Feature #47982
closed
INCLUDE_TYPOSCRIPT does not support real relative paths & constants
Added by Gabriel Kaufmann / Typoworx NewMedia about 11 years ago.
Updated almost 6 years ago.
Description
The "INCLUDE_TYPOSCRIPT"-Tag to include external TypoScript does not seem to support "real" relative paths.
Example:
Works:
<INCLUDE_TYPOSCRIPT: source="FILE:fileadmin/templates/base/mySetup.txt">
While this condition (inside of mySetup.txt) does not work:
# [ Inside mySetup.txt]
<INCLUDE_TYPOSCRIPT: source="FILE:../anotherSetup.txt">
I would have expected that TYPO3 resolves the relative path given by "FILE:../" to the upper directory of "mySetup.txt". But it doesn't.
In some cases this would be very flexible and handy.
- Category set to TypoScript
These are two separate features.
Please file a separate ticket.
Please update this ticket to work on the primary feature only. I will submit a related ticket for the second one.
UPDATE:
New ticket for second feature-request for adding TS-Constant resolving: #47985
Gabriel Kaufmann / Typoworx NewMedia wrote:
Please update this ticket(...)
Done.
- Status changed from New to Needs Feedback
- Assignee set to Gabriel Kaufmann / Typoworx NewMedia
Gabriel Kaufmann / Typoworx NewMedia wrote:
The "INCLUDE_TYPOSCRIPT"-Tag to include external TypoScript does not seem to support "real" relative paths.
[...]
I would have expected that TYPO3 resolves the relative path given by "FILE:../" to the upper directory of "mySetup.txt". But it doesn't.
The documentation at http://docs.typo3.org/typo3cms/TyposcriptSyntaxReference/Syntax/Includes/Index.html explicitly mentions that double periods .. are not allowed. Most probable reason is to avoid any attack vector for path traversal.
Thorsten Kahler wrote:
The documentation at http://docs.typo3.org/typo3cms/TyposcriptSyntaxReference/Syntax/Includes/Index.html explicitly mentions that double periods .. are not allowed. Most probable reason is to avoid any attack vector for path traversal.
Thanks for the hint.
Well at first this make sense. On the other hand I don't think this is a real problem as TYPO3 does have funtions to translate those paths. In simplest case one could do this by realpath in combination with a string-compare against the DOC-ROOT Path for the Web.
So I agree this "could" be a security reason, but only if there are no preventive measures avoiding those issues.
You want relative paths, but they should also be a subdirectory of the site directory. This can only end up with constructions like:
FILE:../htdocs/fileadmin/templates/../templates/../../fileadmin/templates/my_own.ts
Can you explain a use-case for this?
Jigal van Hemert wrote:
You want relative paths, but they should also be a subdirectory of the site directory. This can only end up with constructions like:
FILE:../htdocs/fileadmin/templates/../templates/../../fileadmin/templates/my_own.ts
Can you explain a use-case for this?
Yes. If you have INCLUDES in external TS-FILES. Of course the relative path should then rely on the base-path of the current file the sub-include is taking place.
Please note that #52018 is merged in master (soon to be 6.2 beta 1) now. I guess that solves your request for relative includes?
Stefan Neufeind wrote:
Please note that #52018 is merged in master (soon to be 6.2 beta 1) now. I guess that solves your request for relative includes?
Sounds great. Thanks for keeping me up-to-date on that. I'll give it a try soon. The 52018 patch is only available from TYPO3 6.2 or is it already in latest 6.1?
- Status changed from Needs Feedback to Resolved
Only in 6.2 beta 1 (soon to be released) I'm afraid since it's a new "feature".
If you need it urgently for older releases as well, I guess the patch from gerrit should easily apply on your 6.1.x as well.
- Status changed from Resolved to Closed
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by