Project

General

Profile

Actions

Bug #25359

closed

Essential form protection tokens are dropped when beeing logged in for a "long" time

Added by Helmut Hummel about 13 years ago. Updated almost 13 years ago.

Status:
Closed
Priority:
Should have
Assignee:
Category:
-
Target version:
Start date:
2011-03-20
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
4.5
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

Problem:
The backend form protection uses the session data field to store created tokens. Since this database field has a certain size, the framework starts dropping tokens, when it holds a certain amount of tokens.

When doing so, it is very likely that tokens which are seldom replaced (like the ExtDirect token or the clear cache tokens) will be dropped, resulting in token validation error messages

Solution:
I suggest to abandon the extra security feature of having unique tokens, because it turned out to add a complexity which is almost impossible to handle

(issue imported from #M17991)


Related issues 2 (0 open2 closed)

Related to TYPO3 Core - Bug #24671: Protect C(R)UD actions against CSRFClosedErnesto Baschny2011-01-20

Actions
Related to TYPO3 Core - Bug #25164: Copy & Paste: "Validating the security token of this form has failed. Please reload the form and submit it again."Closed2011-02-24

Actions
Actions #1

Updated by Helmut Hummel almost 13 years ago

  • Assignee set to Helmut Hummel
  • Target version deleted (0)
Actions #2

Updated by Mr. Hudson almost 13 years ago

Patch set 1 of change I784a1a6eef947a9030ffa8233c2a866818fd99c5 has been pushed to the review server.
It is available at http://review.typo3.org/1359

Actions #3

Updated by Mr. Hudson almost 13 years ago

Patch set 2 of change I784a1a6eef947a9030ffa8233c2a866818fd99c5 has been pushed to the review server.
It is available at http://review.typo3.org/1359

Actions #4

Updated by Mr. Hudson almost 13 years ago

Patch set 1 of change I078a6fa7f579026a33568fd0af114e5776c994da has been pushed to the review server.
It is available at http://review.typo3.org/1361

Actions #5

Updated by Mr. Hudson almost 13 years ago

Patch set 1 of change If37990fbc1ae3701777e8218cc1bc8760a4d6a55 has been pushed to the review server.
It is available at http://review.typo3.org/1364

Actions #6

Updated by Helmut Hummel almost 13 years ago

  • Target version set to 4.5.3
  • % Done changed from 0 to 100

Please ignore review request 1359, it was wrong and I abandoned it.

Actions #7

Updated by Mr. Hudson almost 13 years ago

Patch set 2 of change If37990fbc1ae3701777e8218cc1bc8760a4d6a55 has been pushed to the review server.
It is available at http://review.typo3.org/1364

Actions #8

Updated by Mr. Hudson almost 13 years ago

Patch set 2 of change I078a6fa7f579026a33568fd0af114e5776c994da has been pushed to the review server.
It is available at http://review.typo3.org/1361

Actions #9

Updated by Mr. Hudson almost 13 years ago

Patch set 3 of change If37990fbc1ae3701777e8218cc1bc8760a4d6a55 has been pushed to the review server.
It is available at http://review.typo3.org/1364

Actions #10

Updated by Mr. Hudson almost 13 years ago

Patch set 4 of change If37990fbc1ae3701777e8218cc1bc8760a4d6a55 has been pushed to the review server.
It is available at http://review.typo3.org/1364

Actions #11

Updated by Mr. Hudson almost 13 years ago

Patch set 3 of change I078a6fa7f579026a33568fd0af114e5776c994da has been pushed to the review server.
It is available at http://review.typo3.org/1361

Actions #12

Updated by Mr. Hudson almost 13 years ago

Patch set 4 of change I078a6fa7f579026a33568fd0af114e5776c994da has been pushed to the review server.
It is available at http://review.typo3.org/1361

Actions #13

Updated by Mr. Hudson almost 13 years ago

Patch set 5 of change If37990fbc1ae3701777e8218cc1bc8760a4d6a55 has been pushed to the review server.
It is available at http://review.typo3.org/1364

Actions #14

Updated by Mr. Hudson almost 13 years ago

Patch set 6 of change If37990fbc1ae3701777e8218cc1bc8760a4d6a55 has been pushed to the review server.
It is available at http://review.typo3.org/1364

Actions #15

Updated by Mr. Hudson almost 13 years ago

Patch set 7 of change If37990fbc1ae3701777e8218cc1bc8760a4d6a55 has been pushed to the review server.
It is available at http://review.typo3.org/1364

Actions #16

Updated by Mr. Hudson almost 13 years ago

Patch set 5 of change I078a6fa7f579026a33568fd0af114e5776c994da has been pushed to the review server.
It is available at http://review.typo3.org/1361

Actions #17

Updated by Anonymous almost 13 years ago

  • Status changed from New to Resolved
Actions #18

Updated by Oliver Hader almost 13 years ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF