Skip to content

Commit bf09a76

Browse files
ayacooayacoo
authored
Merge pull request #45 from ayacoo/security/3
[SECURITY] Ensure only allowed users can view redirects
2 parents e95255f + c07761f commit bf09a76

6 files changed

Lines changed: 77 additions & 32 deletions

File tree

‎Classes/Form/Element/RedirectElement.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
namespace Ayacoo\RedirectTab\Form\Element;
55

66
use Ayacoo\RedirectTab\Service\RedirectDemandService;
7+
use Ayacoo\RedirectTab\UserFunctions\RedirectAccessDisplayCondition;
78
use Psr\Http\Message\UriInterface;
89
use TYPO3\CMS\Backend\Form\Element\AbstractFormElement;
910
use TYPO3\CMS\Backend\Routing\UriBuilder;
@@ -29,7 +30,9 @@ public function render(): array
2930

3031
$this->prepareView();
3132

33+
$redirectAccess = GeneralUtility::makeInstance(RedirectAccessDisplayCondition::class);
3234
$this->view->assignMultiple([
35+
'canEditRedirects' => $redirectAccess->canEditRedirects(),
3336
'redirects' => $redirectDemandService->getRedirects($currentPage),
3437
'demand' => $redirectDemandService->getDemand(),
3538
'pagination' => $redirectDemandService->preparePagination($redirectDemandService->getDemand()),

‎Classes/UserFunctions/RedirectAccessDisplayCondition.php‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace Ayacoo\RedirectTab\UserFunctions;
6+
7+
use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
8+
9+
class RedirectAccessDisplayCondition
10+
{
11+
private const TABLE_NAME = 'sys_redirect';
12+
13+
public function canListRedirects(): bool
14+
{
15+
return $this->getBackendUser()->isAdmin() || $this->getBackendUser()->check('tables_select', self::TABLE_NAME);
16+
}
17+
18+
public function canEditRedirects(): bool
19+
{
20+
return $this->getBackendUser()->isAdmin() || $this->getBackendUser()->check('tables_modify', self::TABLE_NAME);
21+
}
22+
23+
protected function getBackendUser(): BackendUserAuthentication
24+
{
25+
return $GLOBALS['BE_USER'];
26+
}
27+
}

‎Configuration/TCA/Overrides/pages.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?php
22

3+
use Ayacoo\RedirectTab\UserFunctions\RedirectAccessDisplayCondition;
34
use TYPO3\CMS\Core\Utility\ExtensionManagementUtility;
45

56
defined('TYPO3') || die();
@@ -8,6 +9,12 @@
89

910
$temporaryColumns = [
1011
'redirects' => [
12+
'displayCond' => [
13+
'AND' => [
14+
'REC:NEW:false',
15+
'USER:' . RedirectAccessDisplayCondition::class . '->canListRedirects',
16+
],
17+
],
1118
'exclude' => true,
1219
'label' => 'LLL:EXT:' . $extKey . '/Resources/Private/Language/locallang.xlf:redirect_list',
1320
'config' => [

‎Resources/Private/Templates/Backend/List.html‎

Lines changed: 38 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -50,36 +50,40 @@
5050

5151
<td>
5252
<div class="btn-group">
53-
<f:if condition="{redirect.is_regexp} || {redirect.source_host} === '*'">
53+
<f:if condition="{canEditRedirects}">
5454
<f:then>
55-
<span class="btn btn-default disabled"><core:icon identifier="empty-empty" /></span>
55+
<f:if condition="{redirect.is_regexp} || {redirect.source_host} === '*'">
56+
<f:then>
57+
<span class="btn btn-default disabled"><core:icon identifier="empty-empty" /></span>
58+
</f:then>
59+
<f:else>
60+
<f:link.external class="btn btn-default" uri="{redirect.source_host}{redirect.source_path}" target="_blank" title="{f:translate(key: 'LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:view_redirect')}">
61+
<core:icon identifier="actions-view-page" />
62+
</f:link.external>
63+
</f:else>
64+
</f:if>
65+
<f:if condition="{redirect.disabled} == 1">
66+
<f:then>
67+
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=0', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:unHide')}"><core:icon identifier="actions-edit-unhide" /></a>
68+
</f:then>
69+
<f:else>
70+
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=1', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:hide')}"><core:icon identifier="actions-edit-hide" /></a>
71+
</f:else>
72+
</f:if>
73+
<be:link.editRecord returnUrl="{returnUrl}" class="btn btn-default" table="sys_redirect" uid="{redirect.uid}" title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:edit')}">
74+
<core:icon identifier="actions-open" />
75+
</be:link.editRecord>
76+
<a class="btn btn-default t3js-modal-trigger"
77+
href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'cmd[sys_redirect][{redirect.uid}][delete]=1', currentUrlParameterName:'redirect')}"
78+
title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:delete')}"
79+
data-severity="warning"
80+
data-title="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:label.confirm.delete_record.title')}"
81+
data-bs-content="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:deleteWarning')}"
82+
data-button-close-text="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:buttons.confirm.delete_record.no')}">
83+
<core:icon identifier="actions-delete" />
84+
</a>
5685
</f:then>
57-
<f:else>
58-
<f:link.external class="btn btn-default" uri="{redirect.source_host}{redirect.source_path}" target="_blank" title="{f:translate(key: 'LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:view_redirect')}">
59-
<core:icon identifier="actions-view-page" />
60-
</f:link.external>
61-
</f:else>
6286
</f:if>
63-
<f:if condition="{redirect.disabled} == 1">
64-
<f:then>
65-
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=0', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:unHide')}"><core:icon identifier="actions-edit-unhide" /></a>
66-
</f:then>
67-
<f:else>
68-
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=1', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:hide')}"><core:icon identifier="actions-edit-hide" /></a>
69-
</f:else>
70-
</f:if>
71-
<be:link.editRecord returnUrl="{returnUrl}" class="btn btn-default" table="sys_redirect" uid="{redirect.uid}" title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:edit')}">
72-
<core:icon identifier="actions-open" />
73-
</be:link.editRecord>
74-
<a class="btn btn-default t3js-modal-trigger"
75-
href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'cmd[sys_redirect][{redirect.uid}][delete]=1', currentUrlParameterName:'redirect')}"
76-
title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:delete')}"
77-
data-severity="warning"
78-
data-title="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:label.confirm.delete_record.title')}"
79-
data-bs-content="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:deleteWarning')}"
80-
data-button-close-text="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:buttons.confirm.delete_record.no')}">
81-
<core:icon identifier="actions-delete" />
82-
</a>
8387
</div>
8488
</td>
8589
</tr>
@@ -92,9 +96,13 @@
9296
<f:else>
9397
<f:be.infobox state="-1" title="{f:translate(key: 'LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_not_found.title')}">
9498
<p><f:translate key="LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_not_found.message"/></p>
95-
<be:link.newRecord returnUrl="{returnUrl}" class="btn btn-primary" table="sys_redirect">
96-
<f:translate key="LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_create"/>
97-
</be:link.newRecord>
99+
<f:if condition="{canEditRedirects}">
100+
<f:then>
101+
<be:link.newRecord returnUrl="{returnUrl}" class="btn btn-primary" table="sys_redirect">
102+
<f:translate key="LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_create"/>
103+
</be:link.newRecord>
104+
</f:then>
105+
</f:if>
98106
</f:be.infobox>
99107
</f:else>
100108
</f:if>

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "ayacoo/redirect-tab",
33
"type": "typo3-cms-extension",
4-
"version": "3.1.6",
4+
"version": "3.1.7",
55
"description": "Show TYPO3 redirects in the page properties",
66
"authors": [
77
{

‎ext_emconf.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
'author_email' => 'info@ayacoo.de',
99
'state' => 'stable',
1010
'clearCacheOnLoad' => 0,
11-
'version' => '3.1.6',
11+
'version' => '3.1.7',
1212
'constraints' => [
1313
'depends' => [
1414
'typo3' => '12.4.42-12.9.99',

0 commit comments

Comments
 (0)