[!!!][SECURITY] Deny direct FAL commands for form definitions

Before this change, form definitions have been persisted in regular
`.yaml` files. In order to make the meaning and purpose of those
files more explicit, the new file ending `.form.yaml` is introduced.

Invocations of the file abstraction layer API for those form files
have to be allowed explicitly by granting commands individually using
`FilePersistenceSlot::allowInvocation`.

New form definitions are created with the new file ending per default.
An upgrade wizard renames existing form definitions that are stored in
according storage folders (`allowedFileMounts`). In addition references
in FlexForm of content elements are adjusted to the new file names as
well - in case a form definition has been referenced before.

The file list user interface disabled according direct actions for
`.form.yaml` files or redirects those to the according form module.

Using just `.yaml` instead of `.form.yaml` from site packages
is deprecated. Using just `.yaml` instead of `.form.yaml` from
file storages is not allowed anymore.

Resolves: #84910
Releases: master, 8.7
Security-Commit: e4680db22c680b489545679f118f3242c2929708
Security-Bulletin: TYPO3-CORE-SA-2018-003
Change-Id: I196327d968cbd53bcc623d050d5b3b8742937996
Reviewed-on: https://review.typo3.org/57554
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

typo3/sysext/core/Classes/Resource/ResourceStorage.php

@@ -1828,7 +1828,7 @@ public function moveFile($file, $targetFolder, $targetFileName = null, $conflict
                 throw new Exception\ExistingTargetFileNameException('The target file already exists', 1329850997);
             }
         }
-        $this->emitPreFileMoveSignal($file, $targetFolder);
+        $this->emitPreFileMoveSignal($file, $targetFolder, $sanitizedTargetFileName);
         $sourceStorage = $file->getStorage();
         // Call driver method to move the file and update the index entry
         try {
@@ -2501,10 +2501,11 @@ protected function emitPostFileCopySignal(FileInterface $file, Folder $targetFol
      *
      * @param FileInterface $file
      * @param Folder $targetFolder
+     * @param string $targetFileName
      */
-    protected function emitPreFileMoveSignal(FileInterface $file, Folder $targetFolder)
+    protected function emitPreFileMoveSignal(FileInterface $file, Folder $targetFolder, string $targetFileName)
     {
-        $this->getSignalSlotDispatcher()->dispatch(self::class, self::SIGNAL_PreFileMove, [$file, $targetFolder]);
+        $this->getSignalSlotDispatcher()->dispatch(self::class, self::SIGNAL_PreFileMove, [$file, $targetFolder, $targetFileName]);
     }
 
     /**

typo3/sysext/core/Classes/Utility/File/ExtendedFileUtility.php

@@ -1013,6 +1013,10 @@ public function func_edit($cmds)
             $this->writeLog(9, 1, 100, 'File "%s" was not saved! File extension rejected!', [$fileObject->getIdentifier()]);
             $this->addMessageToFlashMessageQueue('FileUtility.FileWasNotSaved', [$fileObject->getIdentifier()]);
             return false;
+        } catch (\RuntimeException $e) {
+            $this->writeLog(9, 1, 100, 'File "%s" was not saved! File extension rejected!', [$fileObject->getIdentifier()]);
+            $this->addMessageToFlashMessageQueue('FileUtility.FileWasNotSaved', [$fileObject->getIdentifier()]);
+            return false;
         }
     }
 

typo3/sysext/core/Documentation/Changelog/8.7.x/Important-84910-DenyDirectFALCommandsForFormDefinitions.rst

