TYPO3 Core

Scenario:

- System is configured (with trusted hosts) for frontend1.mydomain.com and frontend2.mydomain.com
- User Mallory has two groups (one with lockToDomain for frontend1 and one for frontend2)
- User Mallory logs in on frontend1.mydomain.com (success)
- User Mallory fakes his HTTP_HOST header to frontend2.mydomain.com and gets access rights for frontend1.mydomain.com

I don't know how to fix this.

This is not fixable: The feature relies on HTTP_HOST and there is not way to trust this, so lockToDomain is more an "organizational" feature and must not be interpreted as a security measure.

This ticket is now public, ideas: Add a hint "this is not a sec feature" to csh of those 4 fields (be_groups, be_users, fe_groups, fe_users), and add an according hint to the "security guide"

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/49751

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/49751

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/49751

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/49751