Bug #35720

Access denied Exception for widget links to actions with a policy

Added by Johannes K over 7 years ago. Updated about 7 years ago.

Status:
New
Priority:
Must have
Assignee:
-
Category:
Security
Target version:
-
Start date:
2012-04-05
Due date:
% Done:

0%

PHP Version:
Has patch:
No
Complexity:

Description

In TYPO3\FLOW3\Security\Aspect\CsrfProtectionAspect::addCsrfTokenToUri() the detection for the target classname fails, if a link is generated via <f:link.widget />, so the link is missing the __csrfToken and you get an AccessDeniedException:

#1216919280: You are not allowed to perform this action. (More information)

TYPO3\FLOW3\Security\Exception\AccessDeniedException thrown in file
.../Data/Temporary/Development/Cache/Code/FLOW3_Object_Classes/TYPO3_FLOW3_Security_Authorization_Interceptor_AccessDeny_Original.php in line 30.

Example to reproduce:
Use the paginate widget for an action with a policy


Related issues

Duplicates TYPO3.Flow - Bug #27798: CSRF protection not working for forms in a plugin Accepted 2011-07-01

History

#1 Updated by Johannes K over 7 years ago

The problem is that the CsrfProtectionAspect is woven into UriBuilder::build() (via "method(TYPO3\FLOW3\MVC\Web\Routing\UriBuilder->build()"), but the arguments to determine the target Controller/Action are not yet merged into $arguments, so the CsrfProtectionAspect has no way to check the action.

Possible solution: Use the following code and weave the CsrfProtectionAspect into UriBuilder::doBuild(), but maybe you guys have a better solution ;)

 

class UriBuilder {
...
    /**
     * Builds the URI
     *
     * @param array $arguments optional URI arguments. Will be merged with $this->arguments with precedence to $arguments
     * @return string The URI
     * @api
     */
    public function build(array $arguments = array()) {
        $arguments = \TYPO3\FLOW3\Utility\Arrays::arrayMergeRecursiveOverrule($this->arguments, $arguments);
        $this->mergeArgumentsWithRequestArguments($arguments);

        $this->doBuild($arguments);
      }

        protected function doBuild(array $arguments = array()) {
        // rest of the build function
        }
...
}

Also available in: Atom PDF