[BUGFIX] Save correct table name as ref_table in refindex

The identifier from the linkHandler page TSconfig was formerly used as
the reference table name "ref_table". This identifier is free to choose
and shouldn't be interpreted as a name of a table.

In order to resolve the correct table name, which is stated in the
configuration, the page id of the reference record is now used. This
allows the TypolinkSoftReferenceParser to read the according page
TSconfig and to set the correct table name.

Resolves: #95380
Releases: master, 10.4
Change-Id: I28817a7267a107df27828d99f7e0cf2eeaaf2de1
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/72202
Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: Henrik Ziegenhain <henrik@ziegenhain.me>
Tested-by: Benni Mack <benni@typo3.org>
Reviewed-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Henrik Ziegenhain <henrik@ziegenhain.me>
Reviewed-by: Benni Mack <benni@typo3.org>

typo3/sysext/core/Classes/Database/SoftReferenceIndex.php

@@ -16,6 +16,7 @@
 namespace TYPO3\CMS\Core\Database;
 
 use Psr\EventDispatcher\EventDispatcherInterface;
+use TYPO3\CMS\Backend\Utility\BackendUtility;
 use TYPO3\CMS\Core\DataHandling\Event\AppendLinkHandlerElementsEvent;
 use TYPO3\CMS\Core\Html\HtmlParser;
 use TYPO3\CMS\Core\LinkHandling\Exception\UnknownLinkHandlerException;
@@ -87,6 +88,16 @@ class SoftReferenceIndex implements SingletonInterface
      */
     protected $eventDispatcher;
 
+    /**
+     * @var int
+     */
+    private $referenceUid = 0;
+
+    /**
+     * @var string
+     */
+    private $referenceTable = '';
+
     public function __construct(EventDispatcherInterface $eventDispatcher)
     {
         $this->eventDispatcher = $eventDispatcher;
@@ -106,6 +117,8 @@ public function __construct(EventDispatcherInterface $eventDispatcher)
      */
     public function findRef($table, $field, $uid, $content, $spKey, $spParams, $structurePath = '')
     {
+        $this->referenceUid = $uid;
+        $this->referenceTable = $table;
         $this->tokenID_basePrefix = $table . ':' . $uid . ':' . $field . ':' . $structurePath . ':' . $spKey;
         switch ($spKey) {
             case 'notify':
@@ -154,6 +167,8 @@ public function findRef($table, $field, $uid, $content, $spKey, $spParams, $stru
             default:
                 $retVal = false;
         }
+        $this->referenceUid = 0;
+        $this->referenceTable = '';
         return $retVal;
     }
 
@@ -453,7 +468,17 @@ public function getTypoLinkParts($typolinkValue)
             $linkData = $linkService->resolve($link_param);
             switch ($linkData['type']) {
                 case LinkService::TYPE_RECORD:
-                    $finalTagParts['table'] = $linkData['identifier'];
+                    $referencePageId = $this->referenceTable === 'pages'
+                        ? $this->referenceUid
+                        : (int)(BackendUtility::getRecord($this->referenceTable, $this->referenceUid)['pid'] ?? 0);
+                    if ($referencePageId) {
+                        $pageTsConfig = BackendUtility::getPagesTSconfig($referencePageId);
+                        $table = $pageTsConfig['TCEMAIN.']['linkHandler.'][$linkData['identifier'] . '.']['configuration.']['table'] ?? $linkData['identifier'];
+                    } else {
+                        // Backwards compatibility for the old behaviour, where the identifier was saved as the table.
+                        $table = $linkData['identifier'];
+                    }
+                    $finalTagParts['table'] = $table;
                     $finalTagParts['uid'] = $linkData['uid'];
                     break;
                 case LinkService::TYPE_PAGE: