TYPO3 Core

I think we found a major bug in the DataHandlers `processRemapStack` function that needs to be fixed urgently.

            $newValue = null;
            foreach ($this->remapStack as $remapAction) {....}

The "newValue" which gets set as replacement value in the database is defined outside of the loop.

This leads to the case that a remapAction will get the value from the remapAction before.

                // Process the arguments with the defined function:
                if (!empty($remapAction['func'])) {
                    $callable = [$this, $remapAction['func']];
                    if (is_callable($callable)) {
                        $newValue = $callable(...$remapAction['args']);
                    }
                }
                // If array is returned, check for maxitems condition, if string is returned this was already done:
                if (is_array($newValue)) {
                    $newValue = implode(',', $this->checkValue_checkMax($tcaFieldConf, $newValue));
                    // The reference casting is only required if
                    // checkValue_group_select_processDBdata() returns an array
                    $newValue = $this->castReferenceValue($newValue, $tcaFieldConf, $isNew);
                }

This can happen when both of the conditions above evaluate to false. E.g. for passthrough fields there is no "$remapAction['func']".

This breaks for example the creation of inline records when "allowLanguageSynchronization" is enabled. In this case the "l10n_parent" field which is defined as passthrough gets the count of inline items set instead of the correct parent uid.