TYPO3 Core

Jochen Weiland wrote:

Error message: Fatal error: Uncaught exception 'TYPO3\CMS\Core\Resource\Exception\InsufficientFolderAccessPermissionsException' with message 'You are not allowed to access the given folder'

When exactly does this happen? I assume somewhere in the backend?

Helmut Hummel wrote:

When exactly does this happen? I assume somewhere in the backend?

BE and FE: it happens in the backend when clicking on the "Admin->Language" menu entry as well as in the frontend after deleting the typo3temp/_processed_ folder (make sure that FE is not cached)

Ah ok. I can now confirm it for "Admin->Language".

Uncaught TYPO3 Exception
#1375955684: You are not allowed to access the given folder (More information)

TYPO3\CMS\Core\Resource\Exception\InsufficientFolderAccessPermissionsException thrown in file
/fooo/typo3_src/TYPO3.CMS/typo3/sysext/core/Classes/Resource/ResourceStorage.php in line 730.

71 TYPO3\CMS\Core\Resource\ResourceStorage::assureFolderReadPermission(TYPO3\CMS\Core\Resource\Folder)

/fooo/typo3_src/TYPO3.CMS/typo3/sysext/core/Classes/Resource/ResourceStorage.php:
01805:   */
01806:  public function hasFolderInFolder($folderName, Folder $folder) {
01807:   $this->assureFolderReadPermission($folder);
01808:   return $this->driver->folderExistsInFolder($folderName, $folder);
01809:  }

70 TYPO3\CMS\Core\Resource\ResourceStorage::hasFolderInFolder("typo3temp", TYPO3\CMS\Core\Resource\Folder)

/fooo/typo3_src/TYPO3.CMS/typo3/sysext/core/Classes/Resource/Folder.php:
00237:   */
00238:  public function getSubfolder($name) {
00239:   if (!$this->storage->hasFolderInFolder($name, $this)) {
00240:    throw new \InvalidArgumentException('Folder "' . $name . '" does not exist in "' . $this->identifier . '"', 1329836110);
00241:   }

69 TYPO3\CMS\Core\Resource\Folder::getSubfolder("typo3temp")

/fooo/typo3_src/TYPO3.CMS/typo3/sysext/core/Classes/Resource/ResourceStorage.php:
02237:       $parentFolder = $this->driver->createFolder($folderPart, $parentFolder);
02238:      } else {
02239:       $parentFolder = $parentFolder->getSubfolder($folderPart);
02240:      }
02241:     }

68 TYPO3\CMS\Core\Resource\ResourceStorage::getProcessingFolder()

/fooo/typo3_src/TYPO3.CMS/typo3/sysext/core/Classes/Resource/Service/FileProcessingService.php:
00119:   */
00120:  protected function process(Resource\ProcessedFile $processedFile, Resource\ResourceStorage $targetStorage) {
00121:   $targetFolder = $targetStorage->getProcessingFolder();
00122:   if (!is_object($targetFolder)) {
00123:    throw new \RuntimeException('Could not get processing folder for storage ' . $this->storage->getName(), 1350514301);

67 TYPO3\CMS\Core\Resource\Service\FileProcessingService::process(TYPO3\CMS\Core\Resource\ProcessedFile, TYPO3\CMS\Core\Resource\ResourceStorage)

/fooo/typo3_src/TYPO3.CMS/typo3/sysext/core/Classes/Resource/Service/FileProcessingService.php:
00101:   // or (in case of preview images) already in the DB/in the processing folder
00102:   if (!$processedFile->isProcessed()) {
00103:    $this->process($processedFile, $targetStorage);
00104:   }
00105: 

66 TYPO3\CMS\Core\Resource\Service\FileProcessingService::processFile(TYPO3\CMS\Core\Resource\File, TYPO3\CMS\Core\Resource\ResourceStorage, "Image.CropScaleMask", array)

/fooo/typo3_src/TYPO3.CMS/typo3/sysext/core/Classes/Resource/ResourceStorage.php:
01130:    throw new \InvalidArgumentException('Cannot process files of foreign storage', 1353401835);
01131:   }
01132:   $processedFile = $this->getFileProcessingService()->processFile($fileObject, $this, $context, $configuration);
01133: 
01134:   return $processedFile;

...

To see the error in the FE you obviously need an image in the site that needs "processing" (so that the typo3temp/_processed_ folder is required)

Could you please change line 130 & 132 to TRUE in typo3/sysext/core/Classes/Resource/ResourceFactory.php

...
                    'is_browsable' => TRUE,
                    'is_public' => TRUE,
                    'is_writable' => TRUE
...

Does it work then? DO NOT DO THIS ON YOUR PRODUCTION MACHINE! Just for debugging!

Hi Sascha:

yes, changing the two lines seems to fix the problem

Ok I've added a page to gerrit. I'm not really sure why it has been changed to FALSE.
@Helmut Hummel is it ok to change it back to TRUE?

Jochen Weiland wrote:

After upgrading to TYPO3 versions 6.0.9 or 6.1.4 a fatal error will be generated after clearing the typo3temp directory (specifically the typo3temp/_processed_ subdirectory).

Issue seems to be somewhere in typo3/sysext/core/Classes/Resource/ResourceStorage.php

What I have found out so far: if the subdirectory typo3temp/_processed_ does not exist, it won't be auto-created. If you manually create the directory the exception is not thrown.

Ah, OK this only happens if the typo3temp/_processed_ folder does not exist at all.

Workaround is to make sure it there.

Working on a fix now.

Sascha Egerer wrote:

@Helmut Hummel is it ok to change it back to TRUE?

No, this is not OK. This is one of the main points of the security fixes that storage 0 is neither writable nor browsable.

HI, I also got a problem after updating from 6.1.3 which might be similar.

When I am logged in as a non-admin backend User. The access to some folders are somehow restricted. I could not really figure out why. Here the three main examples:
1. I have several sys-folders for tx_news. In two folders I can list the news, but not open them. I get the message "You are not allowed to access the given folder". In other folders everything is all right.
2. When I try to insert an image via RTE I can list the Images but not select an image: You are not allowed to access the given folder
3. When I go to the module file list, I forst get the error "You are not allowed to access the given folder" but alfter loading the folder tree, I can open all folders (including the one folder I could not access with 6.1.3)

As far as I have seen the admin can do all this.

I have no problem with the language module or with typo3temp/_processed_

Any idea?

Thanks Jürgen

Patch set 1 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23633

Patch set 2 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23633

Hi, I tried all 3 patches for my problem. Unfortunately it did not work. I deleted all typo3temp again, cleared all caches. The only change was, that I also got the problems with the admin user, but slightly different. When opening a news as an admin I got no error message but an blank grey screen.

and I found one news in the folder with the error messages, which I could open without problems (as admin and editor...)???

Jürgen König wrote:

Hi, I tried all 3 patches for my problem. Unfortunately it did not work.

Replace only the changes from "public function getProcessingFolder() {...}". There are other changes in ResourceStorage.php which breaks the installation if you replace the whole file and no other files.

Hint: If you still get a blank page, activate debugging in typo3conf/AdditionalConfiguration.php: $GLOBALS['TYPO3_CONF_VARS']['SYS']['displayErrors'] = '1';

Thanks for the hint. When I replace only the changes from "public function getProcessingFolder() {...}" it works again for the admin user, but there is no change for the editor.

I had the same issue after upgrading to 6.1.4 and deleting all files and folders in typo3temp/.

A page with a tx_news plugin threw the exception.

Creating typo3temp/_processed_ manually fixed it.

PS: the debug report ist including patch 3 as described above

Patch 3 is working for me.

We are having the same problems with both TYPO 6.0.9 and TYPO 6.1.4.

I have applied patch 3 but the problem still exists.

We get the following error for every editor that tries to alter a page or that tries to list the content of a sysfolder.

Core: Exception handler (WEB): Uncaught TYPO3 Exception: #1375955684: You are not allowed to access the given folder | TYPO3\CMS\Core\Resource\Exception\InsufficientFolderAccessPermissionsException thrown in file /websites/XYZ/typo3_src-6.0.9/typo3/sysext/core/Classes/Resource/ResourceStorage.php in line 730. Requested URL: http://XYZ/typo3conf/ext/templavoila/mod1/index.php?id=2

Core: Exception handler (WEB): Uncaught TYPO3 Exception: #1375955684: You are not allowed to access the given folder | TYPO3\CMS\Core\Resource\Exception\InsufficientFolderAccessPermissionsException thrown in file /websites/XYZ/typo3_src-6.0.9/typo3/sysext/core/Classes/Resource/ResourceStorage.php in line 730. Requested URL: http://XYZ/typo3/mod.php?M=web_list&id=5

Dominik Hahn wrote:

We are having the same problems with both TYPO 6.0.9 and TYPO 6.1.4.

I have applied patch 3 but the problem still exists.

Can you post a full backtrace of the exception here?

We get the following error for every editor that tries to alter a page

Access a page with the templavoila page module? Or editing page properties?

or that tries to list the content of a sysfolder.

What records are inside the sysfolder?

After upgrading from 6.0.4 to 6.1.4 I get the same error message that Sascha Egerer posted (Uncaught TYPO3 Exception #1375955684 ...) when I try to insert an image using the RTE (being logged in the backend as admin).

The only workaround that seems to solve this is the patch for ResourceFactory.php posted here: https://review.typo3.org/#/c/23625/1 .

But this patch is abandoned already ... I guess I've to go back to 6.0.4.

-Andrea

Update:

The ResourceFactory.php and the ResourceStorage.php patches don't resolve all issues for me:
- Editors still get the TYPO3 Exception #1375955684 when trying to add an image.
- The Install tool/Upgrade wizard now offers a "Migrate all RTE magic images from uploads/RTEmagicC_* to fileadmin/_migrated/RTE/". But when I do so I get a Fatal Error:
"Fatal error: Call to a member function isAdmin() on a non-object in [...]/typo3/sysext/core/Classes/Resource/Security/StoragePermissionsAspect.php on line 76"

Patch set 4 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23633

Andrea Böhm wrote:

After upgrading from 6.0.4 to 6.1.4 I get the same error message that Sascha Egerer posted (Uncaught TYPO3 Exception #1375955684 ...) when I try to insert an image using the RTE (being logged in the backend as admin).

Can you please also post a full backtrace of the exception here? I cannot reproduce this as admin.

Dominik Hahn wrote:

A full backtrace of both modules is attached.

Thanks. Can you please try patch set 4. Should solve this problem.

Andrea Böhm wrote:

Update:

The ResourceFactory.php and the ResourceStorage.php patches don't resolve all issues for me:
- Editors still get the TYPO3 Exception #1375955684 when trying to add an image.
- The Install tool/Upgrade wizard now offers a "Migrate all RTE magic images from uploads/RTEmagicC_* to fileadmin/_migrated/RTE/". But when I do so I get a Fatal Error:
"Fatal error: Call to a member function isAdmin() on a non-object in [...]/typo3/sysext/core/Classes/Resource/Security/StoragePermissionsAspect.php on line 76"

This is solved here: https://review.typo3.org/#/c/23621/ Bugreport is here #51733

Helmut Hummel wrote:

Dominik Hahn wrote:

A full backtrace of both modules is attached.

Thanks. Can you please try patch set 4. Should solve this problem.

Can reproduce it, so no need for the backtrace

Helmut Hummel wrote:

Andrea Böhm wrote:

After upgrading from 6.0.4 to 6.1.4 I get the same error message that Sascha Egerer posted (Uncaught TYPO3 Exception #1375955684 ...) when I try to insert an image using the RTE (being logged in the backend as admin).

Can you please also post a full backtrace of the exception here? I cannot reproduce this as admin.

With the ResourceFactory.php patch I don't get this message when I'm logged in as admin. Without this patch I get

#1375955684: You are not allowed to access the given folder (More information)

TYPO3\CMS\Core\Resource\Exception\InsufficientFolderAccessPermissionsException thrown in file
/foooo/typo3/sysext/core/Classes/Resource/ResourceStorage.php in line 730.

