All page names need to be in English.
en da  de  fr  it  ja  km  nl  ru  zh

TYPO3 4.5.14

From TYPO3Wiki
Jump to: navigation, search

<< Back to Administrators page


Release Notes for TYPO3 4.5.14

This document contains information about TYPO3 version 4.5.14 which was released on March 28th 2012.


This release is a combined bug fix and security release.


Due to security issues found in the TYPO3 Core, there was a combined release of TYPO3 4.4.14, 4.5.14 and 4.6.7.
Find more details in the security bulletin:


MD5 checksums

ccc960867b52d0b7e9b94b6f1e0dd68e  blankpackage-4.5.14.tar.gz
8925c36c8221ca02f9b646aadd4a5ee4  dummy-4.5.14.tar.gz
4e136051a58131dd5318bfc41768ac28  introductionpackage-4.5.14.tar.gz
7c5feebbbcb217b1f7c63b096df4951d  typo3_src-4.5.14.tar.gz


The usual upgrading procedure applies. No database updates are necessary.

Breaking Change

With the newly released TYPO3 versions, the description field of the filelink content element is HTML encoded by default. If you allowed editors to enter HTML code in this field, you may want to add the following line to your TypoScript template, before updating.

tt_content.uploads.20.itemRendering.20.2.htmlSpecialChars = 0

Allowing HTML in this field is discouraged for editors, same as allowing the plain HTML content.


Here is a list of what was fixed since 4.5.13:

  • [RELEASE] Release of TYPO3 4.5.14
  • [SECURITY] Missing escaping for sys_notes (#22748)
  • [SECURITY] XSS for extension meta data in About module (#30969)
  • [SECURITY] XSS in show item (#29397)
  • [SECURITY] Missing escaping in scheduler (#24474)
  • [SECURITY] XSS in BE file list (#30940)
  • [SECURITY] XSS possibility in RemoveXSS (#30188)
  • [!!!][SECURITY] XSS in filelink element (#25246)
  • [SECURITY] XSS in be_layouts (#29536)
  • [SECURITY] Information disclosure showing DB name (#29060)
  • [TASK] Raise submodule pointer
  • [BUGFIX] Missing column in t3lib_TCEmain::getPreviousLocalizedRecordUid (#35260)
  • [TASK] Clean-up PHPdoc comments in t3lib_PageRenderer (#35158)
  • [BUGFIX] Instance properties are defined statically (#35159)
  • [TASK] Add missing sql_free_result in alt_doc.php (#34771)
  • [BUGFIX] Tooltips for items in groupfields are not moved (#35176)
  • [BUGFIX] Blank page after Save+Close in page settings (#33791)
  • [TASK] Code clean-up in t3lib_PageRenderer (#35160)
  • [BUGFIX] Non-static methods in t3lib_cache are called statically (#35148)
  • [BUGFIX] t3lib_div should contain only static methods (#30050)
  • Revert "[BUGFIX] showAccessRestrictedPages doesn't replace links to restricted subpages" (#32756)
  • [BUGFIX] Fix baseurl handling of IE with RTE htmlArea in FE and realurl (#30847)
  • [BUGFIX] Fatal error 't3lib_lock' does not exist (#34662)


  • [BUGFIX] Code cleanup tx_linkvalidator_processor (#35058)
  • [BUGFIX] Methods should not be private (#34581)


  • [BUGFIX] Version record array is sorted twice (#35165)

Past Release Notes

If you have skipped one or more versions while upgrading to this version, please make sure to read the ReleaseNotes of these versions as well.