Story #55509
closed
Epic #55070: Workpackages
Epic #55066: WP: Security enhancements
Add CSRF Protection to mod.php
100%
Description
The mod.php dispatcher should check for a correct CSRF token.
- It should be possible to disable CSRF protection in conf.php or Extbase addModule API t not break third party modules (needs to be ckecked if needed) take #55516 into account ( especially backwards compat for wizards)
- BackendUtility::getModuleUrl() must add a token (based on module name)
- Module menu must use BackendUtility::getModuleUrl()
- All occurrences of hardcoded mod.php URLs must be changed to use BackendUtility::getModuleUrl() (at least one place in JS)
Updated by
Updated by Gerrit Code Review almost 11 years ago
Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/27636
Updated by Gerrit Code Review almost 11 years ago
Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/27636
Updated by Gerrit Code Review over 10 years ago
Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/27636
Updated by Gerrit Code Review over 10 years ago
Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/27636
Updated by Gerrit Code Review over 10 years ago
Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/27636
Updated by Gerrit Code Review over 10 years ago
Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/27636
Updated by Gerrit Code Review over 10 years ago
Patch set 7 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/27636
Updated by Helmut Hummel over 10 years ago
- Status changed from Accepted to Resolved
- % Done changed from 90 to 100
Applied in changeset 6e9e5455ba0c656e50ce94bc08d988bba9ec642e.
Updated by Falk Aaron over 10 years ago
How to use \TYPO3\CMS\Extbase\Utility\ExtensionUtility::registerModule with navFrameScript parameter?
It does not work, as the modules are loaded before the BE_USER, so BackendUtility::getModuleUrl does only retrieve a "dummyToken".
May you help me out?
Updated by Riccardo De Contardi about 7 years ago
- Status changed from Resolved to Closed