Bug #89616

Extbase returns deleted objects if only endtime is configured

Added by Mathias Brodala 13 days ago. Updated 13 days ago.

Status:
New
Priority:
Must have
Assignee:
-
Category:
Extbase
Target version:
Start date:
2019-11-08
Due date:
% Done:

0%

TYPO3 Version:
9
PHP Version:
Tags:
Complexity:
Is Regression:
Yes
Sprint Focus:

Description

Given a table configured like this in TCA:

return [
    'ctrl' => [
        // ...
        'delete' => 'deleted',
        'enablecolumns' => [
            'endtime' => 'endtime',
        ],
        // ...
    ],
    // ...
];

If used in the BE/CLI context, Extbase will now return deleted rows in case endtime is 0.

This is caused by Extbase's usage of BackendUtility::BEenableFields() will lead Typo3DbQueryParser::getBackendConstraintStatement() to generate a broken statement fragment like this:

 AND (`tx_mytable`.`endtime` = 0) OR (`tx_mytable`.`endtime` > 1573213620) AND tx_mytable.deleted=0

This allows selecting rows which are deleted as long as endtime is 0

Workaround: add at least one additional enablecolumn, so either disabled or starttime. This will lead to a working statement fragment like this:

 AND (`tx_mytable`.`starttime` <= 1573214160) AND ((`tx_mytable`.`endtime` = 0) OR (`tx_mytable`.`endtime` > 1573214160)) AND tx_mytable.deleted=0

History

#1 Updated by Mathias Brodala 13 days ago

  • Description updated (diff)

#2 Updated by Mathias Brodala 13 days ago

  • Description updated (diff)

#3 Updated by Mathias Brodala 13 days ago

  • Description updated (diff)

#4 Updated by Mathias Brodala 13 days ago

  • Is Regression set to Yes

Looks like this is a regression which came with the migration to Doctrine in TYPO3v8. In TYPO3v7 and older BEenableFields() always returns braces around the two endtime constraints:

$query[] = '(' . $field . '=0 OR ' . $field . '>' . $GLOBALS['SIM_ACCESS_TIME'] . ')';

Also available in: Atom PDF