9 TYPO3\CMS\Core\Resource\ResourceStorage::assureFolderReadPermission(TYPO3\CMS\Core\Resource\Folder)

/foooo/typo3/sysext/core/Classes/Resource/ResourceStorage.php:

01865:   }
01866:   $folder = $this->driver->getFolder($identifier);

01867:   $this->assureFolderReadPermission($folder);

01868: 
01869:   return $folder;

8 TYPO3\CMS\Core\Resource\ResourceStorage::getFolder("uploads/")

/foooo/typo3/sysext/core/Classes/Resource/ResourceFactory.php:

00379:    }
00380:   }

00381:   return $this->getStorageObject($storageUid)->getFolder($folderIdentifier);

00382:  }
00383: 

7 TYPO3\CMS\Core\Resource\ResourceFactory::getFolderObjectFromCombinedIdentifier("uploads/")

/foooo/typo3/sysext/core/Classes/Resource/Service/MagicImageService.php:

00057:    // @todo Proper exception handling is missing here
00058:    if ($targetFolderCombinedIdentifier) {

00059:     $magicFolder = $fileFactory->getFolderObjectFromCombinedIdentifier($targetFolderCombinedIdentifier);

00060:    }
00061:    if (empty($magicFolder) || !$magicFolder instanceof \TYPO3\CMS\Core\Resource\Folder) {

6 TYPO3\CMS\Core\Resource\Service\MagicImageService::getMagicFolder("uploads/")

/foooo/typo3/sysext/core/Classes/Resource/Service/MagicImageService.php:

00108:   if ($magicImageInfo[3]) {
00109:    $targetFileName = 'RTEmagicC_' . PathUtility::pathInfo($imageFileObject->getName(), PATHINFO_FILENAME) . '.' . PathUtility::pathinfo($magicImageInfo[3], PATHINFO_EXTENSION);

00110:    $magicFolder = $this->getMagicFolder($targetFolderCombinedIdentifier);

00111:    if ($magicFolder instanceof \TYPO3\CMS\Core\Resource\Folder) {
00112:     $magicImage = $magicFolder->addFile($magicImageInfo[3], $targetFileName, 'changeName');

5 TYPO3\CMS\Core\Resource\Service\MagicImageService::createMagicImage(TYPO3\CMS\Core\Resource\File, array, "uploads/")

/foooo/typo3/sysext/rtehtmlarea/Classes/SelectImage.php:

00239:     'maxH' => $this->magicMaxHeight
00240:    );

00241:    $magicImage = $magicImageService->createMagicImage($fileObject, $imageConfiguration, $this->getRTEImageStorageDir());

00242:    if ($magicImage instanceof \TYPO3\CMS\Core\Resource\FileInterface) {
00243:     $filePath = $magicImage->getForLocalProcessing(FALSE);

4 TYPO3\CMS\Rtehtmlarea\SelectImage::insertMagicImage(TYPO3\CMS\Core\Resource\File, NULL, "01_Ergotherapie_KWA_Klinik_Stift_Rottall.jpg", "data-htmlarea-file-uid="356" data-htmlarea-file-table="sys_file"")

/foooo/typo3/sysext/rtehtmlarea/Classes/SelectImage.php:

00200:    switch ($this->act) {
00201:    case 'magic':

00202:     $this->insertMagicImage($fileObject, $altText, $titleText, 'data-htmlarea-file-uid="' . $uid . '" data-htmlarea-file-table="' . $table . '"');

00203:     die;
00204:     break;

3 TYPO3\CMS\Rtehtmlarea\SelectImage::insertImage()

/foooo/typo3/sysext/rtehtmlarea/Classes/SelectImage.php:

00087:   $this->fileProcessor->init($GLOBALS['FILEMOUNTS'], $GLOBALS['TYPO3_CONF_VARS']['BE']['fileExtensions']);
00088:   $this->allowedItems = $this->getAllowedItems('magic,plain,image');

00089:   $this->insertImage();

00090:   // Creating backend template object:
00091:   $this->doc = \TYPO3\CMS\Core\Utility\GeneralUtility::makeInstance('TYPO3\\CMS\\Backend\\Template\\DocumentTemplate');

2 TYPO3\CMS\Rtehtmlarea\SelectImage::init()

/foooo/typo3/sysext/rtehtmlarea/Classes/Controller/SelectImageController.php:

00076:   if (!$browserRendered) {
00077:    $GLOBALS['SOBE']->browser = \TYPO3\CMS\Core\Utility\GeneralUtility::makeInstance('TYPO3\\CMS\\Rtehtmlarea\\SelectImage');

00078:    $GLOBALS['SOBE']->browser->init();

00079:    $modData = $GLOBALS['BE_USER']->getModuleData('select_image.php', 'ses');
00080:    list($modData, $store) = $GLOBALS['SOBE']->browser->processSessionData($modData);

1 TYPO3\CMS\Rtehtmlarea\Controller\SelectImageController::main()

/foooo/typo3/sysext/rtehtmlarea/mod4/select_image.php:

00047: // Make instance:
00048: $SOBE = \TYPO3\CMS\Core\Utility\GeneralUtility::makeInstance('TYPO3\\CMS\\Rtehtmlarea\\Controller\\SelectImageController');

00049: $SOBE->main();

00050: $SOBE->printContent();
00051: ?>

Hi!

Andrea Böhm wrote:

With the ResourceFactory.php patch I don't get this message when I'm logged in as admin. Without this patch I get

Can you set TYPO3_CONF_VARS['BE']['RTE_imageStorageDir'] to "fileadmin/_processed_" in the install tool?

Then you should be able to add images in RTE, with admin and editor permissions.

I had the error as reported above after updating from 6.1.3 to 6.1.4:
TYPO3\CMS\Core\Resource\Exception\InsufficientFolderAccessPermissionsException thrown in file
/www/typo3_sources/typo3_src-6.1.4/typo3/sysext/core/Classes/Resource/ResourceStorage.php in line 730.

Manually creating typo3temp/_processed_ resolved it.
But this is NOT a good solution.
Updating many old extensions to new typo3-Versions often needs to clear the typo3temp-folder.
And the folder typo3temp/_processed_ is just a dummy: Nothing is written into this folder.

So I changed line 126
in typo3_src-6.1.4\typo3\sysext\core\Classes\Resource\ResourceFactory.php
from 'processingfolder' => 'typo3temp/_processed_/',
to 'processingfolder' => 'fileadmin/_processed_/',

This solved the problem for me, too.

By the way:
The error occured for me in the frontend when using perfectlightbox 3.1.4
and ::Enlarge on Click:: in images properties of a page.

Helmut Hummel wrote:

Hi!

Andrea Böhm wrote:

With the ResourceFactory.php patch I don't get this message when I'm logged in as admin. Without this patch I get

Can you set TYPO3_CONF_VARS['BE']['RTE_imageStorageDir'] to "fileadmin/_processed_" in the install tool?

Then you should be able to add images in RTE, with admin and editor permissions.

I changed this like you said, but it did not solve the problem.
But I couldn't update the ext_localconf.php - I've to wait until tomorrow morning when the webhoster is reachable again (I don't have the permission to override these files which makes this whole update process even more complicated for me ...)

Should I revert to the original ResourceFactory.php?

-Andrea

Patch 4 restored most of the functionality. At least the page module is accessible for all editors and the list module seems to be working again.

Two things are still not working:

An editor trying to edit the tt_news plugin still gets:

Sie haben nicht die nötigen Rechte, um diese Änderung durchzuführen.
Reason: ERROR: authMode "explicitDeny" failed for field "CType" with value "list" evaluated

All editors get an error message in the BE that the images are missing (content elements, tt_news articles and flexible content elements). It's working fine for the admin though.

