[SECURITY] Respect permissions of storages in a file collection 02/53902/2
authorGeorg Ringer <georg.ringer@gmail.com>
Tue, 5 Sep 2017 09:37:22 +0000 (11:37 +0200)
committerOliver Hader <oliver.hader@typo3.org>
Tue, 5 Sep 2017 09:37:24 +0000 (11:37 +0200)
commit1857c1986b66563ca579b5fd63cf66fad25c6a0f
tree59d81fc4379d627612909e4a4ea0e01db6f56dea
parentfe31e60dcb9849c57d860d78430dfd1e723722d4
[SECURITY] Respect permissions of storages in a file collection

If a user creates a sys_file_collection record, only those
storage records must be shown which are allowed for the
user.

Resolves: #82029
Releases: master, 8.7, 7.6
Security-Commit: 45cdfccd52a224d8128e537214606848c717d8e7
Security-Bulletin: TYPO3-CORE-SA-2017-005
Change-Id: Iee94cd84f07ee0dc0730fe1ce84d228dad2f75a2
Reviewed-on: https://review.typo3.org/53902
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
typo3/sysext/backend/Classes/Form/FormDataProvider/AbstractItemProvider.php
typo3/sysext/backend/Classes/Form/FormDataProvider/TcaSelectItems.php
typo3/sysext/core/Classes/Resource/Service/UserFileMountService.php