Project

General

Profile

Actions

Bug #102203

closed

Password recovery url in mail has wrong extension prefix

Added by Moritz Noll 9 months ago. Updated 8 days ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
felogin
Target version:
-
Start date:
2023-10-19
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
11
PHP Version:
7.4
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

When I use the password recovery function I get a wrong extension prefix in url.

/forgot-password?ai[action]=showChangePassword&ai[controller]=PasswordRecovery&ai[hash]=1234567890|712f6c5129ccf8670531bafe33ea0d473bfb119b&cHash=4683b48e47168beec8039c3c36e33bf9

Instead of.

/forgot-password?tx_felogin_login[action]=showChangePassword&tx_felogin_login[controller]=PasswordRecovery&tx_felogin_login[hash]=1234567890|712f6c5129ccf8670531bafe33ea0d473bfb119b&cHash=4683b48e47168beec8039c3c36e33bf9

I think that comes from a third party extension that also uses the "UriBuilder" on that site and set the "argumentPrefix" before.
The problem is that you make here no reset on the UriBuilder instance like you explain in documentation (https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ExtensionArchitecture/Extbase/Reference/UriBuilder.html).
https://forge.typo3.org/projects/typo3cms-core/repository/1749/entry/typo3/sysext/felogin/Classes/Service/RecoveryService.php?utf8=%E2%9C%93&rev=v11.5.32#L141

Actions #1

Updated by Garvin Hicking 9 months ago

Hi Moritz,

that's interesting, thanks for reporting!

Sadly I couldn't reproduce this with either TYPO3v11-v13 on my instance. I just added a dummy controller and placed this:

        $this->view->assign('link', $this->uriBuilder
            ->reset()
            ->setTargetPageUid(189)
            ->setArgumentPrefix('mymymy')
            ->uriFor(
                'anotherAction',
                [
                    'myRecord' => 21,
                ],
                'DummyController',
                'my_ext',
                'my_ext'
            )
        );

inside a Plugin that was placed before the fe-login form. This did not affect the printed link from fe-login and not the mail contained in the E-Mail. (Yes, I cleared the cache ;))

Two things you could maybe check:

1. How exactly does the 3rd Party extension access the UriBuilder? Is it within a Controller? Or something like a PSR14-event, middleware or dataProcessor or something else?
2. What exactly is the setup of your plugins with fe-login on a page? Does placing the third party plugin (if possible) after the login form prevent the error?
3. To see if your suggestion works, did you patch the file you mentioned and just add a ->reset() in front of it:

        $url = $this->uriBuilder->reset()->setCreateAbsoluteUri(true)
            ->uriFor(
                'showChangePassword',
                ['hash' => $hash],
                'PasswordRecovery',
                'felogin',
                'Login'
            )

It probably won't hurt to add reset() to the core, but actually the uriBuilder instances should to my understanding not be shared across Controller instances, so I'd love to first be able to reproduce the issue.

Actions #2

Updated by Moritz Noll 9 months ago

Hi Garvin,

I was able to reproduce this error by creating a dummy controller and place it before the fe-login like you.
Then I set the argument prefix in the initializeAction (like the 3rd party tool does).

protected function initializeAction()
{
   $this->uriBuilder->setArgumentPrefix('xyz');
}

Now the prefixes of the password recovery URL are 'xyz'.
If I place the CE after fe-login the prefixes are correct 'tx_felogin_login'.

Actions #3

Updated by Garvin Hicking 9 months ago

Hi Moritz,

thanks for getting back.

Sadly I still wasn't able to reproduce this. I did work it in via initializeAction like you posted.

If I edit the /typo3/sysext/felogin/Classes/Service/RecoveryService.php file and add a \TYPO3\CMS\Extbase\Utility\DebuggerUtility::var_dump($this->uriBuilder, 'URI Builder Instance Login', 8, true, false); just inside the method prepareMail, it also just prints a uriBuilder server with attribute argumentPrefix = '' (and not the prefix set in the other extension).

I tried both with my custom dummycontroller being cached and nocached. (tried this mostly in a v11 environment)

Anyhow, now I did dig some deeper into the code. The Services.yaml file of typo3/sysext/extbase/Configuration/Services.yaml defines the uriBuilder instance as shared: false. So uriBuilder is not passed as a singleton shared instance, but each controller instance should get an independant instance of a uriBuilder.

So I wonder if maybe something could be interfering with "proper" Dependency Injection on your installation; would you be able to try to reproduce the issue in a vanilla TYPO3 environment with as few extensions as possible (you'd need either a simple sitepackage or the boostrap-package to be able to see a frontend of course). Do you use composer mode? Any specific caching setup?

Sorry for the wall of text, but I'd really like to reproduce and understand the issue before adding a reset() at this point, even though that will be the "easy mode" solution for this :D

Actions #4

Updated by Moritz Noll 9 months ago

After long research I can reproduce it in a fresh Typo3 Environment.
Another extension is the problem 'vhs'.
When it is installed the problem occurs with the wrong prefix.
But I don't know where the bug in this extension occurs yet.

Actions #5

Updated by Garvin Hicking 9 months ago

Hi Moritz!

Are you able to describe how I can setup a fresh environment to reproduce this? Ideally could you put a GIT repository with it (or a dump, or whatever) online and so I can check it with your steps?

vhs does some XClassing I believe, that could be a factor... do I understand you right, it only happens with VHS and not without?

Regards,
Garvin

Actions #6

Updated by Moritz Noll 9 months ago

Hi Garvin!

Yes, here is a link with my fresh Typo3 environment https://file.tedsoft.de/f/eca54694e22b4b309c19/
You need Docker and Visual Studio Code for this.
In Visual Studio Code you need the Dev Container extension (ms-vscode-remote.remote-containers).
Then open the workspace file with Visual Studio Code and click on the green area with the two arrows on the bottom left.
In the menu that pops up click "reopen in container".
When it's finished open your browser on "localhost:8080/typo3".
Now configure an SMTP mail service in the settings section (there comes the install dialog at the first time - click straight to backend) and give the user in the users folder your e-mail.
Open "localhost:8080" and recover your password.
The prefixes in mails URL are ai then.
Disable "vhs" and recover your password again.
Now the prefixes are right.
If you still need help, feel free to ask.

Greetings,
Moritz

Actions #7

Updated by Garvin Hicking 9 months ago

Hhhhm. My guess is that because vhs registers its own fluid caching and middlewares, those could be directly impacting the outcome of this.

To make a long story short; to aid an extension with this operation, I don't think adding ->reset() will do too much harm. I'll create a patch and ask for review. Thanks for staying with me. :-)

Actions #8

Updated by Gerrit Code Review 9 months ago

  • Status changed from New to Under Review

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/81578

Actions #9

Updated by Gerrit Code Review 9 months ago

Patch set 2 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/81578

Actions #10

Updated by Gerrit Code Review 9 months ago

Patch set 3 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/81578

Actions #11

Updated by Gerrit Code Review 9 months ago

Patch set 1 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/81589

Actions #12

Updated by Gerrit Code Review 9 months ago

Patch set 2 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/81589

Actions #13

Updated by Gerrit Code Review 9 months ago

Patch set 4 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/81578

Actions #14

Updated by Gerrit Code Review 9 months ago

Patch set 1 for branch 12.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/81560

Actions #15

Updated by Garvin Hicking 9 months ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions #16

Updated by Benni Mack 8 days ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF