From 314796a0b462d4572461d99a39d716d9657472bf Mon Sep 17 00:00:00 2001
From: Oliver Bartsch <bo@cedev.de>
Date: Tue, 6 Feb 2024 12:06:50 +0100
Subject: [PATCH] [BUGFIX] Handle record export and download options
 individually

The "Export" button in the list module, used to
trigger exporting a table does now also respect
the `options.impexp.enableExportForNonAdminUser`
TSconfig option, preventing a permission exception.

The `mod.web_list.noExportRecordsLinks` is no
longer used for managing the display of the
"Download" button (displayed in the table's
header row), but instead a dedicated TSconfig
option `mod.web_list.displayRecordDownload`
is introduced. Using per-table syntax, it's
also possible to manage the "Download" Button
for each table individually.

Resolves: #99781
Releases: main, 12.4
Change-Id: I8b967218626ecc05dccf4bd7ac441db56a21a753
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82883
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Oliver Bartsch <bo@cedev.de>
---
 Build/phpstan/phpstan-baseline.neon           |  5 --
 .../Controller/RecordListController.php       |  6 +--
 .../Classes/RecordList/DatabaseRecordList.php | 21 ++++++--
 ...ngAndDownloadingRecordsInTheListModule.rst | 49 +++++++++++++++++++
 4 files changed, 68 insertions(+), 13 deletions(-)
 create mode 100644 typo3/sysext/core/Documentation/Changelog/12.4.x/Important-99781-ExportingAndDownloadingRecordsInTheListModule.rst

diff --git a/Build/phpstan/phpstan-baseline.neon b/Build/phpstan/phpstan-baseline.neon
index 2bdf867b680d..20b052fb0415 100644
--- a/Build/phpstan/phpstan-baseline.neon
+++ b/Build/phpstan/phpstan-baseline.neon
@@ -35,11 +35,6 @@ parameters:
 			count: 1
 			path: ../../typo3/sysext/backend/Classes/Controller/Page/TreeController.php
 
-		-
-			message: "#^Offset 'noExportRecordsLinks' on array in isset\\(\\) always exists and is not nullable\\.$#"
-			count: 1
-			path: ../../typo3/sysext/backend/Classes/Controller/RecordListController.php
-
 		-
 			message: "#^Offset 'eval' on array on left side of \\?\\? always exists and is not nullable\\.$#"
 			count: 1
diff --git a/typo3/sysext/backend/Classes/Controller/RecordListController.php b/typo3/sysext/backend/Classes/Controller/RecordListController.php
index 19a3405f8695..e3621b2869ef 100644
--- a/typo3/sysext/backend/Classes/Controller/RecordListController.php
+++ b/typo3/sysext/backend/Classes/Controller/RecordListController.php
@@ -363,9 +363,9 @@ class RecordListController
                 ->setIcon($this->iconFactory->getIcon('actions-system-cache-clear', Icon::SIZE_SMALL));
             $buttonBar->addButton($clearCacheButton, ButtonBar::BUTTON_POSITION_RIGHT);
         }
-        if ($table && (!isset($this->modTSconfig['noExportRecordsLinks'])
-                || (isset($this->modTSconfig['noExportRecordsLinks'])
-                    && !$this->modTSconfig['noExportRecordsLinks']))
+        if ($table
+            && !($this->modTSconfig['noExportRecordsLinks'] ?? false)
+            && $this->getBackendUserAuthentication()->isExportEnabled()
         ) {
             // Export
             if (ExtensionManagementUtility::isLoaded('impexp')) {
diff --git a/typo3/sysext/backend/Classes/RecordList/DatabaseRecordList.php b/typo3/sysext/backend/Classes/RecordList/DatabaseRecordList.php
index ee9a08f42ff2..07ad7cc8bc5e 100644
--- a/typo3/sysext/backend/Classes/RecordList/DatabaseRecordList.php
+++ b/typo3/sysext/backend/Classes/RecordList/DatabaseRecordList.php
@@ -888,11 +888,22 @@ class DatabaseRecordList
 
     protected function createActionButtonDownload(string $table, int $totalItems): ?ButtonInterface
     {
-        // Do not render the download button for page translations or in case it is disabled
-        if (!$this->displayRecordDownload
-            || ($this->modTSconfig['noExportRecordsLinks'] ?? false)
-            || $this->showOnlyTranslatedRecords
-        ) {
+        // Do not render the download button for page translations or in case it is generally disabled
+        if (!$this->displayRecordDownload || $this->showOnlyTranslatedRecords) {
+            return null;
+        }
+
+        $shouldRenderDownloadButton = true;
+        // See if it is disabled in general
+        if (isset($this->modTSconfig['displayRecordDownload'])) {
+            $shouldRenderDownloadButton = (bool)$this->modTSconfig['displayRecordDownload'];
+        }
+        // Table override was explicitly set
+        if (isset($this->tableTSconfigOverTCA[$table . '.']['displayRecordDownload'])) {
+            $shouldRenderDownloadButton = (bool)$this->tableTSconfigOverTCA[$table . '.']['displayRecordDownload'];
+        }
+        // Do not render button if disabled
+        if ($shouldRenderDownloadButton === false) {
             return null;
         }
 
diff --git a/typo3/sysext/core/Documentation/Changelog/12.4.x/Important-99781-ExportingAndDownloadingRecordsInTheListModule.rst b/typo3/sysext/core/Documentation/Changelog/12.4.x/Important-99781-ExportingAndDownloadingRecordsInTheListModule.rst
new file mode 100644
index 000000000000..20a6b925fb38
--- /dev/null
+++ b/typo3/sysext/core/Documentation/Changelog/12.4.x/Important-99781-ExportingAndDownloadingRecordsInTheListModule.rst
@@ -0,0 +1,49 @@
+.. include:: /Includes.rst.txt
+
+.. _important-99781-1707215955:
+
+========================================================================
+Important: #99781 - Exporting and downloading records in the list module
+========================================================================
+
+See :issue:`99781`
+
+Description
+===========
+
+There are two different options for exporting records in the
+:guilabel:`Web->List` module.
+
+One is using the export functionality, which is provided by EXT:impexp and is
+available via the "Export" docheader button in the single table view. It is
+possible to manage the display of the button using the Page TSconfig
+:typoscript:`mod.web_list.noExportRecordsLinks` option. However, the export
+functionality is by default disabled for non-admin users, making the button
+not showing up unless the functionality is explicitly enabled for the user
+with the user TSconfig :typoscript:`options.impexp.enableExportForNonAdminUser`
+option.
+
+The "Download" functionality is available via the "Download" button in each
+tables header row. It is available in both, the list and also the single table
+view and can be managed using the Page TSconfig
+:typoscript:`mod.web_list.displayRecordDownload` option, which is enabled by
+default. Next to the general option is it also possible to set this option on
+a per-table basis using the
+:typoscript:`mod.web_list.table.<tablename>.displayRecordDownload` option.
+In case this option is set, it takes precedence over the general option.
+
+.. code-block:: typoscript
+
+    # Page TSconfig
+    mod.web_list {
+        # Disable "Export" button in docheader
+        noExportRecordsLinks = 1
+
+        # Generally disable "Download" button
+        displayRecordDownload = 0
+
+        # Enable "Download" button for table "tt_content"
+        table.tt_content.displayRecordDownload = 1
+    }
+
+.. index:: Backend, PHP-API, TSConfig, ext:backend
-- 
GitLab