[!!!][TASK] Remove config.disablePageExternalUrl option

The option "config.disablePageExternalUrl", which allowed
to bypass the External URL linking (used for special
jumpurl-like functionality and sys_stat) is removed in
favor of custom implementations for middlewares.

In addition, if a page with external URL cannot be
resolved properly, an error response is now triggered (pageNotFound)

Resolves: #96522
Releases: main
Change-Id: I2ce1bcfac0a2ed10adf32171ad6dbcd4372bf640
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72953
Tested-by: core-ci <typo3@b13.com>
Tested-by: Stefan Bürk <stefan@buerk.tech>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Stefan Bürk <stefan@buerk.tech>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>

typo3/sysext/core/Documentation/Changelog/12.0/Breaking-96522-ConfigdisablePageExternalUrlRemoved.rst

@@ -0,0 +1,41 @@
+.. include:: ../../Includes.txt
+
+========================================================
+Breaking: #96522 - config.disablePageExternalUrl removed
+========================================================
+
+See :issue:`96522`
+
+Description
+===========
+
+The TypoScript setting `config.disablePageExternalUrl` has been removed.
+
+In previous versions, it allowed to have third-party extensions such as
+"jumpurl" handle the redirect, and/or do tracking like extensions "sys_stat"
+did back in 2006. TYPO3 Core did not do a redirect itself then when this
+option was activated.
+
+
+Impact
+======
+
+This option is removed, meaning that TYPO3 Core will always handle a deep link
+to a page with an external URL as a redirect, which has been the default
+behaviour for TYPO3 installations anyways.
+
+
+Affected Installations
+======================
+
+TYPO3 installations explicitly setting this option, which is highly unlikely,
+as modern solutions - even jumpurl - use middlewares already since TYPO3 v9.
+
+
+Migration
+=========
+
+Migrate to a PSR-15 middleware in your own extension to mimic the same behavior,
+if this option was actually useful for anybody in recent years.
+
+.. index:: Frontend, TypoScript, NotScanned, ext:frontend

typo3/sysext/frontend/Classes/Middleware/ShortcutAndMountPointRedirect.php

@@ -21,21 +21,27 @@
 use Psr\Http\Message\ServerRequestInterface;
 use Psr\Http\Server\MiddlewareInterface;
 use Psr\Http\Server\RequestHandlerInterface;
+use Psr\Log\LoggerAwareInterface;
+use Psr\Log\LoggerAwareTrait;
 use TYPO3\CMS\Core\Domain\Repository\PageRepository;
 use TYPO3\CMS\Core\Http\ImmediateResponseException;
 use TYPO3\CMS\Core\Http\RedirectResponse;
 use TYPO3\CMS\Core\Routing\PageArguments;
 use TYPO3\CMS\Core\Utility\GeneralUtility;
+use TYPO3\CMS\Frontend\Controller\ErrorController;
 use TYPO3\CMS\Frontend\Controller\TypoScriptFrontendController;
+use TYPO3\CMS\Frontend\Page\PageAccessFailureReasons;
 
