Project

General

Profile

Actions

Bug #52156

closed

jumpurl.secure juHash error with URL encoded characters

Added by Alexander Stehlik over 10 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Frontend
Target version:
Start date:
2013-09-20
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
6.2
PHP Version:
5.4
Tags:
Complexity:
medium
Is Regression:
No
Sprint Focus:

Description

When an URL to file contains URL encoded characters like spaces or ampersands the juHash check will fail with this error (Exception code is 1294585196):

jumpurl Secure: Calculated juHash did not match the submitted juHash.

The reason for this failure is obvious:

The hash gets calculated with an URL encoded version of the link in:

\TYPO3\CMS\Frontend\ContentObject\ContentObjectRenderer::locDataJU()

Then the hash is checked against the non URL encoded version of the link in:

\TYPO3\CMS\Frontend\Controller\TypoScriptFrontendController::jumpUrl()

My solution would be to URL decode the link before generating the hash. Any objections / other ideas?


Related issues 1 (0 open1 closed)

Related to TYPO3 Core - Bug #52806: FAL: getPublicUrl does not always return a valid URLClosedSteffen Ritter2013-10-14

Actions
Actions #1

Updated by Gerrit Code Review over 10 years ago

  • Status changed from New to Under Review

Patch set 2 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #2

Updated by Gerrit Code Review over 10 years ago

Patch set 3 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #3

Updated by Markus Klein over 10 years ago

I agree with your solution, but I would rather encode it in TypoScriptFrontendController.

Actions #4

Updated by Alexander Stehlik over 10 years ago

Hi Markus,

thanks for the quick feedback.

I thought about that, too. But this would be more complicated (need to parse the URL etc.) because if you run:

rawurlencode("http://www.myurl.tld/?param=value 1");

you will get this as a result:

http%3A%2F%2Fwww.myurl.tld%2F%3Fparam%3Dvalue%201

The other way around is much easier. What problems do you see with the current solution?

Actions #5

Updated by Alexander Stehlik over 10 years ago

Hallo again,

after a night of sleeping I think I found the solution (using the same URL encoding method that is used during the generation of the URL):

$theFileEnc = str_replace('%2F', '/', rawurlencode(rawurldecode($link_param)));

I will look further into that and provide a new patch.

Actions #6

Updated by Gerrit Code Review over 10 years ago

Patch set 4 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #7

Updated by Gerrit Code Review over 10 years ago

Patch set 5 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #8

Updated by Gerrit Code Review over 10 years ago

Patch set 6 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #9

Updated by Gerrit Code Review over 10 years ago

Patch set 7 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #10

Updated by Gerrit Code Review over 10 years ago

Patch set 8 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #11

Updated by Gerrit Code Review over 10 years ago

Patch set 9 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #12

Updated by Gerrit Code Review over 10 years ago

Patch set 10 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #13

Updated by Gerrit Code Review over 10 years ago

Patch set 11 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #14

Updated by Gerrit Code Review over 10 years ago

Patch set 12 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #15

Updated by Gerrit Code Review over 10 years ago

Patch set 13 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #16

Updated by Gerrit Code Review over 10 years ago

Patch set 14 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #17

Updated by Gerrit Code Review over 10 years ago

Patch set 15 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #18

Updated by Gerrit Code Review over 10 years ago

Patch set 16 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #19

Updated by Gerrit Code Review over 10 years ago

Patch set 17 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #20

Updated by Gerrit Code Review over 10 years ago

Patch set 18 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #21

Updated by Gerrit Code Review over 10 years ago

Patch set 19 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #22

Updated by Gerrit Code Review over 10 years ago

Patch set 20 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #23

Updated by Gerrit Code Review about 10 years ago

Patch set 21 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #24

Updated by Gerrit Code Review almost 10 years ago

Patch set 22 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #25

Updated by Gerrit Code Review almost 10 years ago

Patch set 23 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #26

Updated by Gerrit Code Review almost 10 years ago

Patch set 24 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #27

Updated by Gerrit Code Review almost 10 years ago

Patch set 25 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #28

Updated by Gerrit Code Review almost 10 years ago

Patch set 26 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/23940

Actions #29

Updated by Gerrit Code Review over 9 years ago

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #30

Updated by Gerrit Code Review over 9 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #31

Updated by Gerrit Code Review over 9 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #32

Updated by Gerrit Code Review over 9 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #33

Updated by Gerrit Code Review almost 9 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #34

Updated by Gerrit Code Review almost 9 years ago

Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #35

Updated by Gerrit Code Review almost 9 years ago

Patch set 7 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #36

Updated by Gerrit Code Review almost 9 years ago

Patch set 8 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #37

Updated by Gerrit Code Review almost 9 years ago

Patch set 9 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #38

Updated by Gerrit Code Review almost 9 years ago

Patch set 10 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #39

Updated by Gerrit Code Review almost 9 years ago

Patch set 11 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #40

Updated by Gerrit Code Review almost 9 years ago

Patch set 12 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #41

Updated by Gerrit Code Review almost 9 years ago

Patch set 13 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #42

Updated by Gerrit Code Review over 8 years ago

Patch set 14 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #43

Updated by Gerrit Code Review over 8 years ago

Patch set 15 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #44

Updated by Gerrit Code Review over 8 years ago

Patch set 16 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #45

Updated by Gerrit Code Review over 8 years ago

Patch set 17 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #46

Updated by Gerrit Code Review over 8 years ago

Patch set 18 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #47

Updated by Gerrit Code Review over 8 years ago

Patch set 19 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/36211

Actions #48

Updated by Alexander Stehlik over 8 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions #49

Updated by Riccardo De Contardi over 6 years ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF