Bug #100456
closed
Don't report AdminPanel usages to CSP
Added by Daniel Siepmann over 1 year ago. Updated 5 months ago.
100%
Description
I guess this relates to the usage of symfony var dumper for "Events" tab within "Debug" panel.
Steps to reproduce:
- Enable CSP feature toggle for frontend
- Install Admin Panel
- Enable Admin Panel for User in Frontend
- Open Admin Panel (It won't do anything without being opened / toggled)
- Open CSP Backend Module, it should have three entries
Files
| clipboard-202304050939-k2gei.png (74 KB) clipboard-202304050939-k2gei.png | Daniel Siepmann, 2023-04-05 07:39 | ||
| 100456-fine.png (837 KB) 100456-fine.png | Oliver Hader, 2023-05-19 06:15 |
Updated by Daniel Siepmann over 1 year ago
- Related to Feature #99499: Introduce Content Security Policy handling added
Updated by Oliver Hader over 1 year ago
- Status changed from New to Needs Feedback
window.Sfdump does not seem to be a TYPO3 core component (I could not find it in the sources).
Could you please find out, where this is coming from?
Updated by Gerrit Code Review over 1 year ago
- Status changed from Needs Feedback to Under Review
Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Oliver Hader over 1 year ago
I've create a PoC change - which does not work, since Symfony is using inline scripts like innerHTML = whatever, which needs to be fixed first (on Symfony's side).
e.g. https://github.com/symfony/var-dumper/blob/6.2/Dumper/HtmlDumper.php#L160
Updated by Gerrit Code Review over 1 year ago
Patch set 2 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Gerrit Code Review over 1 year ago
Patch set 3 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Oliver Hader over 1 year ago
Updated by Gerrit Code Review over 1 year ago
Patch set 4 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Gerrit Code Review over 1 year ago
Patch set 5 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Oliver Hader over 1 year ago
- File 100456-fine.png 100456-fine.png added
This should be working now, the upcoming release of symfony/var-dumper v6.3 includes this change.
Updated by Gerrit Code Review over 1 year ago
Patch set 6 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Gerrit Code Review over 1 year ago
Patch set 7 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Gerrit Code Review over 1 year ago
Patch set 8 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Gerrit Code Review over 1 year ago
Patch set 9 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Gerrit Code Review over 1 year ago
Patch set 10 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Gerrit Code Review over 1 year ago
Patch set 11 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Gerrit Code Review over 1 year ago
Patch set 1 for branch 12.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/79204
Updated by Gerrit Code Review over 1 year ago
Patch set 12 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/78512
Updated by Gerrit Code Review over 1 year ago
Patch set 2 for branch 12.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/79204
Updated by Oliver Hader over 1 year ago
- Status changed from Under Review to Resolved
- % Done changed from 0 to 100
Applied in changeset df0ca22d5096e440419eb37c19101ab2c57a2d36.
Updated by Oliver Hader over 1 year ago
- Has duplicate Bug #101169: Admin panel does not allow usage of "nonce" added
Updated by