Project

General

Profile

Actions
Copy link

Bug #103377

open

Extbase Backend Module Exception if page with UID same as sys_file_storage does not exist

Added by Oliver Eglseder 8 months ago. Updated 8 months ago.

Status:
New
Priority:
Should have
Assignee:
-
Category:
Extbase
Target version:
next-patchlevel
Start date:
2024-03-12
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
12
PHP Version:
7.2
Tags:
Extbase, Exception, File Module, Filelist, navigation component
Complexity:
Is Regression:
Sprint Focus:

Description

So here's the catch:

I've got an Extbase Module, simple Controller, etc. which uses the same navigation component as the File List Module.
When i select a folder in the navigation component, the id parameter is set to a combined identifier, like "1:/user_upload".

So far, so good. The problem arises, when the Extbase RequestBuilder tries to determine if a feature is enabled, which loads the ConfigurationManager, which tries to get the TypoScript, which tries to load the RootLine, which uses the id param as page id. The value is cast to an int, which leads to the UID of the sys_file_strorage to be interpreted as a page UID, which is clearly wrong. This does not throw an exception as long as the page with the UID 1 exists.

It happened to a customer, that they have a sys_file_storage with a UID which does not exist in pages, which makes the bug visible.
See the Exception trace attached.

This problem dates back AT LEAST until TYPO3 v9, but probably exists since v6.2

Files

TYPO3 Exception.html (80.6 KB) TYPO3 Exception.html Oliver Eglseder, 2024-03-12 11:18
Actions
Copy link
 #1

Updated by Stefan Bürk 8 months ago

TYPO3 v9 is no longer supported by the community so there will be no-one doing work
for that version. And even if, it will not get merged anyway.

Beside that, don't do the same as the filelist module which is a missbehaviour (and not
the only one in that old version).

The core relaxed that and uses dedicated parameters for such things, not checked for the
filelist module in current main.

However, or your custom module - don't to that. let the id be the selected page. Use another navigation aproach than.

Actions
Copy link
 #2

Updated by Oliver Eglseder 8 months ago

  • TYPO3 Version changed from 9 to 12

Please read the issue before discarding it. The problem exists at least since TYPO3 v9. It is still present.

But i've changed the version field to prevent further misunderstandings.

Actions
Copy link
 #3

Updated by Christian Kuhn 8 months ago · Edited

Yay. Loading FE TS in extbase BE modules still haunts us!

BackendConfigurationManager:

    protected function getCurrentPageIdFromRequest(): int
    {
        return (int)($this->request?->getParsedBody()['id'] ?? $this->request?->getQueryParams()['id'] ?? 0);
    }

I guess we should use 'GU::canBeInterpretedAsInteger()' here. Would you like to play around with this?

Background: extbase assumes GET 'id' is the page id in BE in all cases. It's not. filelist for instance uses 'id' for the storage identifier ... We also don't want to force this as a convention in core, so extbase has to sanitize better, here, and it will always still be guesswork.

True solution: Get rid of FE TS to configure extbase BE modules ... it tried a while ago, but got blocks by others. It still has to fall at some point.

Actions
Copy link

Also available in: Atom PDF