install tool (thanks to Peter Kraume)
2018-12-04 b63f03d68a [BUGFIX] Remove expired cache_treelist entries during runtime (thanks to Alexander Schnitzler)
2018-12-04 5b4433410c [BUGFIX] Add getter for tsfe->pageCacheTags (thanks to Daniel Goerz)
2018-12-04 78e132c60e [TASK] Fix code examples in MetaTagManager docs (thanks to Georg Ringer)
2018-12-04 4f3ee3e27d [BUGFIX] Fix docs for site base variants to include protocol (thanks to Benni Mack)
2018-12-04 9eb14883f8 [BUGFIX] Initialize language key in AbstractPlugin (thanks to Georg Ringer)
2018-12-03 621c51d27b [BUGFIX] Allow accessing object from ObjectStorage with numeric value (thanks to Romain Canon)
2018-12-03 efc6284e48 [BUGFIX] Disable extension updates in Composer mode (thanks to Nicole Cordes)
2018-12-03 af1642a8b3 [BUGFIX] Support DateTimeInterface in DebuggerUtility (thanks to Andreas Wolf)
2018-12-03 ba4ac56034 [BUGFIX] Deprecate dependency injection with non public properties (thanks to Alexander Schnitzler)
2018-12-03 9b6c77d805 [BUGFIX] Give Record browser more UX space (thanks to Benni Mack)
2018-12-03 4347443f2e [BUGFIX] Only show pages of current language in XML sitemap (thanks to Richard Haeser)
2018-12-03 8a811b6e3f [FEATURE] Allow to override htmlTag attributes (thanks to Benni Mack)
2018-11-29 1b93464c68 [BUGFIX] Load AdditionalFactoryConfiguration.php again (thanks to Mathias Brodala)
2018-11-29 253c42fe1e [TASK] Clean up comments in FAL (thanks to Benni Mack)
2018-11-29 c3fef10f15 [BUGFIX] Make meta data editable for non-writable storages (thanks to Nicole Cordes)
2018-11-29 d01d61585a [BUGFIX] Catch exception in getData with invalid key for site configuration (thanks to Georg Ringer)
2018-11-28 9047353f8e [TASK] Update bamboo to gerrit notification url (thanks to Christian Kuhn)
2018-11-28 5327827946 [BUGFIX] Allow <s> tag in RTE processing (thanks to Andreas Fernandez)
2018-11-28 2cbaeb8bc5 [BUGFIX] Only fetch default language page for tree lists (thanks to Benni Mack)
2018-11-28 83c8d04e1d [BUGFIX] Correct label for aspect ratio 1.91:1 (thanks to Josef Glatz)
2018-11-27 425e1fe5c7 [BUGFIX] Drop GROUP BY clause in Info > PageTS Config (thanks to Andreas Fernandez)
2018-11-27 8413d6d304 [TASK] Log a warning if fluid-based preview template couldn't be rendered (thanks to Josef Glatz)
2018-11-26 d7065b3469 [BUGFIX] Enlarge scheduler object DB field (thanks to Benni Mack)
2018-11-24 5f700cfed0 Revert "[BUGFIX] Improve Performance for Inline Elements" (thanks to Oliver Hader)
2018-11-22 2ce03c6e21 [BUGFIX] Fix full example in Feature-86826-RecursiveRecordSitemap (thanks to Andreas Fernandez)
2018-11-22 23b5ff1731 [BUGFIX] User Setup: Check if languages have been configured (thanks to Andreas Fernandez)
2018-11-20 8025fa9390 [BUGFIX] Fix outdated link in docs (thanks to Philipp Kitzberger)
2018-11-19 be239c201b [BUGFIX] Remove unused fieldChangeFunc in GroupElement (thanks to Andreas Fernandez)
2018-11-19 a295c18658 [BUGFIX] Strip tags only from strings in ArrayUtility::stripTagsFromValuesRecursive (thanks to Wolfgang Klinger)
2018-11-19 f2693362a8 [TASK] Check number of file extensions (thanks to Guido Schmechel)
2018-11-19 0c948e97b0 [TASK] Add searchFields in TCA for sys_news, sys_action and sys_note (thanks to Wolfgang Klinger)
2018-11-19 198961d040 [BUGFIX] CSS selector in extension configuration modal too specific (thanks to Jonas Eberle)
