TYPO3 Core

Candidate for Major Version

Category:

Security

Target version:

Start date:

2022-11-30

Due date:

% Done:

100%

Estimated time:

(Total: 0.00 h)

PHP Version:

Tags:

Complexity:

Sprint Focus:

Description

see https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#login-csrf

Future topics after PS25 (https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183/25) in separate patch:

maybe reuse Nonce cookie?
AbstractUserAuth event handling tokens
Extbase generic handling
RequestToken->consumed property

Subtasks 1 (0 open — 1 closed)

Feature #99232: Add event to intercept/adjust request-token

Closed

2022-11-30

Related issues 3 (0 open — 3 closed)

Related to TYPO3 Core - Task #98473: Extend RequestToken tests

Closed

2022-09-29

Related to TYPO3 Core - Task #98508: Use pepper explicitly for creating signing keys

Closed

2022-10-03

Related to TYPO3 Core - Bug #101209: Backend refresh login cannot re-authenticate

Closed

2023-06-30

Issue # Delay: days Cancel

History
Notes
Property changes
Associated revisions

Actions

Updated by Gerrit Code Review over 2 years ago

Status changed from New to Under Review

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

Updated by Gerrit Code Review over 2 years ago

Patch set 2 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

Updated by Gerrit Code Review over 2 years ago

Patch set 3 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

Updated by Gerrit Code Review over 2 years ago

Patch set 4 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

Updated by Gerrit Code Review over 2 years ago

Patch set 5 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

Updated by Gerrit Code Review about 2 years ago

Patch set 6 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

Updated by Gerrit Code Review about 2 years ago

Patch set 7 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

Updated by Gerrit Code Review about 2 years ago

Patch set 8 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

Updated by Gerrit Code Review about 2 years ago

Patch set 9 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#login-csrf

#11

Updated by Oliver Hader about 2 years ago

Description updated (diff)

Actions

#12

Updated by Gerrit Code Review about 2 years ago

Patch set 10 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#13

Updated by Gerrit Code Review about 2 years ago

Patch set 11 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#14

Updated by Gerrit Code Review about 2 years ago

Patch set 12 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#15

Updated by Gerrit Code Review about 2 years ago

Patch set 13 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#16

Updated by Gerrit Code Review about 2 years ago

Patch set 14 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#17

Updated by Gerrit Code Review about 2 years ago

Patch set 15 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#18

Updated by Gerrit Code Review about 2 years ago

Patch set 16 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#19

Updated by Gerrit Code Review about 2 years ago

Patch set 17 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#20

Updated by Gerrit Code Review about 2 years ago

Patch set 18 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#21

Updated by Gerrit Code Review about 2 years ago

Patch set 19 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#22

Updated by Gerrit Code Review about 2 years ago

Patch set 20 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#23

Updated by Gerrit Code Review about 2 years ago

Patch set 21 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#24

Updated by Gerrit Code Review about 2 years ago

Patch set 22 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#25

Updated by Gerrit Code Review about 2 years ago

Patch set 23 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#26

Updated by Gerrit Code Review about 2 years ago

Patch set 24 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#27

Updated by Gerrit Code Review about 2 years ago

Patch set 25 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#28

Updated by Oliver Hader about 2 years ago

Description updated (diff)

Actions

#29

Updated by Gerrit Code Review about 2 years ago

Patch set 26 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#30

Updated by Gerrit Code Review about 2 years ago

Patch set 27 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#31

Updated by Gerrit Code Review about 2 years ago

Patch set 28 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#32

Updated by Gerrit Code Review about 2 years ago

Patch set 29 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#33

Updated by Gerrit Code Review about 2 years ago

Patch set 30 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#34

Updated by Gerrit Code Review about 2 years ago

Patch set 31 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#35

Updated by Gerrit Code Review about 2 years ago

Patch set 32 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#36

Updated by Gerrit Code Review about 2 years ago

Patch set 33 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74183

Actions

#37

Updated by Oliver Hader about 2 years ago

Status changed from Under Review to Resolved
% Done changed from 0 to 100

Applied in changeset 9cb30fb9c03e3efb37a0e44d72b24f1bb4814959.

Actions

#38

Updated by Oliver Hader about 2 years ago

Related to Task #98473: Extend RequestToken tests added

Actions

#39

Updated by Oliver Hader about 2 years ago

Related to Task #98508: Use pepper explicitly for creating signing keys added

Actions

#40

Updated by Benni Mack about 2 years ago

Status changed from Resolved to Closed

Actions

#41

Updated by Gerrit Code Review about 2 years ago

Status changed from Closed to Under Review

Patch set 1 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76357

Actions

#42

Updated by Gerrit Code Review about 2 years ago

Patch set 2 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76357

Actions

#43

Updated by Gerrit Code Review about 2 years ago

Patch set 3 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76357

Actions

#44

Updated by Gerrit Code Review about 2 years ago

Patch set 4 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/76357

Actions

#45

Updated by Oliver Hader almost 2 years ago

Subtask #99232 added

Actions

#46

Updated by Benni Mack over 1 year ago

Target version changed from 12 LTS to Candidate for Major Version

Actions

#47

Updated by Oliver Hader over 1 year ago

Status changed from Under Review to Resolved

Done for TYPO3 v12. Nobody was interested in testing the back-port I created to TYPO3 v11.

Actions

#48

Updated by Oliver Hader over 1 year ago

Related to Bug #101209: Backend refresh login cannot re-authenticate added

Actions