Project

General

Profile

Actions
Copy link

Task #78477

closed

Refactoring of FlashMessage rendering

Added by Frank Nägler over 7 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Must have
Assignee:
Frank Nägler
Category:
Code Cleanup
Target version:
8.6
Start date:
2016-10-28
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

The implementation of the rendering of FlashMessages in the core should be optimized.
With #73698 we start a cleanup which removes rendering from different places and centralized the markup with the FlashMessage class.

The problems we identified are:
  • Security: markup in FlashMessage are not allowed and can open XSS issues
  • Context: some messages contains markup which is fine in context of backend and frontend, but not in CLI context or maybe other contexts
  • For the reasons above, we found markup as well in the FlashMessageQueue class

For all this reasons, we need a flexible and secure solution to handle the FlashMessage rendering in different contexts.

Related issues 1 (1 open — 0 closed)

Related to TYPO3 Core - Bug #83733: FlashMessage renderers must not escape user contentNew2018-01-30

Actions
Actions
Copy link

Also available in: Atom PDF