diff --git a/typo3/sysext/core/Documentation/Changelog/12.1/Deprecation-99031-DeprecatedFformathtmlInBackendContext.rst b/typo3/sysext/core/Documentation/Changelog/12.1/Deprecation-99031-DeprecatedFformathtmlInBackendContext.rst new file mode 100644 index 0000000000000000000000000000000000000000..54ad4cc3078d254dcfbd6c460e552d547d0d54a0 --- /dev/null +++ b/typo3/sysext/core/Documentation/Changelog/12.1/Deprecation-99031-DeprecatedFformathtmlInBackendContext.rst @@ -0,0 +1,46 @@ +.. include:: /Includes.rst.txt + +.. _deprecation-99031-1667998430: + +================================================================= +Deprecation: #99031 - Deprecated f:format.html in Backend context +================================================================= + +See :issue:`99031` + +Description +=========== + +The :html:`<f:format.html />` ViewHelper :php:`TYPO3\CMS\Fluid\ViewHelpers\Format\HtmlViewHelper` +should not be used in TYPO3 Backend context anymore. + +Using this ViewHelper in Backend context triggers Frontend :typoscript:`parseFunc` logic, which +should be avoided in the backend. + +There are other ViewHelpers to output and parse HTML in Backend context. See description of +the :ref:`f:sanitize.html <feature-94825-1667998632>` ViewHelper for more details. + + +Impact +====== + +Using :html:`<f:format.html />` logs a deprecation level warning. + + +Affected installations +====================== + +Instances with extensions that come with Backend modules using Fluid rendering and +accessing :html:`<f:format.html />` are affected. + + +Migration +========= + +Switch to one of the other ViewHelpers instead, typically :html:`<f:sanitize.html />` +to secure a given HTML string, :html:`<f:transform.html />` to parse links in HTML, +or :html:`<f:format.raw />` to output the HTML as is when the input can be considered +"secure". + + +.. index:: Backend, Fluid, NotScanned, ext:fluid diff --git a/typo3/sysext/core/Documentation/Changelog/9.5.x/Feature-94825-SanitizeHtmlFluidViewHelper.rst b/typo3/sysext/core/Documentation/Changelog/9.5.x/Feature-94825-SanitizeHtmlFluidViewHelper.rst index 9613f185e23a09e50b1139bad289440bd5b3e34c..b7cb34e3fe03c5633c041bd854bf10423b7c26a1 100644 --- a/typo3/sysext/core/Documentation/Changelog/9.5.x/Feature-94825-SanitizeHtmlFluidViewHelper.rst +++ b/typo3/sysext/core/Documentation/Changelog/9.5.x/Feature-94825-SanitizeHtmlFluidViewHelper.rst @@ -1,5 +1,7 @@ .. include:: /Includes.rst.txt +.. _feature-94825-1667998632: + ====================================================== Feature: #94825 - New f:sanitize.html Fluid ViewHelper ====================================================== diff --git a/typo3/sysext/fluid/Classes/ViewHelpers/Format/HtmlViewHelper.php b/typo3/sysext/fluid/Classes/ViewHelpers/Format/HtmlViewHelper.php index 12ef1d190bd65ce609d82c683b0ac31c3f2190dc..ba7f393066766b1eebdf778bc3b525882450ba02 100644 --- a/typo3/sysext/fluid/Classes/ViewHelpers/Format/HtmlViewHelper.php +++ b/typo3/sysext/fluid/Classes/ViewHelpers/Format/HtmlViewHelper.php @@ -151,10 +151,10 @@ final class HtmlViewHelper extends AbstractViewHelper /** @var RenderingContext $renderingContext */ $request = $renderingContext->getRequest(); - $isBackendRequest = $request instanceof ServerRequestInterface - && $request->getAttribute('applicationType') - && ApplicationType::fromRequest($request)->isBackend(); + $isBackendRequest = $request instanceof ServerRequestInterface && ApplicationType::fromRequest($request)->isBackend(); if ($isBackendRequest) { + // @deprecated since v12, remove in v13: Drop simulateFrontendEnvironment() and resetFrontendEnvironment() and throw a \RuntimeException here. + trigger_error('Using f:format.html in backend context has been deprecated in TYPO3 v12 and will be removed with v13', E_USER_DEPRECATED); $tsfeBackup = self::simulateFrontendEnvironment(); }