Bug #92964

Headers are shown with HTML tags in scheduler task

Added by Sybille Peters 6 months ago. Updated 4 months ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Backend User Interface
Target version:
-
Start date:
2020-12-01
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
9
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

Due to a change, some headers are now displayed with html tags in some scheduler tasks

version 9.5, master

Files

linkvalidator_scheduler.png (47.2 KB) linkvalidator_scheduler.png Sybille Peters, 2020-12-01 10:56
console_commands.png (4.87 KB) console_commands.png Sybille Peters, 2021-01-30 06:13

Related issues

Related to TYPO3 Core - Bug #92983: Header formatting in scheduler for Console CommandsAccepted2020-12-04

Actions
Related to TYPO3 Core - Bug #93717: Raw HTML labels for additional scheduler fields of the linkvalidatorClosed2021-03-12

Actions
Related to TYPO3 Core - Bug #93888: Some scheduler tasks still show raw HTML tagsNew2021-04-09

Actions
Related to TYPO3 Core - Bug #93096: Schedule task with link validator show HTML-Tags instead of procecces documentClosed2020-12-17

Actions
Has duplicate TYPO3 Core - Bug #93317: HTML Code in BE lables - EXT:schedulerClosed2021-01-19

Actions
#1

Updated by Oliver Bartsch 6 months ago

  • Related to Bug #92983: Header formatting in scheduler for Console Commands added
#2

Updated by Oliver Bartsch 5 months ago

  • Has duplicate Bug #93317: HTML Code in BE lables - EXT:scheduler added
#3

Updated by Georg Ringer 5 months ago

  • Subject changed from Headers are shown with HTML tags in linkvalidator scheduler task to Headers are shown with HTML tags in scheduler task

With #92602 the label is escaped twice

#5

Updated by Gerrit Code Review 5 months ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/67549

#6

Updated by Oliver Hader 5 months ago

Issue #92602 (security fix against XSS in typo3/cms-fluid view-helpers) just revealed the flaw in linkvalidator's label generation. ValidatorTaskAdditionalFieldProvider is invoking BackendUtility::wrapInHelp and when rendering the Fluid template f:be.labels.csh causes BackendUtility::wrapInHelp to be called a second time.

It seems(!) this behavior existed since #68683 (https://review.typo3.org/c/Packages/TYPO3.CMS/+/50962/), but was not visually seen until recent security fix.

#7

Updated by Gerrit Code Review 5 months ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/67549

#8

Updated by Sybille Peters 4 months ago

As noted in #92983, it seems this problem appeared as result of: https://review.typo3.org/c/Packages/TYPO3.CMS/+/66663 with related issue #92602 (which I am unable to access).

I am not sure if this will affect other extensions as well. I vaguely remember seeing the problem described here in at least one other scheduler task. Should we at least have a changelog for that?

#9

Updated by Sybille Peters 4 months ago

  • Description updated (diff)
  • Category changed from Linkvalidator to Backend User Interface
#10

Updated by Sybille Peters 4 months ago

Also has problems:

  • Execute console commands

#11

Updated by Gerrit Code Review 4 months ago

Patch set 1 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/67592

#12

Updated by Oliver Hader 4 months ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
#13

Updated by Gerrit Code Review 4 months ago

  • Status changed from Resolved to Under Review

Patch set 2 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/67592

#14

Updated by Gerrit Code Review 4 months ago

Patch set 1 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/67593

#15

Updated by Oliver Hader 4 months ago

  • Status changed from Under Review to Resolved
#16

Updated by Benni Mack 4 months ago

  • Status changed from Resolved to Closed
#17

Updated by Oliver Bartsch 3 months ago

  • Related to Bug #93717: Raw HTML labels for additional scheduler fields of the linkvalidator added
#18

Updated by Sybille Peters 2 months ago

  • Related to Bug #93888: Some scheduler tasks still show raw HTML tags added
#19

Updated by Sybille Peters 2 months ago

  • Related to Bug #93096: Schedule task with link validator show HTML-Tags instead of procecces document added

Also available in: Atom PDF