From 7991a685491f43ada9b3458aa867fdd5a50c2d58 Mon Sep 17 00:00:00 2001 From: Oliver Bartsch Date: Fri, 22 Mar 2024 18:10:35 +0100 Subject: [PATCH] [BUGFIX] Check language access for edit default metadata At various places, it's possible to edit the metadata of a file in the default language. However, users might not have access to the default language. To prevent moving to FormEngine and facing access permission errors, those places now use proper language access checks and do not display corresponding action if the user does not have access. Resolves: #103432 Releases: main, 12.4 Change-Id: I22c3755a17888cfc623ce05b25fd655b323cc553 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83583 Tested-by: Oliver Bartsch Reviewed-by: Oliver Bartsch Tested-by: core-ci --- .../Sources/TypeScript/filelist/file-list.ts | 3 +- .../ItemProviders/FileProvider.php | 9 +++--- .../Classes/Controller/FileListController.php | 29 ++++++++++++------- typo3/sysext/filelist/Classes/FileList.php | 6 +++- .../Private/Templates/File/List.html | 10 ++++--- .../Private/Templates/Filelist/Tiles.html | 3 +- .../Resources/Public/JavaScript/file-list.js | 2 +- 7 files changed, 40 insertions(+), 22 deletions(-) diff --git a/Build/Sources/TypeScript/filelist/file-list.ts b/Build/Sources/TypeScript/filelist/file-list.ts index 777da92c5672..e9cd76f57508 100644 --- a/Build/Sources/TypeScript/filelist/file-list.ts +++ b/Build/Sources/TypeScript/filelist/file-list.ts @@ -89,7 +89,8 @@ export default class Filelist { new RegularEvent(FileListActionEvent.primary, (event: CustomEvent): void => { const detail: FileListActionDetail = event.detail; const resource = detail.resources[0]; - if (resource.type === 'file') { + const resourceElement: HTMLElement = detail.trigger.closest('[data-default-language-access]') as HTMLElement; + if (resource.type === 'file' && resourceElement !== null) { window.location.href = top.TYPO3.settings.FormEngine.moduleUrl + '&edit[sys_file_metadata][' + resource.metaUid + ']=edit' + '&returnUrl=' + Filelist.getReturnUrl(''); diff --git a/typo3/sysext/filelist/Classes/ContextMenu/ItemProviders/FileProvider.php b/typo3/sysext/filelist/Classes/ContextMenu/ItemProviders/FileProvider.php index 5a202d52341b..a5e15786f450 100644 --- a/typo3/sysext/filelist/Classes/ContextMenu/ItemProviders/FileProvider.php +++ b/typo3/sysext/filelist/Classes/ContextMenu/ItemProviders/FileProvider.php @@ -225,10 +225,11 @@ protected function canBeEdited(): bool protected function canEditMetadata(): bool { return $this->isFile() - && $this->record->isIndexed() - && $this->record->checkActionPermission('editMeta') - && $this->record->getMetaData()->offsetExists('uid') - && $this->backendUser->check('tables_modify', 'sys_file_metadata'); + && $this->record->isIndexed() + && $this->record->checkActionPermission('editMeta') + && $this->record->getMetaData()->offsetExists('uid') + && $this->backendUser->check('tables_modify', 'sys_file_metadata') + && $this->backendUser->checkLanguageAccess(0); } protected function canBeRenamed(): bool diff --git a/typo3/sysext/filelist/Classes/Controller/FileListController.php b/typo3/sysext/filelist/Classes/Controller/FileListController.php index dd09637fa2b7..f86c17c2f95c 100644 --- a/typo3/sysext/filelist/Classes/Controller/FileListController.php +++ b/typo3/sysext/filelist/Classes/Controller/FileListController.php @@ -382,19 +382,28 @@ protected function generateFileList(ServerRequestInterface $request): void 'fileUploadUrl' => $this->getFileUploadUrl(), 'totalItems' => $this->filelist->totalItems, ]); + + // Add edit metadata configuration, if user can edit default language + if ($this->getBackendUser()->checkLanguageAccess(0)) { + $this->view->assign( + 'editActionConfiguration', + GeneralUtility::jsonEncodeForHtmlAttribute([ + 'idField' => 'filelistMetaUid', + 'table' => 'sys_file_metadata', + 'returnUrl' => $this->filelist->createModuleUri(), + ]) + ); + } + // Assign meta information for the multi record selection - $this->view->assignMultiple([ - 'editActionConfiguration' => GeneralUtility::jsonEncodeForHtmlAttribute([ - 'idField' => 'filelistMetaUid', - 'table' => 'sys_file_metadata', - 'returnUrl' => $this->filelist->createModuleUri(), - ], true), - 'deleteActionConfiguration' => GeneralUtility::jsonEncodeForHtmlAttribute([ + $this->view->assign( + 'deleteActionConfiguration', + GeneralUtility::jsonEncodeForHtmlAttribute([ 'ok' => $lang->sL('LLL:EXT:core/Resources/Private/Language/locallang_core.xlf:cm.delete'), 'title' => $lang->sL('LLL:EXT:filelist/Resources/Private/Language/locallang_mod_file_list.xlf:clip_deleteMarked'), 'content' => $lang->sL('LLL:EXT:filelist/Resources/Private/Language/locallang_mod_file_list.xlf:clip_deleteMarkedWarning'), - ], true), - ]); + ]), + ); // Add download button configuration, if file download is enabled if ($this->getBackendUser()->getTSConfig()['options.']['file_list.']['fileDownload.']['enabled'] ?? true) { @@ -402,7 +411,7 @@ protected function generateFileList(ServerRequestInterface $request): void 'downloadActionConfiguration', GeneralUtility::jsonEncodeForHtmlAttribute([ 'downloadUrl' => (string)$this->uriBuilder->buildUriFromRoute('file_download'), - ], true) + ]) ); } } else { diff --git a/typo3/sysext/filelist/Classes/FileList.php b/typo3/sysext/filelist/Classes/FileList.php index 21a3e8a871f4..09cb51743d0a 100644 --- a/typo3/sysext/filelist/Classes/FileList.php +++ b/typo3/sysext/filelist/Classes/FileList.php @@ -259,6 +259,7 @@ protected function renderTiles(ResourceCollectionPaginator $paginator, array $re { $view->assign('displayThumbs', $this->thumbs); $view->assign('displayCheckbox', $this->resourceSelectableMatcher ? true : false); + $view->assign('defaultLanguageAccess', $this->getBackendUser()->checkLanguageAccess(0)); $view->assign('pagination', [ 'backward' => $this->getPaginationLinkForDirection($paginator, NavigationDirection::BACKWARD), 'forward' => $this->getPaginationLinkForDirection($paginator, NavigationDirection::FORWARD), @@ -492,6 +493,9 @@ protected function renderListTableBody(array $resourceViews): string 'data-multi-record-selection-element' => 'true', 'draggable' => $resourceView->canMove() ? 'true' : 'false', ]; + if ($this->getBackendUser()->checkLanguageAccess(0)) { + $attributes['data-default-language-access'] = 'true'; + } foreach ($this->fieldArray as $field) { switch ($field) { case 'icon': @@ -988,7 +992,7 @@ protected function createControlEditContent(ResourceView $resourceView): ?Button protected function createControlEditMetaData(ResourceView $resourceView): ?ButtonInterface { - if (!$resourceView->getMetaDataUid()) { + if (!$resourceView->getMetaDataUid() || !$this->getBackendUser()->checkLanguageAccess(0)) { return null; } diff --git a/typo3/sysext/filelist/Resources/Private/Templates/File/List.html b/typo3/sysext/filelist/Resources/Private/Templates/File/List.html index a8f4948480cc..a3cb1d82d401 100644 --- a/typo3/sysext/filelist/Resources/Private/Templates/File/List.html +++ b/typo3/sysext/filelist/Resources/Private/Templates/File/List.html @@ -93,13 +93,15 @@
-
- -
+ + +