TYPO3 Core

Since the last security patch, when starting a console command from the cli, which in some way uses the new getNormalizedParams() method in AbstractUserAuthentication we get the following error:

Uncaught TYPO3 Exception rtrim() expects parameter 1 to be string, boolean given
thrown in file typo3/sysext/core/Classes/Http/NormalizedParams.php
in line 790

The problem seems to be either, that in "determineSiteUrl()" the $requestDir param ist filled with "http://localhost/" because of the line:
"$serverParams = Environment::isCli() ? ['HTTP_HOST' => 'localhost'] : $_SERVER;"
or that "TYPO3_PATH_WEB" is not defined, when it should be.

If we add another condition in determineSiteUrl(), something like:

if ($siteUrl === false && Environment::isCli() && strpos($requestDir, 'localhost') !== false) {
        $siteUrl = $requestDir;
    }

the bug seems to be fixed.

This bug seems to be present in v9/10 haven't checked for v8, v11 or v12.