Feature #47982
closed
INCLUDE_TYPOSCRIPT does not support real relative paths & constants
0%
Description
The "INCLUDE_TYPOSCRIPT"-Tag to include external TypoScript does not seem to support "real" relative paths.
Example:
Works:
<INCLUDE_TYPOSCRIPT: source="FILE:fileadmin/templates/base/mySetup.txt">
While this condition (inside of mySetup.txt) does not work:
# [ Inside mySetup.txt] <INCLUDE_TYPOSCRIPT: source="FILE:../anotherSetup.txt">
I would have expected that TYPO3 resolves the relative path given by "FILE:../" to the upper directory of "mySetup.txt". But it doesn't.
In some cases this would be very flexible and handy.
Updated by Markus Klein over 11 years ago
- Category set to TypoScript
These are two separate features.
Please file a separate ticket.
Updated by Gabriel Kaufmann / Typoworx NewMedia over 11 years ago
Please update this ticket to work on the primary feature only. I will submit a related ticket for the second one.
UPDATE:
New ticket for second feature-request for adding TS-Constant resolving: #47985
Updated by Chris topher over 11 years ago
Gabriel Kaufmann / Typoworx NewMedia wrote:
Please update this ticket(...)
Done.
Updated by Thorsten Kahler over 11 years ago
- Status changed from New to Needs Feedback
- Assignee set to Gabriel Kaufmann / Typoworx NewMedia
Gabriel Kaufmann / Typoworx NewMedia wrote:
The "INCLUDE_TYPOSCRIPT"-Tag to include external TypoScript does not seem to support "real" relative paths.
[...]
I would have expected that TYPO3 resolves the relative path given by "FILE:../" to the upper directory of "mySetup.txt". But it doesn't.
The documentation at http://docs.typo3.org/typo3cms/TyposcriptSyntaxReference/Syntax/Includes/Index.html explicitly mentions that double periods .. are not allowed. Most probable reason is to avoid any attack vector for path traversal.
Updated by Gabriel Kaufmann / Typoworx NewMedia over 11 years ago
Thorsten Kahler wrote:
The documentation at http://docs.typo3.org/typo3cms/TyposcriptSyntaxReference/Syntax/Includes/Index.html explicitly mentions that double periods
..are not allowed. Most probable reason is to avoid any attack vector for path traversal.
Thanks for the hint.
Well at first this make sense. On the other hand I don't think this is a real problem as TYPO3 does have funtions to translate those paths. In simplest case one could do this by realpath in combination with a string-compare against the DOC-ROOT Path for the Web.
So I agree this "could" be a security reason, but only if there are no preventive measures avoiding those issues.
Updated by Jigal van Hemert about 11 years ago
You want relative paths, but they should also be a subdirectory of the site directory. This can only end up with constructions like:
FILE:../htdocs/fileadmin/templates/../templates/../../fileadmin/templates/my_own.ts
Can you explain a use-case for this?
Updated by Gabriel Kaufmann / Typoworx NewMedia about 11 years ago
Jigal van Hemert wrote:
You want relative paths, but they should also be a subdirectory of the site directory. This can only end up with constructions like:
FILE:../htdocs/fileadmin/templates/../templates/../../fileadmin/templates/my_own.tsCan you explain a use-case for this?
Yes. If you have INCLUDES in external TS-FILES. Of course the relative path should then rely on the base-path of the current file the sub-include is taking place.
Updated by Stefan Neufeind about 11 years ago
Please note that #52018 is merged in master (soon to be 6.2 beta 1) now. I guess that solves your request for relative includes?
Updated by Gabriel Kaufmann / Typoworx NewMedia about 11 years ago
Stefan Neufeind wrote:
Please note that #52018 is merged in master (soon to be 6.2 beta 1) now. I guess that solves your request for relative includes?
Sounds great. Thanks for keeping me up-to-date on that. I'll give it a try soon. The 52018 patch is only available from TYPO3 6.2 or is it already in latest 6.1?
Updated by Philipp Gampe about 11 years ago
- Status changed from Needs Feedback to Resolved
Applied in changeset 0f607c857bd4535c6fffc4d7b1e76014b24f0751.
Updated by Stefan Neufeind about 11 years ago
Only in 6.2 beta 1 (soon to be released) I'm afraid since it's a new "feature".
If you need it urgently for older releases as well, I guess the patch from gerrit should easily apply on your 6.1.x as well.
Updated by