Skip to content
Snippets Groups Projects
  1. Jun 10, 2019
  2. Jun 09, 2019
  3. Jun 08, 2019
  4. Jun 07, 2019
  5. Jun 06, 2019
  6. Jun 05, 2019
  7. Jun 04, 2019
  8. Jun 03, 2019
  9. May 31, 2019
  10. May 30, 2019
    • Benni Mack's avatar
      [!!!][TASK] Remove Frontend Track User functionality · 8300dd31
      Benni Mack authored
      The functionality "ftu" ("Frontend Track User"), which allows
      to send the session through GET parameter within the site
      has been removed.
      
      It was used to hand in a session via `config.ftu = 1` and
      the GET parameter "ftu=a-32-character-string", which then
      started a session which was added to any link generated.
      
      This way, sessions could _have_ been transferred across
      domains but only if cookies would not be activated by
      the browser, which is unreliable.
      
      In order to pave the way to modern standards (OTP
      or JWT), this functionality is removed, as the ftu functionality
      has some flaws, conceptually and security wise.
      
      Removed public properties
      * AbstractUserAuthentication->get_name
      * AbstractUserAuthentication->getFallBack
      * AbstractUserAuthentication->getMethodEnabled
      * AbstractUserAuthentication->get_URL_ID
      * TypoScriptFrontendController->getMethodUrlIdToken
      
      Removed TypoScript:
      * config.ftu = 1
      
      Removed TYPO3_CONF_VARS
      * $TYPO3_CONF_VARS[FE][get_url_id_token]
      
      GET Parameter "ftu" has no special meaning anymore.
      
      Resolves: #88458
      Releases: master
      Change-Id: I664be44228b2180909f6abfda8acfcd5fe36aa5a
      Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60840
      
      
      Tested-by: default avatarMarkus Klein <markus.klein@typo3.org>
      Tested-by: default avatarTYPO3com <noreply@typo3.com>
      Tested-by: default avatarAndreas Fernandez <a.fernandez@scripting-base.de>
      Reviewed-by: default avatarMarkus Klein <markus.klein@typo3.org>
      Reviewed-by: default avatarAndreas Fernandez <a.fernandez@scripting-base.de>
      8300dd31
  11. May 29, 2019
  12. May 27, 2019