Project

General

Profile

Actions
Copy link

Bug #78102

closed

Incorrect cHash generation may cause 404 on any page

Added by Dmitry Dulepov over 7 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
-
Target version:
-
Start date:
2016-09-28
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
6.2
PHP Version:
Tags:
Complexity:
easy
Is Regression:
No
Sprint Focus:

Description

10 = TEXT
10 {
  typolink {
    parameter.data = TSFE:id
    additionalParams = &L=0&=
    useCacheHash = 1
  }
}

The code above creates a URL like /index.php?id=1&L=0&=&cHash=b977c84f0882a3a7c08999d2cf997eda. When going to that URL, a 404 is thrown because cHash comparison failed.

Reason: in PHP parameter with empty name does not appear in $_GET. Therefore cHash calculation will always fail. However CacheHashCalculator will not exclude such parameter from relevant parameters.

Yes, I know, it is stupid to create such URLs. However this happens in the wild and customers get very angry when they suddenly see 404s. Fortunately, it is easy to fix.

Mind that such URLs can also be created by badly coded extensions, not only by using TypoScript. So it is definitely makes sense that CacheHashCalculator takes $_GET behavior into account and removes that empty parameter from cHash calculation.

TYPO3 version is set to 6.2 but this also happens in 7.6 and 8.3.

Actions
Copy link

Also available in: Atom PDF