Skip to content

Commit f025175

Browse files
ayacooayacoo
authored
Merge pull request #46 from ayacoo/security/4
[SECURITY] Ensure only allowed users can view redirects
2 parents d0f248f + 085f4cb commit f025175

6 files changed

Lines changed: 78 additions & 20 deletions

File tree

‎Classes/Form/Element/RedirectElement.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
namespace Ayacoo\RedirectTab\Form\Element;
66

77
use Ayacoo\RedirectTab\Service\RedirectDemandService;
8+
use Ayacoo\RedirectTab\UserFunctions\RedirectAccessDisplayCondition;
89
use Psr\Http\Message\UriInterface;
910
use TYPO3\CMS\Backend\Form\Element\AbstractFormElement;
1011
use TYPO3\CMS\Backend\Routing\UriBuilder;
@@ -30,7 +31,9 @@ public function render(): array
3031

3132
$this->prepareView();
3233

34+
$redirectAccess = GeneralUtility::makeInstance(RedirectAccessDisplayCondition::class);
3335
$this->view->assignMultiple([
36+
'canEditRedirects' => $redirectAccess->canEditRedirects(),
3437
'redirects' => $redirectDemandService->getRedirects((int)$currentPage),
3538
'demand' => $redirectDemandService->getDemand(),
3639
'pagination' => $redirectDemandService->preparePagination($redirectDemandService->getDemand()),

‎Classes/UserFunctions/RedirectAccessDisplayCondition.php‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace Ayacoo\RedirectTab\UserFunctions;
6+
7+
use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
8+
9+
class RedirectAccessDisplayCondition
10+
{
11+
private const TABLE_NAME = 'sys_redirect';
12+
13+
public function canListRedirects(): bool
14+
{
15+
return $this->getBackendUser()->isAdmin() || $this->getBackendUser()->check('tables_select', self::TABLE_NAME);
16+
}
17+
18+
public function canEditRedirects(): bool
19+
{
20+
return $this->getBackendUser()->isAdmin() || $this->getBackendUser()->check('tables_modify', self::TABLE_NAME);
21+
}
22+
23+
protected function getBackendUser(): BackendUserAuthentication
24+
{
25+
return $GLOBALS['BE_USER'];
26+
}
27+
}

‎Configuration/TCA/Overrides/pages.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?php
22

3+
use Ayacoo\RedirectTab\UserFunctions\RedirectAccessDisplayCondition;
34
use TYPO3\CMS\Core\Utility\ExtensionManagementUtility;
45

56
defined('TYPO3') || die();
@@ -10,6 +11,7 @@
1011
'displayCond' => [
1112
'AND' => [
1213
'REC:NEW:false',
14+
'USER:' . RedirectAccessDisplayCondition::class . '->canListRedirects',
1315
],
1416
],
1517
'exclude' => true,

‎Resources/Private/Templates/Backend/List.html‎

Lines changed: 44 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -64,26 +64,48 @@
6464
</f:link.external>
6565
</f:else>
6666
</f:if>
67-
<f:if condition="{redirect.disabled} == 1">
67+
<f:if condition="{canEditRedirects}">
6868
<f:then>
69-
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=0', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:unHide')}"><core:icon identifier="actions-edit-unhide" /></a>
69+
<f:if condition="{redirect.disabled} == 1">
70+
<f:then>
71+
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=0', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:unHide')}"><core:icon identifier="actions-edit-unhide" /></a>
72+
</f:then>
73+
<f:else>
74+
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=1', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:hide')}"><core:icon identifier="actions-edit-hide" /></a>
75+
</f:else>
76+
</f:if>
7077
</f:then>
7178
<f:else>
72-
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=1', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:hide')}"><core:icon identifier="actions-edit-hide" /></a>
79+
<span class="btn btn-default disabled"><core:icon identifier="empty-empty" /></span>
80+
</f:else>
81+
</f:if>
82+
83+
<f:if condition="{canEditRedirects}">
84+
<f:then>
85+
<be:link.editRecord returnUrl="{returnUrl}" class="btn btn-default" table="sys_redirect" uid="{redirect.uid}" title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:edit')}">
86+
<core:icon identifier="actions-open" />
87+
</be:link.editRecord>
88+
</f:then>
89+
<f:else>
90+
<span class="btn btn-default disabled"><core:icon identifier="empty-empty" /></span>
91+
</f:else>
92+
</f:if>
93+
<f:if condition="{canEditRedirects}">
94+
<f:then>
95+
<a class="btn btn-default t3js-modal-trigger"
96+
href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'cmd[sys_redirect][{redirect.uid}][delete]=1', currentUrlParameterName:'redirect')}"
97+
title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:delete')}"
98+
data-severity="warning"
99+
data-title="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:label.confirm.delete_record.title')}"
100+
data-bs-content="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:deleteWarning')}"
101+
data-button-close-text="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:buttons.confirm.delete_record.no')}">
102+
<core:icon identifier="actions-delete" />
103+
</a>
104+
</f:then>
105+
<f:else>
106+
<span class="btn btn-default disabled"><core:icon identifier="empty-empty" /></span>
73107
</f:else>
74108
</f:if>
75-
<be:link.editRecord returnUrl="{returnUrl}" class="btn btn-default" table="sys_redirect" uid="{redirect.uid}" title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:edit')}">
76-
<core:icon identifier="actions-open" />
77-
</be:link.editRecord>
78-
<a class="btn btn-default t3js-modal-trigger"
79-
href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'cmd[sys_redirect][{redirect.uid}][delete]=1', currentUrlParameterName:'redirect')}"
80-
title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:delete')}"
81-
data-severity="warning"
82-
data-title="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:label.confirm.delete_record.title')}"
83-
data-bs-content="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:deleteWarning')}"
84-
data-button-close-text="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:buttons.confirm.delete_record.no')}">
85-
<core:icon identifier="actions-delete" />
86-
</a>
87109
</div>
88110
</td>
89111
</tr>
@@ -96,9 +118,13 @@
96118
<f:else>
97119
<f:be.infobox state="-1" title="{f:translate(key: 'LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_not_found.title')}">
98120
<p><f:translate key="LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_not_found.message"/></p>
99-
<be:link.newRecord returnUrl="{returnUrl}" class="btn btn-primary" table="sys_redirect">
100-
<f:translate key="LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_create"/>
101-
</be:link.newRecord>
121+
<f:if condition="{canEditRedirects}">
122+
<f:then>
123+
<be:link.newRecord returnUrl="{returnUrl}" class="btn btn-primary" table="sys_redirect">
124+
<f:translate key="LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_create"/>
125+
</be:link.newRecord>
126+
</f:then>
127+
</f:if>
102128
</f:be.infobox>
103129
</f:else>
104130
</f:if>

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "ayacoo/redirect-tab",
33
"type": "typo3-cms-extension",
4-
"version": "4.0.4",
4+
"version": "4.0.5",
55
"description": "Show TYPO3 redirects in the page properties",
66
"authors": [
77
{

‎ext_emconf.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
'author_email' => 'info@ayacoo.de',
99
'state' => 'stable',
1010
'clearCacheOnLoad' => 0,
11-
'version' => '4.0.4',
11+
'version' => '4.0.5',
1212
'constraints' => [
1313
'depends' => [
1414
'typo3' => '13.4.24-13.4.99',

0 commit comments

Comments
 (0)