Skip to content
Snippets Groups Projects
Commit e297e235 authored by Benjamin Franzke's avatar Benjamin Franzke Committed by Oliver Hader
Browse files

[SECURITY] Do not disclose encryptionKey via InstallTool

The encryptionKey is a secret that must never be sent within any
request, therefore it is now dropped from the editing interface in
"Configure Installation-Wide Options".

The log file writer has been adapted to be aware of the fact that the
encryption key might not be set when TYPO3 has not yet been installed
(which is the case when `vendor/bin/typo3 setup` is executed).

Resolves: #103046
Releases: main, 13.0, 12.4, 11.5
Change-Id: I260a8a2e9af29908543dfe48ac3658d8c45cc440
Security-Bulletin: TYPO3-CORE-SA-2024-004
Security-References: CVE-2024-25119
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82960


Tested-by: default avatarOliver Hader <oliver.hader@typo3.org>
Reviewed-by: default avatarOliver Hader <oliver.hader@typo3.org>
parent 3c8351e3
Branches
Tags
No related merge requests found
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment