Project

General

Profile

Actions

Bug #24453

closed

showpic.php causes a fatal error if parameters GET variable is not an array

Added by Helmut Hummel over 13 years ago. Updated over 11 years ago.

Status:
Closed
Priority:
Could have
Category:
-
Target version:
-
Start date:
2011-01-02
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
4.3
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

Problem:
After upgrading to TYPO3 version 4.3.9, the URL to the showpic functionality changed (see #24140). Since search engines still may have this old URLs in the index, the call to this URL will lead to a fatal PHP error, since the parameters GET variable is not used there.

Solution:
Check if the parameters are transmitted and an array.

Note:
For trunk it would be a further improvement to replace the die() calls with an exception. For this to work properly the error handler must be initialized. The advantage in doing so is a nicer error message and a 500 http header beeing sent forcing the search engines to (hopefully) not index this URL

For 4.4 I also removed the unnecessary use of the encryption key, which was also introduced in #24140 This will of course also change the hash of the showpic functionality, but using the encryption key there is misleading, so I would change it nevertheless.

(issue imported from #M16891)


Files

16891_4-3.diff (1.26 KB) 16891_4-3.diff Administrator Admin, 2011-01-02 16:15
16891_4-4.diff (1.92 KB) 16891_4-4.diff Administrator Admin, 2011-01-02 16:15
16891_trunk.diff (2.69 KB) 16891_trunk.diff Administrator Admin, 2011-01-02 16:15

Related issues 3 (0 open3 closed)

Related to TYPO3 Core - Bug #24140: Cross-Site Scripting in showpic functionalityClosedMarcus Krause2010-11-19

Actions
Related to TYPO3 Core - Bug #26893: BE Log is flooded with "Parameter Error: No file or no parameters given." from showpic.phpClosedChris topher2011-05-18

Actions
Related to TYPO3 Core - Bug #39052: Send sane HTTP response in showpic on errorClosed2012-07-18

Actions
Actions

Also available in: Atom PDF