All page names need to be in English.
en da  de  fr  it  ja  km  nl  ru  zh

TYPO3 4.4.14

From TYPO3Wiki
Jump to: navigation, search

<< Back to Administrators page


Release Notes for TYPO3 4.4.14

This document contains information about TYPO3 version 4.4.14 which was released on March 28th 2012.


This release is a combined bug fix and security release.


Due to security issues found in the TYPO3 Core, there was a combined release of TYPO3 4.4.14, 4.5.14 and 4.6.7.
Find more details in the security bulletin:


MD5 checksums

d603f1c331385a0a1a1de1cfa5f16820  blankpackage-4.4.14.tar.gz
bf6df8c4f73b522aefb739f69c4b81f3  dummy-4.4.14.tar.gz
55a4a1b7df9efa91feae3160b60f2081  typo3_src-4.4.14.tar.gz


The usual upgrading procedure applies. No database updates are necessary.

Breaking Change

With the newly released TYPO3 versions, the description field of the filelink content element is HTML encoded by default. If you allowed editors to enter HTML code in this field, you may want to add the following line to your TypoScript template, before updating.

tt_content.uploads.20.itemRendering.20.2.htmlSpecialChars = 0

Allowing HTML in this field is discouraged for editors, same as allowing the plain HTML content.


Here is a list of what was fixed since 4.4.13:

  • [RELEASE] Release of TYPO3 4.4.14
  • [SECURITY] XSS possibility in RemoveXSS (#30188)
  • [SECURITY] XSS in show item (#29397)
  • [!!!][SECURITY] XSS in filelink element (#25246)
  • [SECURITY] XSS for extension meta data in About module (#30969)
  • [SECURITY] Missing escaping in scheduler (#24474)
  • [SECURITY] XSS in BE file list (#30940)
  • [SECURITY] Missing escaping for sys_notes (#22748)
  • [SECURITY] Information disclosure showing DB name (#29060)
  • [BUGFIX] Tooltips for items in groupfields are not moved (#35176)
  • [BUGFIX] Send no-cache headers in t3lib_userauth (#24125)
  • [TASK] Update copyright year to 2012 (#34600)
  • [BUGFIX] cmpIPv4: prevent E_NOTICE, cleanup compare, testcases (#27230)
  • [BUGFIX] getAllowedItems called with one parameter too much (#34030)

Past Release Notes

If you have skipped one or more versions while upgrading to this version, please make sure to read the ReleaseNotes of these versions as well.