2018-11-19 c5f27f00da [BUGFIX] Cast file resource pointer in UploadFileReferenceConverter (thanks to Georg Ringer)
2018-11-16 271ef66b86 [TASK] Explain "recursive" in record sitemap (thanks to Jonas Eberle)
2018-11-16 1b95f08a6e [FEATURE] Support recursive in record sitemap (thanks to Georg Ringer)
2018-11-16 206414c661 [BUGFIX] Add RootPage to Slug Candidates (thanks to Achim Fritz)
2018-11-16 cda6c03008 [BUGFIX] Select proper records in DBAL workspace restrictions (thanks to Benni Mack)
2018-11-15 5335d9aaae [BUGFIX] Remove caches if a site is deleted (thanks to Steffen Dietrich)
2018-11-14 09bd2cf424 [BUGFIX] Cast PSR-7 Uri object to string in preview links (thanks to Achim Fritz)
2018-11-14 cec73aee1e [TASK] Remove obsolete .rst file (thanks to Christian Kuhn)
2018-11-14 4e239bc980 [BUGFIX] Check Tsconfig in page module for value of content element (thanks to Georg Ringer)
2018-11-14 56dcf354a9 [BUGFIX] Set proper caching lifetime of meta tags and titles (thanks to Richard Haeser)
2018-11-14 b315587d89 Revert "[BUGFIX] Set BackendUserAspect earlier to make it usable in TSConfig" (thanks to Oliver Hader)
2018-11-09 1ab4b9a148 [TASK] Move latest rst files to correct directory (thanks to Georg Ringer)
2018-11-09 14bf40b3eb Revert "[FEATURE] Support feature toggle in expression language" (thanks to Anja Leichsenring)
2018-11-08 3823f0af9e [TASK] Only render hreflang tag when multiple languages are available (thanks to Richard Haeser)
2018-11-08 40a79c0ad1 [TASK] Respect alternative web mounts in suggest wizard (thanks to Alexander Stehlik)
2018-11-08 1a66bc9198 [BUGFIX] Correctly create schema diff for renamed fields and indexes (thanks to Helmut Hummel)
2018-11-08 2a565fa670 [BUGFIX] Use FlashMessageRendererResolver in ReferenceIndex (thanks to Georg Ringer)
2018-11-08 d70b6f51d8 [BUGFIX] Skip language -1 in preview url generation (thanks to Georg Ringer)
2018-11-08 be62d64d6b [BUGFIX] Improve Performance for Inline Elements (thanks to Tymoteusz Motylewski)
2018-11-08 43e988f420 [TASK] Remove leftovers of "options.uploadFieldsInTopOfEB" (thanks to Georg Ringer)
2018-11-08 a726ae1ec9 [BUGFIX] Remove double encoding of dataStructureIdentifier (thanks to Stefan Froemken)
2018-11-08 4532a1adf9 [BUGFIX] Send payload of image cropping wizard via POST (thanks to Andreas Fernandez)
2018-11-08 a445cca676 [BUGFIX] Detect proper TsConfig for blinding settings in tree provider (thanks to Georg Ringer)
2018-11-08 eb3ed3298f [BUGFIX] Fix various issues in Core Updater (thanks to Andreas Fernandez)
2018-11-08 0015c5e3cd [BUGFIX] Show adminpanel module in safari (thanks to Josef Glatz)
2018-11-08 d702b0918c [BUGFIX] Use sys_language isocode for SiteLanguage (thanks to Alexander Opitz)
2018-11-08 c0d321c2c0 [FEATURE] Support feature toggle in expression language (thanks to Frank Naegler)
2018-11-08 da277eb8bf [BUGFIX] Ignore provided pages for sitemap menu (thanks to Georg Ringer)
2018-11-08 ec2340a691 [BUGFIX] Include DB queries with free mode records (thanks to Benni Mack)
2018-11-08 3cdf60a9e5 [TASK] Remove fluid namespace in sitemap template (thanks to Georg Ringer)
2018-11-08 b0cfa48173 [BUGFIX] Add reports.html to acceptance tests (thanks to Steffen Dietrich)
2018-11-06 1bc7b0a4df [BUGFIX] Hide internal prefix "cat:" in tags of upgrade docs (thanks to Georg Ringer)
