From 245f0a9f1e404f99b49d93dfc888d3c83137d811 Mon Sep 17 00:00:00 2001
From: Oliver Hader <oliver@typo3.org>
Date: Mon, 29 Jan 2018 16:43:45 +0100
Subject: [PATCH] [BUGFIX] Invalid session token on creating content element in
admin panel
When creating a new content element in the frontend using the according
button in the "editing" section of the admin panel, the request to the
TYPO3 backend is rejected due to an invalid XSRF session token:
Validating the security token of this form has failed.
Please reload the form and submit it again.
The reason is, that the URL after issue #70055 looks like the following
"token=<hash>id=<id>" instead of "token=<hash>&id=<id>" - the id became
part of the XSRF session token.
Resolves: #83719
Releases: master, 8.7, 7.6
Change-Id: Ibdd252b2e59d9e8de78bb0be14a95e0789dc0d17
Reviewed-on: https://review.typo3.org/55490
Tested-by: TYPO3com <no-reply@typo3.com>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
---
.../sysext/frontend/Classes/View/AdminPanelView.php | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/typo3/sysext/frontend/Classes/View/AdminPanelView.php b/typo3/sysext/frontend/Classes/View/AdminPanelView.php
index a8516ba2d8de..c20a24a93b1f 100644
--- a/typo3/sysext/frontend/Classes/View/AdminPanelView.php
+++ b/typo3/sysext/frontend/Classes/View/AdminPanelView.php
@@ -655,7 +655,6 @@ class AdminPanelView
$moduleName = isset($tsConfig['properties']['newContentElementWizard.']['override'])
? $tsConfig['properties']['newContentElementWizard.']['override']
: 'new_content_element';
- $newContentWizScriptPath = BackendUtility::getModuleUrl($moduleName);
$perms = $this->getBackendUser()->calcPerms($tsfe->page);
$langAllowed = $this->getBackendUser()->checkLanguageAccess($tsfe->sys_language_uid);
$id = $tsfe->id;
@@ -665,12 +664,15 @@ class AdminPanelView
$link = BackendUtility::getModuleUrl('record_history', ['element' => 'pages:' . $id, 'returnUrl' => $returnUrl]);
$toolBar = '<a class="t3-icon btn btn-default" href="' . htmlspecialchars($link) . '#latest" title="' . $this->extGetLL('edit_recordHistory') . '">' . $icon . '</a>';
if ($perms & Permission::CONTENT_EDIT && $langAllowed) {
- $params = '';
- if ($tsfe->sys_language_uid) {
- $params = '&sys_language_uid=' . $tsfe->sys_language_uid;
+ $linkParameters = [
+ 'id' => $id,
+ 'returnUrl' => $returnUrl,
+ ];
+ if (!empty($tsfe->sys_language_uid)) {
+ $linkParameters['sys_language_uid'] = $tsfe->sys_language_uid;
}
+ $link = BackendUtility::getModuleUrl($moduleName, $linkParameters);
$icon = $this->iconFactory->getIcon('actions-document-new', Icon::SIZE_SMALL)->render();
- $link = $newContentWizScriptPath . 'id=' . $id . $params . '&returnUrl=' . rawurlencode($returnUrl);
$toolBar .= '<a class="t3-icon btn btn-default" href="' . htmlspecialchars($link) . '" title="' . $this->extGetLL('edit_newContentElement') . '"">' . $icon . '</a>';
}
if ($perms & Permission::PAGE_EDIT) {
--
GitLab