Skip to content
Snippets Groups Projects
Commit 1d6079ab authored by Christian Kuhn's avatar Christian Kuhn
Browse files

[BUGFIX] Mitigate misusing request 'id' as pages-uid in extbase BE

The backend uses request GET/POST parameter 'id' as convention for
"pages uid" at various places: Especially the BackendModuleValidator
checks for this parameter early, to deny access to pages a BE user
has no access to.

This convention is a broken misuse: There is no such convention,
and for instance the filelist module uses 'id' to transfer a
selected "storage-uid:path".

The BackendModuleValidator mitigates this by calling
MU::canBeInterpretedAsInteger() before interpreting that
parameter as a pages-uid.

The extbase BackendConfigurationManager also uses 'id' to retrieve
the FE TypoScript configuration for this "pages-uid", it however
does not check with MU::canBeInterpretedAsInteger(), first.

The patch adds a MU::canBeInterpretedAsInteger() check to extbase
BackendConfigurationManager to be in-line with BackendModuleValidator,
and adds `@todo` comments outlining the general misuse of the argument.

Change-Id: I9b53a521bde4d3c145bfda2994d81dc4abf9c103
Resolves: #103540
Related: #96797
Releases: main, 12.4
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83674


Reviewed-by: default avatarGarvin Hicking <gh@faktor-e.de>
Tested-by: default avatarcore-ci <typo3@b13.com>
Tested-by: default avatarStefan Bürk <stefan@buerk.tech>
Tested-by: default avatarChristian Kuhn <lolli@schwarzbu.ch>
Tested-by: default avatarGarvin Hicking <gh@faktor-e.de>
Reviewed-by: default avatarChristian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: default avatarStefan Bürk <stefan@buerk.tech>
parent fbef6ad9
Branches
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment