Project

General

Profile

Actions

Bug #95297

closed

cHash not enforced for Extbase actions anymore

Added by Anonymous over 2 years ago. Updated about 1 year ago.

Status:
Closed
Priority:
Should have
Assignee:
Category:
Link Handling, Site Handling & Routing
Target version:
-
Start date:
2021-09-21
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
10
PHP Version:
7.4
Tags:
chash,extbase
Complexity:
Is Regression:
Sprint Focus:
On Location Sprint

Description

TYPO3 8.5 introduced a new behaviour.

URIs to Extbase actions now need a valid cHash per default. This is required for both cached and uncached actions

https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/8.5/Breaking-78002-EnforceCHashArgumentForExtbaseActions.html

Calling a link to an extbase-action without cHash would lead to an exception.

Now in v10 it looks like this behaviour is not anymore.

Issue

Opening a link to an extbase-action without chash just works.

Expected behaviour

Opening a link to an extbase-action without chash should fail.

Example URL

https://foo.ddev.site/foobarpage?tx_fooext_fooplugin%5Baction%5D=perform&tx_fooext_fooplugin%5Bcontroller%5D=FooController&tx_fooext_fooplugin%5BuserFoo%5D=barbazbarbaz

Possible cause

https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/10.3/Deprecation-89868-RemoveReqCHashFunctionalityForPlugins.html

Here changed a lot. Not only things got deprecated.

https://forge.typo3.org/projects/typo3cms-core/repository/1749/revisions/f305de5888f0a5c1d1474df3f35d52698e1eee4d

CacheHashEnforce was removed in favor of handling in PageArgumentValidator middleware.

It looks like, that "dynamic" extbase-action-arguments were not considered in this changeset. Now CacheHashCalculator don't know them and therefore they are not enforced anymore.

Hotfix / quickfix

Add params manually to requireCacheHashPresenceParameters.

$GLOBALS['TYPO3_CONF_VARS']['FE']['cacheHash']['requireCacheHashPresenceParameters'] = [
    '^tx_fooext_fooplugin',
];

Real fix suggestion

Either populate requireCacheHashPresenceParameters dynamically or use another way to enforce cHash for Extbase actions again.


Related issues 2 (0 open2 closed)

Related to TYPO3 Core - Task #89868: Remove reqCHash functionality for pluginsClosedBenni Mack2019-12-06

Actions
Related to TYPO3 Core - Bug #78002: Require cHash for cached plugin actions in ExtbaseClosed2016-09-20

Actions
Actions

Also available in: Atom PDF