diff --git a/typo3/sysext/backend/Classes/Utility/BackendUtility.php b/typo3/sysext/backend/Classes/Utility/BackendUtility.php index 2d10fe1fa066e0873feac2303f47f92c89e0148b..85d7c26a87a232c2fd321771169927cc9cc8697d 100644 --- a/typo3/sysext/backend/Classes/Utility/BackendUtility.php +++ b/typo3/sysext/backend/Classes/Utility/BackendUtility.php @@ -2317,33 +2317,6 @@ class BackendUtility ' />'; } - /** - * Input field function menu - * Works like ->getFuncMenu() / ->getFuncCheck() but displays an input field instead which updates the script "onchange" - * - * @param mixed $mainParams $id is the "&id=" parameter value to be sent to the module, but it can be also a parameter array which will be passed instead of the &id=... - * @param string $elementName The form elements name, probably something like "SET[...] - * @param string $currentValue The value to be selected currently. - * @param int $size Relative size of input field, max is 48 - * @param string $script The script to send the &id to, if empty it's automatically found - * @param string $addParams Additional parameters to pass to the script. - * @return string HTML code for input text field. - * @see getFuncMenu() - * @todo not used at least since TYPO3 v9, drop in TYPO3 v12.0 - */ - public static function getFuncInput( - $mainParams, - $elementName, - $currentValue, - $size = 10, - $script = '', - $addParams = '' - ) { - $scriptUrl = self::buildScriptUrl($mainParams, $addParams, $script); - $onChange = 'window.location.href = ' . GeneralUtility::quoteJSvalue($scriptUrl . '&' . $elementName . '=') . '+escape(this.value);'; - return '<input type="text" class="form-control" name="' . $elementName . '" value="' . htmlspecialchars($currentValue) . '" onchange="' . htmlspecialchars($onChange) . '" />'; - } - /** * Builds the URL to the current script with given arguments * diff --git a/typo3/sysext/core/Documentation/Changelog/12.0/Breaking-96829-RemovedBackendUtility-getFuncInput.rst b/typo3/sysext/core/Documentation/Changelog/12.0/Breaking-96829-RemovedBackendUtility-getFuncInput.rst new file mode 100644 index 0000000000000000000000000000000000000000..968e75d3a91440dfad2c945f4a57bbee690ce52b --- /dev/null +++ b/typo3/sysext/core/Documentation/Changelog/12.0/Breaking-96829-RemovedBackendUtility-getFuncInput.rst @@ -0,0 +1,40 @@ +.. include:: ../../Includes.txt + +========================================================= +Breaking: #96829 - Removed BackendUtility->getFuncInput() +========================================================= + +See :issue:`96829` + +Description +=========== + +Method :php:`BackendUtility::getFuncInput()` is incompatible with +`Content-Security-Policy` HTTP headers due to its onchange JavaScript +handler, and has been removed. + + +Impact +====== + +Instances with extensions using the method will raise a fatal +PHP error upon use. + + +Affected Installations +====================== + +The method is part of very old-school backend module code and of limited use. +TYPO3 core code does not use it since at least v9, it is relatively unlikely +backend modules of extensions still use this method. The extension scanner +finds usages with a strong match. + + +Migration +========= + +No direct migration available. The input field HTML should most likely be inlined +to a template and eventual JavaScript events should be handled with a JavaScript +module. + +.. index:: Backend, PHP-API, FullyScanned, ext:backend diff --git a/typo3/sysext/install/Configuration/ExtensionScanner/Php/MethodCallStaticMatcher.php b/typo3/sysext/install/Configuration/ExtensionScanner/Php/MethodCallStaticMatcher.php index 90581f993d9e18b0d9309640129d0aaa891bf103..f08bd3eab29a3d4bfb39d219e8e70f636971e5f2 100644 --- a/typo3/sysext/install/Configuration/ExtensionScanner/Php/MethodCallStaticMatcher.php +++ b/typo3/sysext/install/Configuration/ExtensionScanner/Php/MethodCallStaticMatcher.php @@ -1364,4 +1364,11 @@ return [ 'Breaking-96733-RemovedSupportForModuleHandlingBasedOnTBE_MODULES.rst', ], ], + 'TYPO3\CMS\Backend\Utility\BackendUtility::getFuncInput' => [ + 'numberOfMandatoryArguments' => 3, + 'maximumNumberOfArguments' => 6, + 'restFiles' => [ + 'Breaking-96829-RemovedBackendUtility-getFuncInput.rst', + ], + ], ];