[SECURITY] Synchronize admin tools session with backend user session (40f1ea7b) · Commits · TYPO3 / TYPO3.CMS

Commit 40f1ea7b authored 2 years ago by

Oliver Hader Committed by Oliver Hader 2 years ago

[SECURITY] Synchronize admin tools session with backend user session

Admin tools sessions are revoked in case the initiatin backend user
does not have admin or system maintainer privileges anymore. Besides
that, revoking backend user interface sessions now also revokes access
to admin tools. Standalone install tool is not affected.

Resolves: #92019
Releases: main, 11.5, 10.4
Change-Id: I367098abd632fa34caa59e4e165f5ab1916894c5
Security-Bulletin: TYPO3-CORE-SA-2022-005
Security-References: CVE-2022-31050
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74896


Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

parent 7d46791c

Branches