[BUGFIX] Fix site settings hash calculation

The site-constants cache key in method
`addDefaultTypoScriptConstantsFromSite` of
`SysTemplateTreeBuilder` uses `json_encode()`
in order to build a hash of the site settings object.

With #104858 site settings were expanded to
allow setting-key access via `$settings->get('foo.bar')`
for defined settings and missed to adapt the `jsonSerialize()`
method to continue to return the settings tree instead of the
reduced settings map (which is limited to
settings defined in `settings.definitions.yaml`).

This leads to broken TS caches with multiple sites:
Settings from one site spill over to other sites,
depending on which one was called first after cache clear.

A regression test replays the scenario to proof correctness
of the code change.

Releases: main, 13.4
Resolves: #105760
Related: #104858
Change-Id: Ied715c25265abb98681b11c13468679c0b23528a
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/87557
Tested-by: core-ci <typo3@b13.com>
Tested-by: Benjamin Franzke <ben@bnf.dev>
Reviewed-by: Achim Fritz <af@achimfritz.de>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Achim Fritz <af@achimfritz.de>
Reviewed-by: Benjamin Franzke <ben@bnf.dev>

Author: bnf

typo3/sysext/core/Classes/Site/Entity/SiteSettings.php

@@ -30,6 +30,13 @@
     private array $flatSettings;
     private array $settingsTree;
 
+    /**
+     * @param array $settings key-value map of defined settings
+     * @param array $settingsTree nested settings tree, included defined (settings.definitions.yaml) and anonymous settings (only set in settings.yaml)
+     * @param array $flatSettings key-value map of all settings (defined and anonymous settings)
+     *
+     * @internal to be constructed by create() or createFromSettingsTree()
+     */
     public function __construct(array $settings, array $settingsTree, array $flatSettings)
     {
         parent::__construct($settings);
@@ -67,9 +74,12 @@ public function getAllFlat(): array
         return $this->flatSettings;
     }
 
+    /**
+     * @todo Update jsonSerialize() to return settings map and settings tree values, or remove altogether.
+     */
     public function jsonSerialize(): mixed
     {
-        return json_encode($this->settings);
+        return json_encode($this->settingsTree);
     }
 
     /**

typo3/sysext/frontend/Tests/Functional/SiteHandling/Fixtures/MultiSiteTestPageAndSysTemplateImport.csv

@@ -0,0 +1,16 @@
+"pages"
+,"uid","pid","deleted","title","slug","is_siteroot"
+,1,0,0,"Brand root","/",1
+,2,0,0,"Tech root","/",1
+"sys_template"
+,"uid","pid","deleted","hidden","sorting","title","config"
+,1,1,0,0,256,"Brand root TS","page = PAGE
+page {
+  10 = TEXT
+  10.value = {$settingFromSite}
+}"
+,2,2,0,0,256,"Tech root TS","page = PAGE
+page {
+  10 = TEXT
+  10.value = {$settingFromSite}
+}"

typo3/sysext/frontend/Tests/Functional/SiteHandling/MultiSiteTest.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\CMS\Frontend\Tests\Functional\SiteHandling;
+
+use PHPUnit\Framework\Attributes\Test;
+use TYPO3\CMS\Core\Tests\Functional\SiteHandling\SiteBasedTestTrait;
+use TYPO3\TestingFramework\Core\Functional\Framework\Frontend\InternalRequest;
+use TYPO3\TestingFramework\Core\Functional\FunctionalTestCase;
+
+/**
+ * Test scenarios with multiple sites. Verify caches do not spill
+ * over from one site to another and similar.
+ */
+final class MultiSiteTest extends FunctionalTestCase
+{
+    use SiteBasedTestTrait;
+
+    protected const LANGUAGE_PRESETS = [
+        'EN' => ['id' => 0, 'title' => 'English', 'locale' => 'en_US.UTF8'],
+    ];
+
+    #[Test]
+    public function twoSysTemplateBasedSitesCalculateCorrectSiteSettingsInTypoScript(): void
+    {
+        $this->importCSVDataSet(__DIR__ . '/Fixtures/MultiSiteTestPageAndSysTemplateImport.csv');
+        $this->writeSiteConfiguration(
+            'acme-brand',
+            [
+                'rootPageId' => 1,
+                'base' => 'https://acme.com/brand',
+                'settings' => [
+                    'settingFromSite' => 'BrandFoo',
+                ],
+            ],
+            [
+                $this->buildDefaultLanguageConfiguration('EN', '/'),
+            ]
+        );
+        $this->writeSiteConfiguration(
+            'acme-tech',
+            [
+                'rootPageId' => 2,
+                'base' => 'https://acme.com/tech',
+                'settings' => [
+                    'settingFromSite' => 'TechBar',
+                ],
+            ],
+            [
+                $this->buildDefaultLanguageConfiguration('EN', '/'),
+            ]
+        );
+        $response = $this->executeFrontendSubRequest((new InternalRequest('https://acme.com/brand')));
+        // Site settings set this string, it is used in TypoScript of this page as constant.
+        self::assertStringContainsString('BrandFoo', (string)$response->getBody());
+        $response = $this->executeFrontendSubRequest((new InternalRequest('https://acme.com/tech')));
+        // Site settings set this string, it is used in TypoScript of this page as constant.
+        // The test verifies the correct constant value is calculated when first calling one site
+        // and then the other one, when both have the same site setting with different values.
+        self::assertStringContainsString('TechBar', (string)$response->getBody());
+    }
+}