Skip to content
Snippets Groups Projects
  1. Apr 07, 2024
    • Christian Kuhn's avatar
      [BUGFIX] Mitigate misusing request 'id' as pages-uid in extbase BE · 524267cd
      Christian Kuhn authored
      The backend uses request GET/POST parameter 'id' as convention for
      "pages uid" at various places: Especially the BackendModuleValidator
      checks for this parameter early, to deny access to pages a BE user
      has no access to.
      
      This convention is a broken misuse: There is no such convention,
      and for instance the filelist module uses 'id' to transfer a
      selected "storage-uid:path".
      
      The BackendModuleValidator mitigates this by calling
      MU::canBeInterpretedAsInteger() before interpreting that
      parameter as a pages-uid.
      
      The extbase BackendConfigurationManager also uses 'id' to retrieve
      the FE TypoScript configuration for this "pages-uid", it however
      does not check with MU::canBeInterpretedAsInteger(), first.
      
      The patch adds a MU::canBeInterpretedAsInteger() check to extbase
      BackendConfigurationManager to be in-line with BackendModuleValidator,
      and adds `@todo` comments outlining the general misuse of the argument.
      
      Change-Id: I9b53a521bde4d3c145bfda2994d81dc4abf9c103
      Resolves: #103540
      Related: #96797
      Releases: main, 12.4
      Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83678
      
      
      Reviewed-by: default avatarChristian Kuhn <lolli@schwarzbu.ch>
      Tested-by: default avatarcore-ci <typo3@b13.com>
      Tested-by: default avatarChristian Kuhn <lolli@schwarzbu.ch>
      524267cd
  2. Apr 05, 2024
  3. Apr 04, 2024
  4. Apr 03, 2024
  5. Apr 02, 2024
  6. Apr 01, 2024
  7. Mar 25, 2024
  8. Mar 23, 2024
  9. Mar 22, 2024
  10. Mar 21, 2024
  11. Mar 20, 2024
  12. Mar 19, 2024
  13. Mar 18, 2024
  14. Mar 17, 2024
  15. Mar 16, 2024
  16. Mar 15, 2024
  17. Mar 14, 2024