2018-11-06 7c7b357481 [BUGFIX] Use correct value for eventPid in DataHandler (thanks to Benni Mack)
2018-11-05 582b91167d [BUGFIX] Fix isMissing called on Null error (thanks to Bernhard Sirlinger)
2018-11-05 ff6ad483a2 [FEATURE] Improve creation of URL query strings from arrays (thanks to Stefan Neufeind)
2018-11-05 c3f32cbb3d [BUGFIX] Force word breaks in callouts (thanks to Andreas Fernandez)
2018-11-05 aabe5f7174 [BUGFIX] Respect DateTimeImmutable in Extbase (thanks to Benni Mack)
2018-11-03 2130b3499c Revert "[BUGFIX] Set constraints in FrontendRestrictionContainer depending on workspace context" (thanks to Frank Naegler)
2018-11-02 6a3a5ca11b [TASK] Raise testing-framework and styleguide (thanks to Christian Kuhn)
2018-11-02 0127c5d2ee [BUGFIX] Show correct ReST file for @validate annotation (thanks to Alexander Schnitzler)
2018-11-02 54f1399f64 [BUGFIX] Make `LoginRefresh.submitForm a lambda function (thanks to Andreas Fernandez)
2018-11-02 565764486d [BUGFIX] Keep existing validation errors for recursive domain relations (thanks to Markus Klösges)
2018-11-02 f347a3161e [TASK] Changed label for page_tree_stop (thanks to teilzeitphilosoph)
2018-11-02 c3e7779c61 [BUGFIX] Set constraints in FrontendRestrictionContainer depending on workspace context (thanks to Andreas Fernandez)
2018-11-02 1b4ff64284 [BUGFIX] Fix translated file relation with sql_mode=ONLY_FULL_GROUP_BY (thanks to Mathias Brodala)
2018-11-02 8fc01bb9a1 [BUGFIX] Provide effectivePid for flexforms segment (thanks to Patrick Lenk)
2018-11-02 0faf982923 [TASK] Allow type 'text' in site configuration (thanks to Georg Ringer)
2018-11-02 bebb019ff9 [TASK] Change cursor type hovering CE in language view (thanks to Gianluigi Martino)
2018-11-02 7b4aa3df33 [BUGFIX] Limit available languages in user setup module (thanks to Georg Ringer)
2018-10-31 63995038a7 [BUGFIX] Add missing translation value for save_and_close in form engine (thanks to Joerg Kummer)
2018-10-31 3633982d40 [BUGFIX] Adding 3 to "TYPO" (thanks to Jonathan I)
2018-10-31 d51588fc4d [TASK] Migrate FormEngineFlexForm to TypeScript (thanks to Andreas Wolf)
2018-10-31 5f109e965a [TASK] Migrate FormEngineSuggest to TypeScript (thanks to Andreas Fernandez)
2018-10-31 826955c103 [TASK] Migrate LayoutModule/Paste.js to TypeScript (thanks to Andreas Wolf)
2018-10-31 3f18227033 [BUGFIX] Resolve strict type assertion in RecordStateFactory (thanks to Oliver Hader)
2018-10-30 f7b5985f21 [BUGFIX] Adjust FrontendUserImageUpdateWizard (thanks to Alexander Grein)
2018-10-30 74146385fb [BUGFIX] Correct clickjacking header in backend (thanks to Chris Müller)
2018-10-30 cc5b38b771 [BUGFIX] Execute scheduler tasks ordered by next execution time (thanks to Sascha Egerer)
2018-10-30 b6e130c2db [BUGFIX] Allow overlay for all root level records (thanks to Mathias Brodala)
2018-10-30 60fa0872b5 [TASK] Add PHP 7.3 to bamboo core master testing (thanks to Christian Kuhn)
2018-10-30 102337e237 [TASK] Run functional tests without xdebug on bamboo (thanks to Christian Kuhn)
2018-10-30 9eb46bdd60 [BUGFIX] Show correct namespace in example block of CommaSeparatedValueProcessor (thanks to Joerg Boesche)
2018-10-30 6d2b0e8b90 [BUGFIX] Update karma (thanks to Andreas Fernandez)
2018-10-30 173304eda7 [TASK] Test fully built css in bamboo (thanks to Christian Kuhn)
2018-10-30 f605b316df [TASK] Set TYPO3 version to 9.5.2-dev (thanks to Oliver Hader)