Task #83334

GeneralUtility::implodeArrayForUrl should always encode param-names

Added by Stefan Neufeind almost 2 years ago. Updated 7 months ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Security
Target version:
-
Start date:
2017-12-14
Due date:
% Done:

100%

TYPO3 Version:
9
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

implodeArrayForUrl() had a fifth parameter to encode param-names
as well. It needs to be used to receive secure URLs, however its
default-value was "false" in the past.
That parameter is removed/deprecated now and defaults to "true"
(always encode param-names).


Related issues

Related to TYPO3 Core - Task #83350: Provide array_filter_recursive in ArrayUtility Closed 2017-12-16
Related to TYPO3 Core - Task #86838: Deprecate GeneralUtility::implodeArrayForUrl() Rejected 2018-11-02
Related to TYPO3 Core - Bug #87010: Copy, cut and paste function broken in weblist module Closed 2018-11-26
Related to TYPO3 Core - Bug #87153: Reset password in the `felogin` not working Closed 2018-12-13
Related to TYPO3 Core - Bug #87403: felogin: password forgotten form is not displayed after clicking link in email - double encoded forgothash Closed 2019-01-11

Associated revisions

Revision ff6ad483 (diff)
Added by Stefan Neufeind about 1 year ago

[FEATURE] Improve creation of URL query strings from arrays

Adds a new method HttpUtility::buildQueryString() using
http_build_query() instead of reimplementing the encoding-process like
the old method GeneralUtility::implodeArrayForUrl() did.

As the parameter $rawurlencodeParamName of implodeArrayForUrl() was set
to "false" by default and used in several places without manually
setting it to "true" using that method could lead to potentially unsafe
non-encoded parameter names.

Some unit-tests had wrong URLs with non-encoded braces [...], which were
adapted to be properly escaped as well.

Resolves: #83334
Releases: master
Change-Id: Ifbaad912f0d658671356dc7bdf1579dacff272df
Reviewed-on: https://review.typo3.org/55079
Reviewed-by: Benni Mack <>
Tested-by: Benni Mack <>
Tested-by: TYPO3com <>
Reviewed-by: Anja Leichsenring <>
Tested-by: Anja Leichsenring <>

Revision ad4f700d (diff)
Added by Gerrit Mohrmann 11 months ago

[BUGFIX] Remove rawurlencode from felogin reset password link

Link is encoded twice since #83334.
The patch removes the rawurlencode from FrontendLoginController

Resolves: #87153
Related: #83334
Releases: master, 9.5
Change-Id: I91a99e952300fb57cc1e9097738ab7f21ea6e9a4
Reviewed-on: https://review.typo3.org/59155
Tested-by: TYPO3com <>
Reviewed-by: Guido Schmechel <>
Reviewed-by: Oliver Klee <>
Reviewed-by: Josef Glatz <>
Reviewed-by: Georg Ringer <>
Tested-by: Georg Ringer <>
Tested-by: Mona Muzaffar <>
Reviewed-by: Jan Helke <>
Tested-by: Jan Helke <>

Revision cc3e6f1c (diff)
Added by Gerrit Mohrmann 11 months ago

[BUGFIX] Remove rawurlencode from felogin reset password link

Link is encoded twice since #83334.
The patch removes the rawurlencode from FrontendLoginController

Resolves: #87153
Related: #83334
Releases: master, 9.5
Change-Id: I91a99e952300fb57cc1e9097738ab7f21ea6e9a4
Reviewed-on: https://review.typo3.org/59407
Tested-by: TYPO3com <>
Reviewed-by: Jan Helke <>
Tested-by: Jan Helke <>

History

#1 Updated by Gerrit Code Review almost 2 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#2 Updated by Gerrit Code Review almost 2 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#3 Updated by Gerrit Code Review almost 2 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#4 Updated by Gerrit Code Review almost 2 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#5 Updated by Gerrit Code Review almost 2 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#6 Updated by Gerrit Code Review almost 2 years ago

Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#7 Updated by Gerrit Code Review almost 2 years ago

Patch set 7 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#8 Updated by Gerrit Code Review almost 2 years ago

Patch set 8 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#9 Updated by Gerrit Code Review almost 2 years ago

Patch set 9 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#10 Updated by Stefan Neufeind almost 2 years ago

  • Related to Task #83350: Provide array_filter_recursive in ArrayUtility added

#11 Updated by Gerrit Code Review almost 2 years ago

Patch set 10 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#12 Updated by Gerrit Code Review almost 2 years ago

Patch set 11 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#13 Updated by Gerrit Code Review almost 2 years ago

Patch set 12 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#14 Updated by Gerrit Code Review almost 2 years ago

Patch set 13 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#15 Updated by Gerrit Code Review almost 2 years ago

Patch set 14 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#16 Updated by Gerrit Code Review almost 2 years ago

Patch set 15 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#17 Updated by Gerrit Code Review almost 2 years ago

Patch set 16 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#18 Updated by Gerrit Code Review almost 2 years ago

Patch set 17 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#19 Updated by Gerrit Code Review almost 2 years ago

Patch set 18 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#20 Updated by Gerrit Code Review almost 2 years ago

Patch set 19 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#21 Updated by Gerrit Code Review almost 2 years ago

Patch set 20 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#22 Updated by Gerrit Code Review almost 2 years ago

Patch set 21 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#23 Updated by Gerrit Code Review almost 2 years ago

Patch set 22 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#24 Updated by Gerrit Code Review over 1 year ago

Patch set 23 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#25 Updated by Gerrit Code Review over 1 year ago

Patch set 24 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#26 Updated by Gerrit Code Review over 1 year ago

Patch set 25 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#27 Updated by Gerrit Code Review over 1 year ago

Patch set 26 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#28 Updated by Gerrit Code Review over 1 year ago

Patch set 27 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#29 Updated by Gerrit Code Review over 1 year ago

Patch set 28 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#30 Updated by Gerrit Code Review over 1 year ago

Patch set 29 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#31 Updated by Gerrit Code Review over 1 year ago

Patch set 30 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#32 Updated by Gerrit Code Review about 1 year ago

Patch set 31 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#33 Updated by Gerrit Code Review about 1 year ago

Patch set 32 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#34 Updated by Gerrit Code Review about 1 year ago

Patch set 33 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#35 Updated by Gerrit Code Review about 1 year ago

Patch set 34 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#36 Updated by Gerrit Code Review about 1 year ago

Patch set 35 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#37 Updated by Gerrit Code Review about 1 year ago

Patch set 36 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#38 Updated by Gerrit Code Review about 1 year ago

Patch set 37 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#39 Updated by Anja Leichsenring about 1 year ago

  • Related to Task #86838: Deprecate GeneralUtility::implodeArrayForUrl() added

#40 Updated by Gerrit Code Review about 1 year ago

Patch set 38 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#41 Updated by Gerrit Code Review about 1 year ago

Patch set 39 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55079

#42 Updated by Stefan Neufeind about 1 year ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#43 Updated by Helmut Hummel about 1 year ago

  • Assignee deleted (Helmut Hummel)

#44 Updated by Anja Leichsenring about 1 year ago

  • Related to Bug #87010: Copy, cut and paste function broken in weblist module added

#45 Updated by Gerrit Mohrmann 12 months ago

  • Related to Bug #87153: Reset password in the `felogin` not working added

#46 Updated by Georg Ringer 11 months ago

  • Related to Bug #87403: felogin: password forgotten form is not displayed after clicking link in email - double encoded forgothash added

#47 Updated by Benni Mack 7 months ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF