TYPO3 Core

Confirmed This is related to the recently DataHandler permission check
streamlining #106382.

For the filelist / list localization issue, there is no page record to retrieve as files/file metadata records always have pid = 0 and there is no record to retrieve for this.

In case of sys_file / sys_file_metadata which are always resides in pid = 0 no page record is retrieved (empty array) and passed down to the permission check methods which honors empty array with missing uid exception. Before that change there was a check to mitigate this when no page record has been determined.

First impression is, that we need to add an empty array check before calling the BE user permission check, but needs some addition look into it.

Maybe we need to take non-page record permission checks in account (be user workspace / live record edit things) .. not sure.

Place: https://review.typo3.org/c/Packages/TYPO3.CMS/+/88445/55/typo3/sysext/core/Classes/DataHandling/DataHandler.php#4755

        if (!$this->hasPagePermission(Permission::PAGE_SHOW, $pageRecord)) {
            $this->log($table, $uid, SystemLogDatabaseAction::LOCALIZE, null, SystemLogErrorClassification::USER_ERROR, 'Attempt to localize record {table}:{uid} without permission', null, ['table' => $table, 'uid' => (int)$uid]);
            return false;
        }

or

https://review.typo3.org/c/Packages/TYPO3.CMS/+/88445/55/typo3/sysext/core/Classes/DataHandling/DataHandler.php#7348

        $pagesSchema = $this->tcaSchemaFactory->get('pages');
        if (!$pagesSchema->hasCapability(TcaSchemaCapability::RestrictionWebMount) && !$this->BE_USER->isInWebMount($page)) {
            return false;
        }

Thanks for reporting. Can confirm this issue with TYPO3 13.4.
Older projects with 12 and 11 do not have this problem.

Do we need an allowlist for tables on pid 0?

André Buchmann wrote in #note-4:

Do we need an allowlist for tables on pid 0?

No, basically there is a TCA option for this. The point is, that due to the
permission check streamlining the option is not verified first and a empty
array passed to the BE user isInWebmount() method which throws a expection
when no `uid` is passed.

Thanks for reporting. Can confirm this issue with TYPO3 13.4.
Older projects with 12 and 11 do not have this problem.

Yeah, as already mentioned in https://forge.typo3.org/issues/106569#note-2
this is a regression/error introduced with the streamlining onf these checks,
which has only been backported to TYPO3 v13.4.

Patch set 2 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/89172

Patch set 3 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/89172

Patch set 1 for branch 13.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/89225