Bug #86878

Missing typecast in UploadedFileReferenceConverter when importing FileReference

Added by Saskia Schreiber 11 months ago. Updated 5 months ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Form Framework
Target version:
-
Start date:
2018-11-07
Due date:
% Done:

100%

TYPO3 Version:
9
PHP Version:
7.2
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

There seems to be a missing typecast in UploadedFileReferenceConverter->importUploadedResource() (https://github.com/TYPO3/TYPO3.CMS/blob/a36d3dab92aa48b7d415dbaced5ba69f8722f38c/typo3/sysext/form/Classes/Mvc/Property/TypeConverter/UploadedFileReferenceConverter.php#L222).

If there is a valid FileReference resourcePointer, $hashService->validateAndStripHmac is called which returns a string ID (f.ex. '23'). $this->createFileReferenceFromFalFileObject which is called next expects int as type, which leads to an exception.

In my local patch I fixed this with adding a typecast in line 221 ($resourcePointer = $resourcePointer ? (int)$resourcePointer : null;) if the resourcePointer is available.
Casting directly to int would lead to undesired casts from null to 0.

This bug may not cause any problems in direct usage, I found it while using the TypeConverter in combination with a custom extbase/fluid image upload.

Associated revisions

Revision c5f27f00 (diff)
Added by Georg Ringer 10 months ago

[BUGFIX] Cast file resource pointer in UploadFileReferenceConverter

The return value of the hmac check is a string and must be casted to
an integer as the method using the value requires an integer.

Resolves: #86878
Releases: master, 8.7
Change-Id: Ic6db911c213eb668141ba0c849ff8a627a6f94dc
Reviewed-on: https://review.typo3.org/58868
Reviewed-by: Nicole Cordes <>
Tested-by: Nicole Cordes <>
Tested-by: TYPO3com <>
Reviewed-by: Josef Glatz <>
Reviewed-by: Benni Mack <>
Tested-by: Benni Mack <>

Revision 070c5067 (diff)
Added by Georg Ringer 10 months ago

[BUGFIX] Cast file resource pointer in UploadFileReferenceConverter

The return value of the hmac check is a string and must be casted to
an integer as the method using the value requires an integer.

Resolves: #86878
Releases: master, 8.7
Change-Id: Ic6db911c213eb668141ba0c849ff8a627a6f94dc
Reviewed-on: https://review.typo3.org/58911
Tested-by: TYPO3com <>
Reviewed-by: Benni Mack <>
Tested-by: Benni Mack <>

History

#1 Updated by Gerrit Code Review 11 months ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/58868

#2 Updated by Gerrit Code Review 10 months ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/58868

#3 Updated by Gerrit Code Review 10 months ago

Patch set 1 for branch TYPO3_8-7 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/58911

#4 Updated by Georg Ringer 10 months ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#5 Updated by Benni Mack 5 months ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF