The middleware is processed for files too

[bmoex]

Maybe its something not for this; but I had to manually do this in my own environment and wanted to mention it here:

I have a middleware handling 'secured' files to find the files and serve the file to the browser. As this is processed through middleware the justincase extension lowercased the filepath too; resolving into unknown files.

I fixed this with the following code before the lowerstring check is executed:

       // Safe check that no direct file is requested
        $absolutePath = GeneralUtility::sanitizeLocalUrl(Environment::getPublicPath() . $path);
        if (file_exists($absolutePath)) {
            return $handler->handle($request);
        }

Do you think this should be added for possible other conflicts too?

[Abdull]

Is this issue also about fileadmin file handling? If so, then it doesn't seem to be a problem anymore for fileadmin file handling:

I just tested b13/justincase:1.2.0 with a TYPO3 11.5.25 on Linux (case-sensitive file system), and fileadmin file handling is as expected, i.e. file name capitalization is significant and obeyed.

Example

Three files in fileadmin, all in the same directory:

File https://typo3.example.com/fileadmin/case.png (lowercase)

File https://typo3.example.com/fileadmin/CASE.png (UPPERCASE)

File https://typo3.example.com/fileadmin/CaSe.png (MiXeDcASe)

Result

Requests to any of these three files are correctly disambiguated, and a request to nonexisting https://typo3.example.com/fileadmin/casE.png correctly results in a 404 Not Found.

[bmoex]

By default TYPO3 bypasses the fileadmin folder but i have a middleware that initiates the fileadmin folder through php, and therefor activates your middleware.

My middleware then validates if the user is logged in and has access based on uri; but due to your middleware this request is manipulated (newly created) for my usecase and therefor not used correctly anymore.

As i adjusted it locally, it doesn't conflict anymore. Feel free to adjust or just leave it be but the problem remains. If you want my 'secured files' extension to test, i can send you this in private (feel free to dm me in slack)

[sterborg]

The redirect middleware is affected. If you want to use redirects for files with uppercase letters in the filepath, it won't work as the request is already turned to lowercase.

Workaround at the moment is to change the order of middlewares. I'm not shure if there are any drawbacks, though.