Task #78477

Refactoring of FlashMessage rendering

Added by Frank Naegler about 3 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Must have
Assignee:
Category:
Code Cleanup
Target version:
Start date:
2016-10-28
Due date:
% Done:

100%

TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

The implementation of the rendering of FlashMessages in the core should be optimized.
With #73698 we start a cleanup which removes rendering from different places and centralized the markup with the FlashMessage class.

The problems we identified are:
  • Security: markup in FlashMessage are not allowed and can open XSS issues
  • Context: some messages contains markup which is fine in context of backend and frontend, but not in CLI context or maybe other contexts
  • For the reasons above, we found markup as well in the FlashMessageQueue class

For all this reasons, we need a flexible and secure solution to handle the FlashMessage rendering in different contexts.


Related issues

Related to TYPO3 Core - Bug #83733: FlashMessage renderers must not escape user content New 2018-01-30

Associated revisions

Revision d881b03b (diff)
Added by Susanne Moog about 3 years ago

[!!!][FEATURE] Refactoring of FlashMessage rendering

This patch reverts some changes of #73698 and adds some new things:

- Introduce context based FlashMessageRenderer
- Add special FlashMessageViewHelper for the backend
- Cleanup classes related to FlashMessages
- Deprecate some methods from the FlashMessages::class

Resolves: #78477
Related: #73698
Releases: master
Change-Id: I937d5896b0a3d45e59c9174d233410f202add997
Reviewed-on: https://review.typo3.org/50285
Reviewed-by: Christian Kuhn <>
Tested-by: Christian Kuhn <>
Tested-by: TYPO3com <>
Reviewed-by: Markus Klein <>
Tested-by: Markus Klein <>

History

#1 Updated by Gerrit Code Review about 3 years ago

  • Status changed from In Progress to Under Review

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#2 Updated by Gerrit Code Review about 3 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#3 Updated by Gerrit Code Review about 3 years ago

Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#4 Updated by Gerrit Code Review about 3 years ago

Patch set 7 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#5 Updated by Gerrit Code Review about 3 years ago

Patch set 8 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#6 Updated by Gerrit Code Review about 3 years ago

Patch set 9 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#7 Updated by Gerrit Code Review about 3 years ago

Patch set 10 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#8 Updated by Gerrit Code Review about 3 years ago

Patch set 11 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#9 Updated by Gerrit Code Review about 3 years ago

Patch set 12 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#10 Updated by Gerrit Code Review about 3 years ago

Patch set 13 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#11 Updated by Gerrit Code Review about 3 years ago

Patch set 14 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#12 Updated by Benni Mack about 3 years ago

  • Target version changed from 8.5 to 8.6

#13 Updated by Gerrit Code Review about 3 years ago

Patch set 15 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#14 Updated by Gerrit Code Review about 3 years ago

Patch set 16 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#15 Updated by Gerrit Code Review about 3 years ago

Patch set 17 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#16 Updated by Gerrit Code Review about 3 years ago

Patch set 18 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#17 Updated by Gerrit Code Review about 3 years ago

Patch set 19 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#18 Updated by Gerrit Code Review about 3 years ago

Patch set 20 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#19 Updated by Gerrit Code Review about 3 years ago

Patch set 21 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#20 Updated by Anonymous about 3 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#21 Updated by Riccardo De Contardi over 2 years ago

  • Status changed from Resolved to Closed

#22 Updated by Alexander Schnitzler almost 2 years ago

  • Related to Bug #83733: FlashMessage renderers must not escape user content added

Also available in: Atom PDF