Skip to content
Snippets Groups Projects
Commit 10a41357 authored by Benjamin Franzke's avatar Benjamin Franzke
Browse files

[BUGFIX] Fix sudo mode in non-Sec-Fetch-Dest context

Since #94084 all module URLs are automatically framed by
the TYPO3 main controller whenever they are opened in a
Sec-Fetch-Dest aware request. (HTTPS or localhost domain)
The intention of API is to allow module-links
to be opened in a new tab by user intent – but due to
technical limitation that feature is limited to
secure contexts, and must therefore not be relied on
as an API for internal redirects.

sudo mode made use of this API and redirected
via top.location to the privileged module, relying
on the fact that iframe module-requests where detected
to be loaded in the wrong context, to produce
a redirect to the proper backend-frame, this didn't
work for non HTTPS requests.

This workaround has been done to remove "sudo-mode"
from the URL bar. That workaround is no longer needed
as #101287 added support for installtool URL
bar synchronisation.
ContentContainer API is now used to set the URL.

Releases: main, 12.4
Resolves: #101288
Related: #101287
Change-Id: Id8b828662e3cd2739a93eda5f9517f896c65e941
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/79921


Tested-by: default avatarBenjamin Franzke <ben@bnf.dev>
Reviewed-by: default avatarBenjamin Franzke <ben@bnf.dev>
Tested-by: default avatarcore-ci <typo3@b13.com>
parent e1f4d209
Branches
Tags
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment