diff --git a/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php b/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php index d1c4c9379e2b59cd5e30ddd034de90d76748d90c..6fd922fa9b803bd6ce92476e67c4aa2ce2cd0dac 100644 --- a/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php +++ b/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php @@ -181,13 +181,7 @@ abstract class AbstractUserAuthentication implements LoggerAwareInterface public $user; /** - * Will force the session cookie to be set every time (lifetime must be 0) - * @var bool - */ - public $forceSetCookie = false; - - /** - * Will prevent the setting of the session cookie (takes precedence over forceSetCookie) + * Will prevent the setting of the session cookie * @var bool */ public $dontSetCookie = false; @@ -379,7 +373,7 @@ abstract class AbstractUserAuthentication implements LoggerAwareInterface */ public function isSetSessionCookie() { - return ($this->userSession->isNew() || $this->forceSetCookie) && $this->lifetime === 0; + return $this->userSession->isNew() && $this->lifetime === 0; } /** diff --git a/typo3/sysext/core/Documentation/Changelog/master/Breaking-93073-AbstractUserAuthentication-forceSetCookieRemoved.rst b/typo3/sysext/core/Documentation/Changelog/master/Breaking-93073-AbstractUserAuthentication-forceSetCookieRemoved.rst new file mode 100644 index 0000000000000000000000000000000000000000..a4f8e5b48b16d07e0be7f3c99d80c032198aef82 --- /dev/null +++ b/typo3/sysext/core/Documentation/Changelog/master/Breaking-93073-AbstractUserAuthentication-forceSetCookieRemoved.rst @@ -0,0 +1,40 @@ +.. include:: ../../Includes.txt + +===================================================================== +Breaking: #93073 - AbstractUserAuthentication->forceSetCookie removed +===================================================================== + +See :issue:`93073` + +Description +=========== + +The public property `forceSetCookie` +is removed from the PHP class `AbstractUserAuthentication`. + +This property served to ensure that a cookie should be added +at any times, which is useful for time-based cookies, which only +happen in Frontend user sessions. This property is now moved as a protected +property into the FrontendUserAuthentication class and used in this class +solely to reduce the complexity of the internal logic as well as outside API. + + +Impact +====== + +Setting this property has no effect anymore, setting this property on a Frontend User object will trigger a PHP warning. + + +Affected Installations +====================== + +TYPO3 installations with third-party extensions and special cookie handling, which is very unlikely. + + +Migration +========= + +If custom functionality for setting cookies is needed, it is highly +recommended to send cookies manually via a PSR-15 middleware. + +.. index:: Backend, Frontend, PHP-API, FullyScanned, ext:core diff --git a/typo3/sysext/frontend/Classes/Authentication/FrontendUserAuthentication.php b/typo3/sysext/frontend/Classes/Authentication/FrontendUserAuthentication.php index fdb2cddedb64b5230d907e67399daecb772c99a6..2d80b56ce15f569681abef4e101e8a57874e12b0 100644 --- a/typo3/sysext/frontend/Classes/Authentication/FrontendUserAuthentication.php +++ b/typo3/sysext/frontend/Classes/Authentication/FrontendUserAuthentication.php @@ -151,6 +151,12 @@ class FrontendUserAuthentication extends AbstractUserAuthentication */ protected $loginHidden = false; + /** + * Will force the session cookie to be set every time (lifetime must be 0). + * @var bool + */ + protected $forceSetCookie = false; + /** * Will prevent the setting of the session cookie (takes precedence over forceSetCookie) * Disable cookie by default, will be activated if saveSessionData() is called, diff --git a/typo3/sysext/install/Configuration/ExtensionScanner/Php/PropertyPublicMatcher.php b/typo3/sysext/install/Configuration/ExtensionScanner/Php/PropertyPublicMatcher.php index a216c07337be513879d4ae2a852a48eddc76e4ee..a10abc304f02a626e8bf7442beaa0eeb74485b4d 100644 --- a/typo3/sysext/install/Configuration/ExtensionScanner/Php/PropertyPublicMatcher.php +++ b/typo3/sysext/install/Configuration/ExtensionScanner/Php/PropertyPublicMatcher.php @@ -795,4 +795,9 @@ return [ 'Breaking-93062-VariousGroup-relatedPublicPropertiesInBE_USERRemoved.rst', ], ], + 'TYPO3\CMS\Core\Authentication\AbstractUserAuthentication->forceSetCookie' => [ + 'restFiles' => [ + 'Breaking-93073-AbstractUserAuthentication-forceSetCookieRemoved.rst', + ], + ], ];