[TASK] Add backwards-compatibility for old BE modules

Handling of "&M" parameters is added back in order to make
the transition for Backend modules easier.

Resolves: #83800
Related: #82406
Releases: master
Change-Id: Iaa237b62254804d78314b48d80dfbea563fd7af4
Reviewed-on: https://review.typo3.org/55589


Tested-by: TYPO3com <no-reply@typo3.com>
Reviewed-by: Mathias Schreiber <mathias.schreiber@typo3.com>
Tested-by: Mathias Schreiber <mathias.schreiber@typo3.com>
Reviewed-by: Susanne Moog <susanne.moog@typo3.org>
Tested-by: Susanne Moog <susanne.moog@typo3.org>
Reviewed-by: Benni Mack <benni@typo3.org>
Tested-by: Benni Mack <benni@typo3.org>

typo3/sysext/backend/Classes/Http/RequestHandler.php

@@ -19,6 +19,7 @@ use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
 use Psr\Http\Server\RequestHandlerInterface as PsrRequestHandlerInterface;
 use TYPO3\CMS\Backend\Routing\Exception\InvalidRequestTokenException;
+use TYPO3\CMS\Backend\Routing\Router;
 use TYPO3\CMS\Core\Core\Bootstrap;
 use TYPO3\CMS\Core\Http\RedirectResponse;
 use TYPO3\CMS\Core\Http\RequestHandlerInterface;
@@ -77,17 +78,27 @@ class RequestHandler implements RequestHandlerInterface, PsrRequestHandlerInterf
         $moduleName = $request->getQueryParams()['M'] ?? $request->getParsedBody()['M'] ?? null;
         // Allow the login page to be displayed if routing is not used and on index.php
         $pathToRoute = $request->getQueryParams()['route'] ?? $request->getParsedBody()['route'] ?? $moduleName ?? '/login';
-        $request = $request->withAttribute('routePath', $pathToRoute);
 
         // skip the BE user check on the login page
         // should be handled differently in the future by checking the Bootstrap directly
         $this->boot($pathToRoute === '/login');
 
         if ($moduleName !== null) {
+            // backwards compatibility for old module names
+            // @deprecated since TYPO3 CMS 9, will be removed in TYPO3 CMS 10.
+            $router = GeneralUtility::makeInstance(Router::class);
+            foreach ($router->getRoutes() as $routeIdentifier => $route) {
+                if ($routeIdentifier === $moduleName) {
+                    $pathToRoute = $route->getPath();
+                    break;
+                }
+            }
+
             trigger_error('Calling the TYPO3 Backend with "M" GET parameter will be removed in TYPO3 v10,'
                 . ' the calling code calls this script with "&M=' . $moduleName . '" and needs to be adapted'
                 . ' to use the TYPO3 API.', E_USER_DEPRECATED);
         }
+        $request = $request->withAttribute('routePath', $pathToRoute);
 
         // Check if the router has the available route and dispatch.
         try {

typo3/sysext/backend/Classes/Http/RouteDispatcher.php

@@ -88,7 +88,13 @@ class RouteDispatcher extends Dispatcher implements DispatcherInterface
             return true;
         }
         $token = (string)($request->getParsedBody()['token'] ?? $request->getQueryParams()['token']);
-        return $this->getFormProtection()->validateToken($token, 'route', $route->getOption('_identifier'));
+        if ($token) {
+            return $this->getFormProtection()->validateToken($token, 'route', $route->getOption('_identifier'));
+        }
+        // backwards compatibility: check for M and module token params
+        // @deprecated since TYPO3 CMS 9, will be removed in TYPO3 CMS 10.
+        $token = (string)($request->getParsedBody()['moduleToken'] ?? $request->getQueryParams()['moduleToken']);
+        return $this->getFormProtection()->validateToken($token, 'moduleCall', $request->getParsedBody()['M'] ?? $request->getQueryParams()['M']);
     }
 
     /**

typo3/sysext/extbase/Classes/Mvc/Web/Routing/UriBuilder.php

@@ -14,6 +14,7 @@ namespace TYPO3\CMS\Extbase\Mvc\Web\Routing;
  * The TYPO3 project - inspiring people to share!
  */
 
+use TYPO3\CMS\Backend\Routing\Exception\ResourceNotFoundException;
 use TYPO3\CMS\Core\Utility\ArrayUtility;
 use TYPO3\CMS\Core\Utility\GeneralUtility;
 use TYPO3\CMS\Extbase\Mvc\Request;
@@ -664,7 +665,9 @@ class UriBuilder
             }
         } else {
             $id = GeneralUtility::_GP('id');
-            $module = GeneralUtility::_GP('route');
+            // backwards compatibility: check for M parameter
+            // @deprecated since TYPO3 CMS 9, will be removed in TYPO3 CMS 10.
+            $module = GeneralUtility::_GP('route') ?: GeneralUtility::_GP('M');
             if ($id !== null) {
                 $arguments['id'] = $id;
             }
@@ -678,13 +681,13 @@ class UriBuilder
         $moduleName = $arguments['route'] ?? null;
         unset($arguments['route'], $arguments['token']);
         $backendUriBuilder = GeneralUtility::makeInstance(\TYPO3\CMS\Backend\Routing\UriBuilder::class);
-        if (!empty($moduleName)) {
+        try {
             if ($this->request instanceof WebRequest && $this->createAbsoluteUri) {
                 $uri = (string)$backendUriBuilder->buildUriFromRoutePath($moduleName, $arguments, \TYPO3\CMS\Backend\Routing\UriBuilder::ABSOLUTE_URL);
             } else {
                 $uri = (string)$backendUriBuilder->buildUriFromRoutePath($moduleName, $arguments, \TYPO3\CMS\Backend\Routing\UriBuilder::ABSOLUTE_PATH);
             }
-        } else {
+        } catch (ResourceNotFoundException $e) {
             if ($this->request instanceof WebRequest && $this->createAbsoluteUri) {
                 $uri = (string)$backendUriBuilder->buildUriFromModule($moduleName, $arguments, \TYPO3\CMS\Backend\Routing\UriBuilder::ABSOLUTE_URL);
             } else {