Bug #48096

Wizard "Add" leave a blank page on save or close.

Added by Laurent Cherpit almost 7 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
-
Target version:
-
Start date:
2013-05-10
Due date:
% Done:

100%

TYPO3 Version:
6.2
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

if TCA column of a field type "select" contains configuration keys like "itemListStyle" or "selectedListStyle", the wizard "Add" leave a blank page after closing the edit form.

Associated revisions

Revision 22ed9499 (diff)
Added by Laurent Cherpit over 4 years ago

[BUGFIX] AddController: RemoveXSS on REQUEST_URI

sanitizeLocalUrl() fails to compare returnUrl value if the TCA column of a
field type "select" contains configuration keys like "itemListStyle" or
"selectedListStyle".
In "AddController", using RemoveXSS on request_uri before assigning the
returnUrl parameter, the comparaison of the params of returnUrl will
match on the backlink generation used to close the editForm.

If returnUrl contains string with "style" in it, it will be processed in
the same manner by sanitizeLocalUrl. So the backlink of the editForm
will not be dummy.php.

Change-Id: I5f3282766fe6cf9cae24f70d7f979ce4be004d5f
Resolves: #48096
Releases: master
Reviewed-on: http://review.typo3.org/20680
Reviewed-by: Benjamin Mack <>
Tested-by: Benjamin Mack <>
Reviewed-by: Anja Leichsenring <>
Tested-by: Anja Leichsenring <>

History

#1 Updated by Gerrit Code Review almost 7 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/20680

#2 Updated by Gerrit Code Review about 5 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/20680

#3 Updated by Gerrit Code Review over 4 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/20680

#4 Updated by Gerrit Code Review over 4 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/20680

#5 Updated by Laurent Cherpit over 4 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#6 Updated by Benni Mack over 1 year ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF