Skip to content
  • Benjamin Franzke's avatar
    [BUGFIX] Fix sudo mode in non-Sec-Fetch-Dest context · 10a41357
    Benjamin Franzke authored
    Since #94084 all module URLs are automatically framed by
    the TYPO3 main controller whenever they are opened in a
    Sec-Fetch-Dest aware request. (HTTPS or localhost domain)
    The intention of API is to allow module-links
    to be opened in a new tab by user intent – but due to
    technical limitation that feature is limited to
    secure contexts, and must therefore not be relied on
    as an API for internal redirects.
    
    sudo mode made use of this API and redirected
    via top.location to the privileged module, relying
    on the fact that iframe module-requests where detected
    to be loaded in the wrong context, to produce
    a redirect to the proper backend-frame, this didn't
    work for non HTTPS requests.
    
    This workaround has been done to remove "sudo-mode"
    from the URL bar. That workaround is no longer needed
    as #101287 added support for installtool URL
    bar synchronisation.
    ContentContainer API is now used to set the URL.
    
    Releases: main, 12.4
    Resolves: #101288
    Related: #101287
    Change-Id: Id8b828662e3cd2739a93eda5f9517f896c65e941
    Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79921
    
    
    Tested-by: default avatarBenjamin Franzke <ben@bnf.dev>
    Reviewed-by: default avatarBenjamin Franzke <ben@bnf.dev>
    Tested-by: default avatarcore-ci <typo3@b13.com>
    10a41357