Task #80317

Deprecate BackendUtility::getRecordRaw

Added by Manuel Selbach over 2 years ago. Updated about 1 year ago.

Status:
Closed
Priority:
Should have
Category:
-
Target version:
-
Start date:
2017-03-17
Due date:
% Done:

100%

TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

Since we follow the principel of "prepared statement", the method getRecordRaw will break this behaviour.
Within the "where" parameter of the function it is possible to inject malicious code.

Thus we should remove it, as the queryBuilder should be used everywhere in the future
to increase visiblity of which query will be processed at a concrete point of code and to
force the concept of prepared statements.


Related issues

Related to TYPO3 Core - Bug #81052: Non-existent field "fe_groups" is used in BackendUtility::ADMCMD_previewCmds() Closed 2017-04-27

Associated revisions

Revision 5462fdfb (diff)
Added by Manuel Selbach over 2 years ago

[TASK] Deprecate BackendUtility::getRecordRaw

Since we follow the principle of "prepared statement", the method
getRecordRaw will break this behaviour. Within the "where" parameter
of the function it is possible to pass a malformed query part.

Thus we should remove it, as the queryBuilder should be used everywhere
in the future to increase visiblity of which query will be processed at
a concrete point of code and to force the concept of prepared statements.

Resolves: #80317
Releases: master
Change-Id: If0028bf897ddee4517228a9e399390fe7266215e
Reviewed-on: https://review.typo3.org/52075
Tested-by: TYPO3com <>
Reviewed-by: Anja Leichsenring <>
Tested-by: Anja Leichsenring <>
Reviewed-by: Christian Kuhn <>
Tested-by: Christian Kuhn <>

Revision e47acfbe (diff)
Added by Christian Kuhn over 2 years ago

[FOLLOWUP][TASK] Deprecate BackendUtility::getRecordRaw

Rename .rst file since the colons give headaches on windows.

Change-Id: I710a030ce7335b294d081e237a019cec6b7ca74f
Resolves: #80317
Releases: master
Reviewed-on: https://review.typo3.org/52125
Reviewed-by: Benjamin Kott <>
Tested-by: Benjamin Kott <>
Tested-by: TYPO3com <>
Reviewed-by: Christian Kuhn <>
Tested-by: Christian Kuhn <>

Revision 6571e8c8 (diff)
Added by Andreas Fernandez over 2 years ago

[BUGFIX] Use correct field `fe_group` instead of non-existent `fe_groups`

Since #80317, `BackendUtility::ADMCMD_previewCmds()` uses the field
`fe_groups` for the `pages` table, which does not exist. This patch
fixes the regression by using `fe_group` again.

Resolves: #81052
Related: #80317
Releases: master, 8.7
Change-Id: I08106704589fcab7607a9448b2eae646c611de93
Reviewed-on: https://review.typo3.org/52644
Tested-by: TYPO3com <>
Reviewed-by: Daniel Goerz <>
Tested-by: Daniel Goerz <>
Reviewed-by: Wouter Wolters <>
Tested-by: Wouter Wolters <>

Revision 36447587 (diff)
Added by Andreas Fernandez over 2 years ago

[BUGFIX] Use correct field `fe_group` instead of non-existent `fe_groups`

Since #80317, `BackendUtility::ADMCMD_previewCmds()` uses the field
`fe_groups` for the `pages` table, which does not exist. This patch
fixes the regression by using `fe_group` again.

Resolves: #81052
Related: #80317
Releases: master, 8.7
Change-Id: I08106704589fcab7607a9448b2eae646c611de93
Reviewed-on: https://review.typo3.org/52645
Tested-by: TYPO3com <>
Reviewed-by: Wouter Wolters <>
Tested-by: Wouter Wolters <>

History

#1 Updated by Gerrit Code Review over 2 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/52075

#2 Updated by Gerrit Code Review over 2 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/52075

#3 Updated by Gerrit Code Review over 2 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/52075

#4 Updated by Gerrit Code Review over 2 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/52075

#5 Updated by Gerrit Code Review over 2 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/52075

#6 Updated by Gerrit Code Review over 2 years ago

Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/52075

#7 Updated by Gerrit Code Review over 2 years ago

Patch set 7 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/52075

#8 Updated by Gerrit Code Review over 2 years ago

Patch set 8 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/52075

#9 Updated by Gerrit Code Review over 2 years ago

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/52125

#10 Updated by Manuel Selbach over 2 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#11 Updated by Andreas Fernandez over 2 years ago

  • Related to Bug #81052: Non-existent field "fe_groups" is used in BackendUtility::ADMCMD_previewCmds() added

#12 Updated by Benni Mack about 1 year ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF