Missing initialization of related and relatedFrom properties causes errors after security update

[philipp-leichtweis]

Version: 14.0.3
TYPO3 Version: 13.4

Description

After the recent security update, the related and relatedFrom properties in the News model are no longer properly initialized, which causes errors when extensions that extend the News model try to access these properties.

Error Message

Could not get value of property "GeorgRinger\News\Domain\Model\News::related",
make sure the property is either public or has a getter getRelated(),
a hasser hasRelated() or an isser isRelated().

Root Cause

In Classes/Domain/Model/News.php, the properties related and relatedFrom are declared (lines 82-88) but are not initialized in either:

• __construct() (line 176-184)
• initializeObject() (line 189-197)

Other ObjectStorage properties like categories, contentElements, relatedLinks, falMedia, falRelatedFiles, and tags are properly initialized in both methods, but related and relatedFrom are missing.

Steps to Reproduce

1. Install georgringer/news version 14.0.3
2. Install any extension that extends the News model (e.g., mediadreams/md_newsfrontend)
3. Try to access news records that have related news
4. Error occurs when trying to access the related property

Proposed Solution

Add initialization for related and relatedFrom in both __construct() and initializeObject() methods:

In __construct() (after line 178):

$this->related = new ObjectStorage();
$this->relatedFrom = new ObjectStorage();

In initializeObject() (after line 193):

$this->related ??= new ObjectStorage();
$this->relatedFrom ??= new ObjectStorage();

Patch

I've created a patch that fixes this issue:

--- a/Classes/Domain/Model/News.php
+++ b/Classes/Domain/Model/News.php
@@ -176,6 +176,8 @@ class News extends AbstractEntity
     public function __construct()
     {
         $this->categories = new ObjectStorage();
+        $this->related = new ObjectStorage();
+        $this->relatedFrom = new ObjectStorage();
         $this->contentElements = new ObjectStorage();
         $this->relatedLinks = new ObjectStorage();
         $this->falMedia = new ObjectStorage();
@@ -189,6 +191,8 @@ class News extends AbstractEntity
     public function initializeObject(): void
     {
         $this->categories ??= new ObjectStorage();
+        $this->related ??= new ObjectStorage();
+        $this->relatedFrom ??= new ObjectStorage();
         $this->contentElements ??= new ObjectStorage();
         $this->relatedLinks ??= new ObjectStorage();
         $this->falMedia ??= new ObjectStorage();

Workaround

Until this is fixed, users can apply the patch using cweagans/composer-patches:

1. Install composer require cweagans/composer-patches --dev
2. Create the patch file in patches/georgringer-news-fix-related-initialization.patch
3. Add to composer.json:

"extra": {
    "patches": {
        "georgringer/news": {
            "Fix missing initialization of related and relatedFrom properties": "patches/georgringer-news-fix-related-initialization.patch"
        }
    }
}