Task #91123

Epic #87417: Integrate proper Content Security Policy (CSP) handling

Task #87418: Refactor and remove usage of inline scripts in backend

Avoid inline JavaScript generated by BackendUtility:viewOnClick

Added by Oliver Hader 3 months ago. Updated 2 months ago.

Status:
Under Review
Priority:
Should have
Assignee:
Category:
Security
Target version:
-
Start date:
2020-04-18
Due date:
% Done:

0%

TYPO3 Version:
10
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

Inline JavaScript produced by BackendUtility:viewOnClick is substituted with markup based instructions and static JavaScript event handlers.

// basically delivers window.open(generatedUri)
BackendUtility::viewOnClick($pageId, $backPath, $rootLine, $section, $viewUri, $getVars, $switchFocus);

can be substituted with e.g.

\TYPO3\CMS\Backend\Routing\PreviewUriBuilder::create($pageId, $viewUri)
    ->withRootLine($rootLine)
    ->withSection($section)
    ->withAdditionalQueryParameters($getVars)
    ->serializeDispatcherAttributes([PreviewUriBuilder::OPTION_SWITCH_FOCUS => $switchFocus]);

which results in the following HTML data attributes
(data can be retrieved as array of complete element as well)

... data-dispatch-action="TYPO3.WindowManager.localOpen" data-dispatch-args="["...uri...",null,"previewWin"]" 

History

#1 Updated by Gerrit Code Review 3 months ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/64243

#2 Updated by Gerrit Code Review 2 months ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/64243

#3 Updated by Gerrit Code Review 2 months ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/64243

#4 Updated by Gerrit Code Review 2 months ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/64243

#5 Updated by Gerrit Code Review 2 months ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/64243

#6 Updated by Gerrit Code Review 2 months ago

Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/64243

#7 Updated by Gerrit Code Review 2 months ago

Patch set 7 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/64243

Also available in: Atom PDF