TYPO3 Forge: Issues http://forge.typo3.org/ http://forge.typo3.org/themes/TYPO3/favicon/favicon.png 2018-09-04T14:45:58Z TYPO3 Forge Redmine TYPO3 Core - Bug #86147 (Under Review): Prevent updating unchanged fields in DataMapProcessor http://forge.typo3.org/issues/86147 2018-09-04T14:45:58Z Nicole Cordes typo3@cordes.co <p>Given:</p> <p>- a table with some additional IRRE relations and fields with TCA configuration ['behaviour']['allowLanguageSynchronization'] enabled<br />- open a record from the given table<br />- save it without any changes</p> <p>Expected:</p> <p>- saving an untouched record should not update any other record as nothing has changed</p> <p>Actual:</p> <p>- related records are updated even without any changes<br />- fetching related records recursively (parents, siblings, relations) takes very long and may result in a "maximum execution time" error</p> TYPO3 Core - Task #86141 (Under Review): Remove superfluous database contraint in DataMapProcessor http://forge.typo3.org/issues/86141 2018-09-04T12:24:29Z Nicole Cordes typo3@cordes.co <p>The database query to fetch dependent elements in \TYPO3\CMS\Core\DataHandling\Localization\DataMapProcessor::fetchDependentElements uses an <abbr title="">IN</abbr> constraint as well as an gt() (greater than) constraint. Having the <abbr title="">IN</abbr> constraint is sufficient and the gt() constraint should be superfluous.</p> <p>Removing the gt() constraint reveals some more flaws as the API returns 0 id as ancestor id. This has to be fixed as well to prevent wrong elements.</p> TYPO3 Core - Bug #85061 (Under Review): Extbase doesn't overlay workspace records http://forge.typo3.org/issues/85061 2018-05-22T10:25:56Z Nicole Cordes typo3@cordes.co <p>Given:<br />An Extbase-Repository and a database table that is capable of workspaces.</p> <p>Expected:<br />When fetching records of the database table with any repository function, will return the correctly overlaid row in a workspace.</p> <p>Actual:<br />No overlaid row is returned.</p> TYPO3 Core - Bug #22348 (New): Security problem with flexforms, especially extbase and overriding... http://forge.typo3.org/issues/22348 2010-03-29T19:50:40Z Georg Ringer <p>Description:<br />-----------------<br />A user can save anything in the flexform field by using e.g. firebug and<br />modifiying the name-attribute of the fields. Extbase is configured to<br />merge flexform and typoscript settings automatically and further more it<br />uses specific keywords to set e.g. the used templates.</p> <p>For example: Any textarea / input field can be changed to save data into<br />the field "view.templateRootPath" which is then used as template path.</p> <p>Problem:<br />----------------<br />If a user has the rights to create html files or maybe the right to<br />upload files to a specific folder in fileadmin/, he can change the<br />template of any extbase extension he has access to.</p> <p>Problem with pibase:<br />----------------<br />As there is no speficic keyword for the pibase extension it is not that<br />easy there. Of course if an extension merges every flexform setting with<br />the TS settings itself, the same problem occurs.</p> <p>Possible Solution:<br />----------------<br />I don't know if the proposed solution is the correct one but IMO before<br />the record is saved/updated, it needs to be checked if every flexform<br />field is existing in the flexform file.</p> <p>IMO there is at least one problem: If the flexform file is extended by<br />the extension author, old and unsed sections remain in the database<br />because everything is merged there.</p> <p>(issue imported from #M13955)</p>