 /**
  * Checks mount points, shortcuts and redirects to the target.
  * Alternatively, checks if the current page is a redirect to an external page
  *
  * @internal this middleware might get removed in TYPO3 v10.x.
  */
-class ShortcutAndMountPointRedirect implements MiddlewareInterface
+class ShortcutAndMountPointRedirect implements MiddlewareInterface, LoggerAwareInterface
 {
+    use LoggerAwareTrait;
+
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
     {
         $exposeInformation = $GLOBALS['TYPO3_CONF_VARS']['FE']['exposeRedirectInformation'] ?? false;
@@ -60,20 +66,30 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
         // See if the current page is of doktype "External URL", if so, do a redirect as well.
         /** @var TypoScriptFrontendController */
         $controller = $request->getAttribute('frontend.controller');
-        if (empty($controller->config['config']['disablePageExternalUrl'] ?? null)
-            && PageRepository::DOKTYPE_LINK === (int)$controller->page['doktype']) {
+        if ((int)$controller->page['doktype'] === PageRepository::DOKTYPE_LINK) {
             $externalUrl = $this->prefixExternalPageUrl(
                 $controller->page['url'],
                 $request->getAttribute('normalizedParams')->getSiteUrl()
             );
+            $message = 'TYPO3 External URL' . ($exposeInformation ? ' at page with ID ' . $controller->page['uid'] : '');
             if (!empty($externalUrl)) {
-                $message = 'TYPO3 External URL' . ($exposeInformation ? ' at page with ID ' . $controller->page['uid'] : '');
                 return new RedirectResponse(
                     $externalUrl,
                     303,
                     ['X-Redirect-By' => $message]
                 );
             }
+            $this->logger->error(
+                'Page of type "External URL" could not be resolved properly',
+                [
+                    'page' => $controller->page,
+                ]
+            );
+            return GeneralUtility::makeInstance(ErrorController::class)->pageNotFoundAction(
+                $request,
+                'Page of type "External URL" could not be resolved properly',
+                $controller->getPageAccessFailureReasons(PageAccessFailureReasons::INVALID_EXTERNAL_URL)
+            );
         }
 
         return $handler->handle($request);

typo3/sysext/frontend/Classes/Page/PageAccessFailureReasons.php

@@ -27,6 +27,7 @@ final class PageAccessFailureReasons
     public const NO_PAGES_FOUND = 'page.database.empty';
     public const PAGE_NOT_FOUND = 'page';
     public const ROOTLINE_BROKEN = 'page.rootline';
+    public const INVALID_EXTERNAL_URL = 'page.invalid_external_url';
 
     // Page configuration issues
     public const RENDERING_INSTRUCTIONS_NOT_FOUND = 'rendering_instructions';
@@ -58,9 +59,10 @@ final class PageAccessFailureReasons
      *
      * @var string[]
      */
-    protected $messages = [
+    protected array $messages = [
         self::NO_PAGES_FOUND => 'No page on rootlevel found',
         self::PAGE_NOT_FOUND => 'The requested page does not exist',
+        self::INVALID_EXTERNAL_URL => 'Page of type "External URL" could not be resolved properly',
 
         self::RENDERING_INSTRUCTIONS_NOT_FOUND => 'No TypoScript template found',
         self::RENDERING_INSTRUCTIONS_NOT_CONFIGURED => 'The page is not configured',

typo3/sysext/t3editor/Resources/Private/tsref.xml

@@ -318,11 +318,6 @@ Use this feature in templates supplying other content-types than HTML. That coul
 		<property name="disableCharsetHeader" type="boolean">
 			<description><![CDATA[By default a HTTP header "Content-Type: text/html; charset..." is sent. This option will disable that.]]></description>
 			<default><![CDATA[
-]]></default>
-		</property>
-		<property name="disablePageExternalUrl" type="boolean">
-			<description><![CDATA[If set, pages with doktype "External Url" will not trigger jumpUrl in TSFE. This may help you to have external urls open inside you framesets.]]></description>
-			<default><![CDATA[
 ]]></default>
 		</property>
 		<property name="disablePrefixComment" type="boolean">

typo3/sysext/t3editor/Resources/Public/JavaScript/Mode/typoscript/typoscript.js

@@ -263,7 +263,6 @@
         'disableItems': kw('disableItems'),
         'disableNewContentElementWizard': kw('disableNewContentElementWizard'),
         'disableNoMatchingValueElement': kw('disableNoMatchingValueElement'),
-        'disablePageExternalUrl': kw('disablePageExternalUrl'),
         'disablePrefixComment': kw('disablePrefixComment'),
         'disablePrependAtCopy': kw('disablePrependAtCopy'),
         'disableSearchBox': kw('disableSearchBox'),