Permalink
Show file tree
Hide file tree
22 changes: 22 additions & 0 deletions
22
typo3/sysext/core/Classes/Authentication/BackendUserAuthentication.php
10 changes: 5 additions & 5 deletions
10
typo3/sysext/core/Tests/Acceptance/Application/Impexp/UsersCest.php
66 changes: 66 additions & 0 deletions
66
typo3/sysext/core/Tests/Functional/Authentication/BackendUserAuthenticationTest.php
11 changes: 1 addition & 10 deletions
11
typo3/sysext/impexp/Classes/Controller/ImportController.php
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
[SECURITY] Restrict export functionality to allowed users
The import functionality of the import/export module is already restricted to admin users or users, who explicitly have access through the user TSConfig setting "options.impexp.enableImportForNonAdminUser". The export functionality has the following security drawbacks: * Export for editors is not limited on field level * The "Save to filename" functionality saves to a shared folder, which other editors with different access rights may have access to. Both issues are not easy to resolve and also the target audience for the Import/Export functionality are mainly TYPO3 admins. Therefore, now also the export functionality is restricted to TYPO3 admin users and to users, who explicitly have access through the new user TSConfig setting "options.impexp.enableExportForNonAdminUser". Additionally, the contents of the temporary "importexport" folder in file storages is now only visible to users who have access to the export functionality. In general, it is recommended to only install the Import/Export extension when the functionality is required. Resolves: #94951 Releases: main, 11.5, 10.4 Change-Id: Iae020baf051aeec0613366687aa8ebcbf9b3d8b2 Security-Bulletin: TYPO3-CORE-SA-2022-001 Security-References: CVE-2022-31046 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74902 Tested-by: Oliver Hader <oliver.hader@typo3.org> Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
- Loading branch information
Showing
10 changed files
with
236 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
55 changes: 55 additions & 0 deletions
55
typo3/sysext/core/Classes/Resource/Filter/ImportExportFilter.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| <?php | ||
|
|
||
| declare(strict_types=1); | ||
|
|
||
| /* | ||
| * This file is part of the TYPO3 CMS project. | ||
| * | ||
| * It is free software; you can redistribute it and/or modify it under | ||
| * the terms of the GNU General Public License, either version 2 | ||
| * of the License, or any later version. | ||
| * | ||
| * For the full copyright and license information, please read the | ||
| * LICENSE.txt file that was distributed with this source code. | ||
| * | ||
| * The TYPO3 project - inspiring people to share! | ||
| */ | ||
|
|
||
| namespace TYPO3\CMS\Core\Resource\Filter; | ||
|
|
||
| use TYPO3\CMS\Core\Authentication\BackendUserAuthentication; | ||
| use TYPO3\CMS\Core\Resource\Driver\DriverInterface; | ||
|
|
||
| /** | ||
| * Utility methods for filtering filenames stored in `importexport` temporary folder. | ||
| * Albeit this filter is in the scope of `ext:impexp`, it is located in `ext:core` to | ||
| * apply filters on left-over fragments, even when `ext:impexp` is not installed. | ||
| * | ||
| * @internal | ||
| */ | ||
| class ImportExportFilter | ||
| { | ||
| /** | ||
| * Filter method that checks if a directory or a file in such directory belongs to the temp directory of EXT:impexp | ||
| * and the user has "export" permissions. | ||
| */ | ||
| public static function filterImportExportFilesAndFolders(string $itemName, string $itemIdentifier, string $parentIdentifier, array $additionalInformation, DriverInterface $driverInstance) | ||
| { | ||
| // + `_temp_` is hard-coded in `BackendUserAuthentication::getDefaultUploadTemporaryFolder()` | ||
| // + `importexport` is hard-coded in `ImportExport::createDefaultImportExportFolder()` | ||
| $importExportFolderSubPath = '/_temp_/importexport/'; | ||
| if (str_ends_with($parentIdentifier, $importExportFolderSubPath) || str_contains($itemIdentifier, $importExportFolderSubPath)) { | ||
| $backendUser = self::getBackendUser(); | ||
| if ($backendUser === null || !$backendUser->isExportEnabled()) { | ||
| return -1; | ||
| } | ||
| } | ||
|
|
||
| return true; | ||
| } | ||
|
|
||
| protected static function getBackendUser(): ?BackendUserAuthentication | ||
| { | ||
| return $GLOBALS['BE_USER'] ?? null; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.