Task #78477

Refactoring of FlashMessage rendering

Added by Frank Naegler about 4 years ago. Updated about 3 years ago.

Status:
Closed
Priority:
Must have
Assignee:
Category:
Code Cleanup
Target version:
Start date:
2016-10-28
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

The implementation of the rendering of FlashMessages in the core should be optimized.
With #73698 we start a cleanup which removes rendering from different places and centralized the markup with the FlashMessage class.

The problems we identified are:
  • Security: markup in FlashMessage are not allowed and can open XSS issues
  • Context: some messages contains markup which is fine in context of backend and frontend, but not in CLI context or maybe other contexts
  • For the reasons above, we found markup as well in the FlashMessageQueue class

For all this reasons, we need a flexible and secure solution to handle the FlashMessage rendering in different contexts.


Related issues

Related to TYPO3 Core - Bug #83733: FlashMessage renderers must not escape user contentNew2018-01-30

Actions
#1

Updated by Gerrit Code Review about 4 years ago

  • Status changed from In Progress to Under Review

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#2

Updated by Gerrit Code Review about 4 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#3

Updated by Gerrit Code Review about 4 years ago

Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#4

Updated by Gerrit Code Review about 4 years ago

Patch set 7 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#5

Updated by Gerrit Code Review about 4 years ago

Patch set 8 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#6

Updated by Gerrit Code Review about 4 years ago

Patch set 9 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#7

Updated by Gerrit Code Review about 4 years ago

Patch set 10 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#8

Updated by Gerrit Code Review about 4 years ago

Patch set 11 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#9

Updated by Gerrit Code Review about 4 years ago

Patch set 12 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#10

Updated by Gerrit Code Review about 4 years ago

Patch set 13 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#11

Updated by Gerrit Code Review about 4 years ago

Patch set 14 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#12

Updated by Benni Mack almost 4 years ago

  • Target version changed from 8.5 to 8.6
#13

Updated by Gerrit Code Review almost 4 years ago

Patch set 15 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#14

Updated by Gerrit Code Review almost 4 years ago

Patch set 16 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#15

Updated by Gerrit Code Review almost 4 years ago

Patch set 17 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#16

Updated by Gerrit Code Review almost 4 years ago

Patch set 18 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#17

Updated by Gerrit Code Review almost 4 years ago

Patch set 19 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#18

Updated by Gerrit Code Review almost 4 years ago

Patch set 20 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#19

Updated by Gerrit Code Review almost 4 years ago

Patch set 21 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50285

#20

Updated by Anonymous almost 4 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
#21

Updated by Riccardo De Contardi about 3 years ago

  • Status changed from Resolved to Closed
#22

Updated by Alexander Schnitzler almost 3 years ago

  • Related to Bug #83733: FlashMessage renderers must not escape user content added

Also available in: Atom PDF