@@ -0,0 +1,53 @@
+.. include:: ../../Includes.txt
+
+=================================================================
+Important: #84910 - Deny direct FAL commands for form definitions
+=================================================================
+
+In order to control settings in user provided form definitions files and only
+allow manipulations by using the backend form editor (or direct file access
+using e.g. SFTP) form file extensions have been changed form simple `.yaml`
+to more specific `.form.yaml`.
+
+Direct file commands by using either the backend file list module or implemented
+invocations of the file abstraction layer (FAL) API are denied per default and
+have to allowed explicitly for the following commands for files ending with the
+new file suffix `.form.yaml`:
+
+* plain command invocations
+  + create (creating new, empty file having `.form.yaml` suffix)
+  + rename (renaming to file having `.form.yaml` suffix)
+  + replace (replacing an existing file having `.form.yaml` suffix)
+  + move (moving to different file having `.form.yaml` suffix)
+* command and content invocations - content signature required
+  + add (uploading new file having `.form.yaml` suffix)
+  + setContents (changing contents of file having `.form.yaml` suffix)
+
+In order to grant those commands, `\TYPO3\CMS\Form\Slot\FilePersistenceSlot`
+has been introduced (singleton instance).
+
+.. code-block:: php
+
+    // Allowing content modifications on a $file object with
+    // given $newContent information prior to executing the command
+
+    $slot = GeneralUtility::makeInstance(FilePersistenceSlot::class);
+    $slot->allowInvocation(
+        FilePersistenceSlot::COMMAND_FILE_SET_CONTENTS,
+        $file->getCombinedIdentifier(),
+        $this->filePersistenceSlot->getContentSignature($newContent)
+    );
+
+    $file->setContents($newContent);
+
+In contrast to *plain command invocations*, those having *content invocations*
+(`add` and `setContents`, see list of commands above) require a content signature
+as well in order to be executed. The previous example demonstrates that for the
+`setContents` command.
+
+Extensions that are modifying (e.g. post-processing) persisted form definition
+files using the file abstraction layer (FAL) API need to adjust and extend their
+implementation and allow according invocations as outlined above.
+
+See :issue:`84910`
+.. index:: Backend, FAL, ext:form

typo3/sysext/form/Classes/Hooks/DataStructureIdentifierHook.php

@@ -107,11 +107,18 @@ public function parseDataStructureByIdentifierPostProcess(array $dataStructure,
                 $formPersistenceManager = GeneralUtility::makeInstance(ObjectManager::class)->get(FormPersistenceManagerInterface::class);
                 $formIsAccessible = false;
                 foreach ($formPersistenceManager->listForms() as $form) {
+                    $invalidFormDefinition = $form['invalid'] ?? false;
+                    $hasDeprecatedFileExtension = $form['deprecatedFileExtension'] ?? false;
+
+                    if ($form['location'] === 'storage' && $hasDeprecatedFileExtension) {
+                        continue;
+                    }
+
                     if ($form['persistenceIdentifier'] === $identifier['ext-form-persistenceIdentifier']) {
                         $formIsAccessible = true;
                     }
 
-                    if (isset($form['invalid']) && $form['invalid']) {
+                    if ($invalidFormDefinition || $hasDeprecatedFileExtension) {
                         $dataStructure['sheets']['sDEF']['ROOT']['el']['settings.persistenceIdentifier']['TCEforms']['config']['items'][] = [
                             $form['name'] . ' (' . $form['persistenceIdentifier'] . ')',
                             $form['persistenceIdentifier'],

typo3/sysext/form/Classes/Hooks/FileListEditIconsHook.php

@@ -0,0 +1,51 @@
+<?php
+declare(strict_types = 1);
+namespace TYPO3\CMS\Form\Hooks;
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+use TYPO3\CMS\Core\Utility\StringUtility;
+use TYPO3\CMS\Filelist\FileList;
+use TYPO3\CMS\Filelist\FileListEditIconHookInterface;
+use TYPO3\CMS\Form\Mvc\Persistence\FormPersistenceManager;
+
+/**
+ */
+class FileListEditIconsHook implements FileListEditIconHookInterface
+{
+
+    /**
+     * Modifies edit icon array
+     *
+     * @param array $cells
+     * @param FileList $parentObject
+     */
+    public function manipulateEditIcons(&$cells, &$parentObject)
+    {
+        $fileOrFolderObject = $cells['__fileOrFolderObject'];
+        $fullIdentifier = $fileOrFolderObject->getCombinedIdentifier();
+        $isFormDefinition = StringUtility::endsWith($fullIdentifier, FormPersistenceManager::FORM_DEFINITION_FILE_EXTENSION);
+
+        if (!$isFormDefinition) {
+            return;
+        }
+
+        $disableIconNames = ['edit', 'view', 'replace', 'rename'];
+        foreach ($disableIconNames as $disableIconName) {
+            if (!empty($cells[$disableIconName])) {
+                $cells[$disableIconName] = $parentObject->spaceIcon;
+            }
+        }
+    }
+}