The string-based configuration option
$GLOBALS['TYPO3_CONF_VARS']['GFX']['processor_stripColorProfileCommand']
has been superseded by
$GLOBALS['TYPO3_CONF_VARS']['GFX']['processor_stripColorProfileParameters']
for security reasons.
The former option expected a string of command line parameters. The
defined parameters had to be shell-escaped beforehand, while the new
option expects an array of strings that will be shell-escaped by TYPO3
when used.
The existing configuration will continue to be supported. Still, it is
suggested to use the new configuration format, as the Install Tool is
adapted to allow modification of the new configuration option only:
// Before
$GLOBALS['TYPO3_CONF_VARS']['GFX']['processor_stripColorProfileCommand'] = '+profile \'*\'';
// After
$GLOBALS['TYPO3_CONF_VARS']['GFX']['processor_stripColorProfileParameters'] = [
'+profile',
'*'
];
simonschaufi
commented
1 month ago
Important: #102799 - TYPO3_CONF_VARS.GFX.processor_stripColorProfileParameters option added
https://docs.typo3.org/c/typo3/cms-core/main/en-us/Changelog/11.5.x/Important-102799-TYPO3_CONF_VARSGFXprocessor_stripColorProfileParametersOptionAdded.html
Important: #102799 - TYPO3_CONF_VARS.GFX.processor_stripColorProfileParameters option added
See 102799
Description
The string-based configuration option
$GLOBALS['TYPO3_CONF_VARS']['GFX']['processor_stripColorProfileCommand']has been superseded by$GLOBALS['TYPO3_CONF_VARS']['GFX']['processor_stripColorProfileParameters']for security reasons.The former option expected a string of command line parameters. The defined parameters had to be shell-escaped beforehand, while the new option expects an array of strings that will be shell-escaped by TYPO3 when used.
The existing configuration will continue to be supported. Still, it is suggested to use the new configuration format, as the Install Tool is adapted to allow modification of the new configuration option only: