From a01aa6f33daf417df32afec52ca22c55170ee421 Mon Sep 17 00:00:00 2001
From: Christian Kuhn <lolli@schwarzbu.ch>
Date: Fri, 7 Apr 2023 13:33:42 +0200
Subject: [PATCH] [BUGFIX] Sanitize BackendUtility::titleAttribForPages()
When the "Access" module is called without a selected
page, the root page icon rendering triggers a PHP 8.0
array access warning.
This was triggered by the refactoring with #100454, but
is a general issue of the method, which is why the patch
should go to 11.5 as well.
The patch sanitizes $row['uid']. Other parts of the
method access further array keys without fallback,
but those should be fine - at least for now - since
this is about 'pages', and if there is a uid, the
other fields are probably provided as well.
Resolves: #100527
Related: #100454
Releases: main, 11.5
Change-Id: I40df9fcb86a145cfa68f7dc3086649c52efe7d79
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/78535
Reviewed-by: Benni Mack <benni@typo3.org>
Reviewed-by: Oliver Klee <typo3-coding@oliverklee.de>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Jochen <rothjochen@gmail.com>
Tested-by: Benni Mack <benni@typo3.org>
Tested-by: Jochen <rothjochen@gmail.com>
---
typo3/sysext/backend/Classes/Utility/BackendUtility.php | 3 +++
1 file changed, 3 insertions(+)
diff --git a/typo3/sysext/backend/Classes/Utility/BackendUtility.php b/typo3/sysext/backend/Classes/Utility/BackendUtility.php
index c09ddabc1caa..93e840a09e25 100644
--- a/typo3/sysext/backend/Classes/Utility/BackendUtility.php
+++ b/typo3/sysext/backend/Classes/Utility/BackendUtility.php
@@ -1113,6 +1113,9 @@ class BackendUtility
*/
public static function titleAttribForPages($row, $perms_clause = '', $includeAttrib = true)
{
+ if (!isset($row['uid'])) {
+ return '';
+ }
$lang = static::getLanguageService();
$parts = [];
$parts[] = 'id=' . $row['uid'];
--
GitLab