|
14 | 14 | use HDNET\Calendarize\Service\PluginConfigurationService; |
15 | 15 | use HDNET\Calendarize\Utility\DateTimeUtility; |
16 | 16 | use Psr\Http\Message\ResponseInterface; |
| 17 | +use TYPO3\CMS\Core\Crypto\HashService; |
17 | 18 | use TYPO3\CMS\Core\Http\PropagateResponseException; |
18 | 19 | use TYPO3\CMS\Core\Type\ContextualFeedbackSeverity; |
19 | 20 | use TYPO3\CMS\Core\Utility\GeneralUtility; |
20 | 21 | use TYPO3\CMS\Extbase\Configuration\ConfigurationManagerInterface; |
21 | 22 | use TYPO3\CMS\Extbase\Mvc\Controller\ActionController; |
22 | 23 | use TYPO3\CMS\Extbase\Mvc\Controller\Arguments; |
23 | 24 | use TYPO3\CMS\Extbase\Mvc\RequestInterface; |
24 | | -use TYPO3\CMS\Extbase\Security\Cryptography\HashService; |
25 | 25 | use TYPO3\CMS\Frontend\Controller\ErrorController; |
26 | 26 | use TYPO3\CMS\Frontend\Page\PageAccessFailureReasons; |
27 | 27 |
|
@@ -125,7 +125,7 @@ protected function callActionMethod(RequestInterface $request): ResponseInterfac |
125 | 125 | if (isset($this->feedFormats[$request->getFormat()])) { |
126 | 126 | if ($request->hasArgument('hmac')) { |
127 | 127 | $hmac = $request->getArgument('hmac'); |
128 | | - if ($this->validatePluginHmac($hmac)) { |
| 128 | + if ($this->validatePluginHmac($hmac, $this->request->getControllerActionName())) { |
129 | 129 | $this->setHeadersAndExit( |
130 | 130 | $response, |
131 | 131 | $this->feedFormats[$request->getFormat()], |
@@ -194,7 +194,7 @@ protected function eventExtendedAssignMultiple(array $variables, string $classNa |
194 | 194 | { |
195 | 195 | // use this variable in your extension to add more custom variables |
196 | 196 | $variables['extended'] = []; |
197 | | - $variables['extended']['pluginHmac'] = $this->calculatePluginHmac(); |
| 197 | + $variables['extended']['pluginHmac'] = $this->calculatePluginHmac($this->request->getControllerActionName()); |
198 | 198 | $variables['settings'] = $this->settings; |
199 | 199 | $variables['contentObject'] = $this->request->getAttribute('currentContentObject')->data; |
200 | 200 |
|
@@ -223,7 +223,7 @@ protected function eventExtendedRedirect( |
223 | 223 | 'delay' => 0, |
224 | 224 | 'statusCode' => 301, |
225 | 225 | ]; |
226 | | - $variables['extended']['pluginHmac'] = $this->calculatePluginHmac(); |
| 226 | + $variables['extended']['pluginHmac'] = $this->calculatePluginHmac($this->request->getControllerActionName()); |
227 | 227 | $variables['settings'] = $this->settings; |
228 | 228 | } |
229 | 229 |
|
@@ -260,26 +260,36 @@ protected function getStringForPluginHmac(): string |
260 | 260 | * |
261 | 261 | * @see HashService::generateHmac |
262 | 262 | */ |
263 | | - protected function calculatePluginHmac(): string |
| 263 | + protected function calculatePluginHmac(string $context = 'default'): string |
264 | 264 | { |
| 265 | + /* Generate a secret that is unique per context */ |
| 266 | + $contentObject = $this->request->getAttribute('currentContentObject'); |
| 267 | + $uid = $contentObject ? (string)$contentObject->data['uid'] : '0'; |
| 268 | + $additionalSecret = $uid . $context; |
| 269 | + |
265 | 270 | $string = $this->getStringForPluginHmac(); |
266 | 271 |
|
267 | 272 | $hashService = GeneralUtility::makeInstance(HashService::class); |
268 | 273 |
|
269 | | - return $hashService->generateHmac($string); |
| 274 | + return $hashService->hmac($string, $additionalSecret); |
270 | 275 | } |
271 | 276 |
|
272 | 277 | /** |
273 | 278 | * @see HashService::validateHmac |
274 | 279 | */ |
275 | | - protected function validatePluginHmac(string $hmac): bool |
| 280 | + protected function validatePluginHmac(string $hmac, string $context = 'default'): bool |
276 | 281 | { |
| 282 | + /* Generate a secret that is unique per context */ |
| 283 | + $contentObject = $this->request->getAttribute('currentContentObject'); |
| 284 | + $uid = $contentObject ? (string)$contentObject->data['uid'] : '0'; |
| 285 | + $additionalSecret = $uid . $context; |
| 286 | + |
277 | 287 | $string = $this->getStringForPluginHmac(); |
278 | 288 |
|
279 | 289 | /** @var HashService $hashService */ |
280 | 290 | $hashService = GeneralUtility::makeInstance(HashService::class); |
281 | 291 |
|
282 | | - return $hashService->validateHmac($string, $hmac); |
| 292 | + return $hashService->validateHmac($string, $additionalSecret, $hmac); |
283 | 293 | } |
284 | 294 |
|
285 | 295 | /** |
|
0 commit comments