TemplaVoila/FCE:

Datei fehlt!
Dieses Inhaltselement verlinkt auf eine Datei, die nicht existiert: Maier-Knapp-Herbst_01.png

tt_news:

Datei fehlt!
Dieses Inhaltselement verlinkt auf eine Datei, die nicht existiert: DSC_8012.jpg

What can I do about it? I don't understand why I should set the 'RTE_imageStorageDir' to temporary folder (containing only processed images at the moment) when TYPO3 moans about not finding the original images.
We have disabled the ability to upload files through the RTE so this one only affects normal content elements (images, text & images), tt_news articles and flexible content elements.

Any help is greatly appreciated.

Still not working.

I've updated the files with the ones of Patch Set 4 (https://review.typo3.org/#/c/23633/), ResourceFactory.php from https://review.typo3.org/#/c/23625/ and the ext_localconf.php from https://review.typo3.org/#/c/23621/. And I've set TYPO3_CONF_VARS['BE']['RTE_imageStorageDir'] to "fileadmin/_processed_".

The ext_localconf.php solved the install tool problems with the upgrade wizard.

But editors still are not able to insert RTE images. And a new problem showed up: both admin and editors can't access the filelist module. Trying so results in the following error:

Fatal error: Call to undefined method TYPO3\CMS\Core\Resource\File::isMissing() in /foooo/typo3_src-6.1.4/typo3/sysext/core/Classes/Resource/ResourceStorage.php on line 615

-Andrea

CORRECTION:
I did not mean to filelist module but the user_upload folder that should be accessible in this module.

Andrea Böhm wrote:

Fatal error: Call to undefined method TYPO3\CMS\Core\Resource\File::isMissing() in /foooo/typo3_src-6.1.4/typo3/sysext/core/Classes/Resource/ResourceStorage.php on line 615

You seem to have an inconsistent state of changes in your installation. isMissing() is introduced in master only and not backported to 6.0 or 6.1 (yet).

Please reset to the original ResourceStorage class as the problems with RTE images are not solved with the patch in https://review.typo3.org/23633
This is only about recreating the typo3temp/_processed_ folder when it has been deleted (I will remove the other change and move it to another patch set)

Also everyone: Thanks for your reports and test so far; very helpful! To keep things separate, I'd like to continue with all RTE related problems in Ticket #51807

Thanks!

Patch set 5 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23633

Patch set 1 for branch TYPO3_6-1 has been pushed to the review server.
It is available at https://review.typo3.org/23655

Patch set 1 for branch TYPO3_6-0 has been pushed to the review server.
It is available at https://review.typo3.org/23656

Hi!

Dominik Hahn wrote:

Patch 4 restored most of the functionality. At least the page module is accessible for all editors and the list module seems to be working again.

Two things are still not working:

An editor trying to edit the tt_news plugin still gets:
[...]

All editors get an error message in the BE that the images are missing (content elements, tt_news articles and flexible content elements). It's working fine for the admin though.

TemplaVoila/FCE:
[...]
(this file is in the folder uploads/tx_templavoila)

tt_news:
[...]
(this file is in the folder uploads/pics)

Please try coressponding patch in ticket #51808

What can I do about it? I don't understand why I should set the 'RTE_imageStorageDir' to temporary folder (containing only processed images at the moment) when TYPO3 moans about not finding the original images.

You are right. This was a wrong hint and the problems have a different cause. Please use 'uploads/' again for now

Helmut Hummel wrote:

Andrea Böhm wrote:

Fatal error: Call to undefined method TYPO3\CMS\Core\Resource\File::isMissing() in /foooo/typo3_src-6.1.4/typo3/sysext/core/Classes/Resource/ResourceStorage.php on line 615

You seem to have an inconsistent state of changes in your installation. isMissing() is introduced in master only and not backported to 6.0 or 6.1 (yet).

Thanks Helmut - using your ResourceStorage.php for 6.1 helped with this issue.

I'll now follow the RTE Bug thread.

OK, for anybody having problems with the current release, please try out this

https://review.typo3.org/23660 (patch set 5)

It rolls back permission restrictions for storage 0 and should solve all problems with RTE and old extensions (like tt_news)