[TASK] Introduce sudo mode for install tool accessed via backend
The session expiration time for the install tool is reduced from 60 to 15 minutes. When accessing the install tool via backend user interface, currently logged in backend users have to confirm their user password again in order to get access to the install tool. This process is known as "sudo mode". Standalone install tool is not affected by sudo mode confirmation. This change enforces mitigation as mentioned in TYPO3-CORE-SA-2020-006, see https://typo3.org/security/advisory/typo3-core-sa-2020-006. Resolves: #92836 Releases: master, 10.4, 9.5 Change-Id: Ib4f0e92346610879347a48587ffd575429b98650 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66630 Tested-by:TYPO3com <noreply@typo3.com> Tested-by:
Markus Klein <markus.klein@typo3.org> Tested-by:
Torben Hansen <derhansen@gmail.com> Tested-by:
Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Markus Klein <markus.klein@typo3.org> Reviewed-by:
Torben Hansen <derhansen@gmail.com> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
Showing
- typo3/sysext/core/Documentation/Changelog/9.5.x/Important-92836-IntroduceSudoModeForInstallToolAccessedViaBackend.rst 62 additions, 0 deletions...836-IntroduceSudoModeForInstallToolAccessedViaBackend.rst
- typo3/sysext/core/Tests/Acceptance/Install/AbstractIntroductionPackage.php 14 additions, 0 deletions.../Tests/Acceptance/Install/AbstractIntroductionPackage.php
- typo3/sysext/core/Tests/Acceptance/Install/Mysql/BlankPageCest.php 3 additions, 3 deletions...ext/core/Tests/Acceptance/Install/Mysql/BlankPageCest.php
- typo3/sysext/core/Tests/Acceptance/Install/Mysql/IntroductionPackageCest.php 3 additions, 3 deletions...ests/Acceptance/Install/Mysql/IntroductionPackageCest.php
- typo3/sysext/install/Classes/Controller/BackendModuleController.php 241 additions, 12 deletions...xt/install/Classes/Controller/BackendModuleController.php
- typo3/sysext/install/Classes/Service/SessionService.php 2 additions, 2 deletionstypo3/sysext/install/Classes/Service/SessionService.php
- typo3/sysext/install/Classes/ServiceProvider.php 1 addition, 0 deletionstypo3/sysext/install/Classes/ServiceProvider.php
- typo3/sysext/install/Configuration/Backend/Routes.php 14 additions, 0 deletionstypo3/sysext/install/Configuration/Backend/Routes.php
- typo3/sysext/install/Resources/Private/Language/BackendModule.xlf 21 additions, 0 deletions...sext/install/Resources/Private/Language/BackendModule.xlf
- typo3/sysext/install/Resources/Private/Templates/BackendModule/BackendUserConfirmation.html 71 additions, 0 deletions...vate/Templates/BackendModule/BackendUserConfirmation.html
Please register or sign in to comment