Bug #83029

GIFBUILDER files cannot be delivered via web server

Added by Oliver Hader about 2 years ago. Updated about 1 year ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Image Generation / GIFBUILDER
Target version:
-
Start date:
2017-11-17
Due date:
% Done:

100%

TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

GIFBUILDER uses provided file names and text snippets in order to generate the final name for files to be written to. In case text snippets start with a dot, this is also reflected into the file name - preventing some web servers to deliver the file since it's considered to be internal.

Since directory separators are correctly converted there are no security vulnerabilities.

TypoScript:

page.20 = IMAGE
page.20.file = GIFBUILDER
page.20.file {
    XY = [10.w]+10, [10.h]+10
    backColor = #cc0000
    10 = TEXT
    10.text = .hello
    10.fontColor = #000000
    10.fontSize = 20
    10.offset = 0,20
}

Associated revisions

Revision 5dde3a36 (diff)
Added by Oliver Hader about 2 years ago

[BUGFIX] GIFBUILDER files cannot be delivered via web server

GIFBUILDER uses provided file names and text snippets in order to
generate the final name for files to be written to. In case text
snippets start with a dot, this is also reflected into the file
name - preventing some web servers to deliver the file since it's
considered to be internal.

Resolves: #83029
Releases: master, 8.7
Change-Id: Iebed832c1c2429c7400373a6af4d5ae14a9ea18e
Reviewed-on: https://review.typo3.org/54677
Tested-by: TYPO3com <>
Reviewed-by: Georg Ringer <>
Tested-by: Georg Ringer <>
Reviewed-by: Stefan Neufeind <>
Tested-by: Stefan Neufeind <>

Revision c304e745 (diff)
Added by Oliver Hader about 2 years ago

[BUGFIX] GIFBUILDER files cannot be delivered via web server

GIFBUILDER uses provided file names and text snippets in order to
generate the final name for files to be written to. In case text
snippets start with a dot, this is also reflected into the file
name - preventing some web servers to deliver the file since it's
considered to be internal.

Resolves: #83029
Releases: master, 8.7
Change-Id: Iebed832c1c2429c7400373a6af4d5ae14a9ea18e
Reviewed-on: https://review.typo3.org/54712
Reviewed-by: Stefan Neufeind <>
Tested-by: Stefan Neufeind <>
Tested-by: TYPO3com <>

History

#1 Updated by Gerrit Code Review about 2 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/54677

#2 Updated by Oliver Hader about 2 years ago

  • Description updated (diff)

#3 Updated by Gerrit Code Review about 2 years ago

Patch set 1 for branch TYPO3_8-7 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/54712

#4 Updated by Oliver Hader about 2 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#5 Updated by Benni Mack about 1 year ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF