TYPO3 Core

got excactly the same problem with 4.1.2

Seems to still occur with at least 4.1.5 (no newer release tested).

related to #0009182

This is STILL an issue in 4.2.6. When I set "doNotCheckReferer" in the install tool it seems to be a work around. This issue still needs to be fixed! Disabling referer is not a fix... it's a hack.

I'm suffering from that misbehaviour, too. TYPO3 4.3.3 and 4.2.10.

Same Problem over here too, with typo3 4.4.4

Yes, same Problem over here too, with TYPO3 4.4.4.

Does this also occur, when you redirect example2.com to example.com? Because of duplicate content, sites shouldn't be reachable under different domains. Wouldn't this be a better workaround?

However it really seems like there's a bug somewhere.. anybody willing to dig into the "external link" generation?

Same Problem with TYPO3 4.4.6.

I have found the reason and I have two possible solutions for the problem.
The reason is in typo3/sysext/cms/tslib/index_ts.php
// ************************
// Check JumpUrl
// ***********************
$TSFE->setExternalJumpUrl();
$TSFE->checkJumpUrlReferer();

After the setExternalJumpUrl, the referer will be controlled and if it fails, the function checkJumpUrlReferer deletes jumpurl.

1. Solution:
It is not useful to check the referers of the jumpurl. That is why delete the line:
$TSFE->checkJumpUrlReferer(); in typo3/sysext/cms/tslib/index_ts.php.
And the function checkJumpUrlReferer can also be deleted in typo3/sysext/cms/tslib/class.tslib_fe.php, because it is only used here.

2. Solution:
Add a new configuration variable to typo3, e.g: TYPO3_CONF_VARS['SYS']['checkJumpUrlReferer'], and use this variable in the function checkJumpUrlReferer in /cms/tslib/class.tslib_fe.php instead of TYPO3_CONF_VARS['SYS']['doNotCheckReferer']. And it would be useful to have default value of this variable as 0.

I would prefer the first solution.

Another solution:
If the check is done, do it correctly: Use the domain record.

Looking closer at the code, the same check is also done in checkDataSubmission for fe_tce and formmail. So this should check there, too.

Still an issue in 4.5.22 :)

Steffen Gebert wrote:

Does this also occur, when you redirect example2.com to example.com? Because of duplicate content, sites shouldn't be reachable under different domains. Wouldn't this be a better workaround?

I agree.

Tamer Erdogan wrote:

1. Solution:
It is not useful to check the referers of the jumpurl. That is why delete the line:
$TSFE->checkJumpUrlReferer(); in typo3/sysext/cms/tslib/index_ts.php.

I would not object this solution, since we have introduced a hash to secure the redirect for pages of type external URL.

And the function checkJumpUrlReferer can also be deleted in typo3/sysext/cms/tslib/class.tslib_fe.php, because it is only used here.

This cannot be done of course in released versions, but I would not object to delete this method in 6.1 without deprecation, but it would also not harm to have it empty and throw a deprecation message for 2 versions.

Anyone willing to push a patch to gerrit?

Problem still persists in TYPO3 6.1.7, workaround still: Set "doNotCheckReferer" = 1 in installation-tool.

Helmut Hummel wrote:

Steffen Gebert wrote:

Does this also occur, when you redirect example2.com to example.com? Because of duplicate content, sites shouldn't be reachable under different domains. Wouldn't this be a better workaround?

I agree.

I disagree! If a canonical url is set, there are no duplicate content problems. And there are many reasons for a multidomain setup.

But the bug does not need a multidomain setup. In my case i changed several doktypes to 3 (redirect) after a redesign. Now the problem are the previous indexed pages in google: all calls from google don't open the redirect url but an empty page (STATUS 200), cause an external referer is set.

Now I set doNotCheckReferer and the redirects work as suspected (302). But I am not sure, which side effects now exists.

+ edit +
TYPO3 6.18

Now I set doNotCheckReferer and the redirects work as suspected (302). But I am not sure, which side effects now exists.

Could anyone please comment on possible side effects if any?