[SECURITY] Filter disallowed properties in form editor 62/57562/2
authorRalf Zimmermann <ralf.zimmermann@tritum.de>
Thu, 12 Jul 2018 09:36:23 +0000 (11:36 +0200)
committerOliver Hader <oliver.hader@typo3.org>
Thu, 12 Jul 2018 09:36:31 +0000 (11:36 +0200)
commit8203657f7e72aecb0c34e8166314501781f2fb11
tree5d3a6bfb6753c1f994e7060bc770975ceec635e7
parentf3445f96442000eeafba95ed7c6fda66efccb8da
[SECURITY] Filter disallowed properties in form editor

The form editor save and preview actions now check the submitted
form definition against configured possibilities within the form
editor setup.

Releases: master, 8.7
Resolves: #85044
Security-Commit: f4a1a09378ed286f3744d6a72f09bfa11a6ba87e
Security-Bulletin: TYPO3-CORE-SA-2018-003
Change-Id: Ibf6083ab98b9fe73effe217380f555892c9c6bb0
Reviewed-on: https://review.typo3.org/57562
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
45 files changed:
typo3/sysext/core/Documentation/Changelog/8.7.x/Important-85044-FilterDisallowedPropertiesInFormEditor.rst [new file with mode: 0644]
typo3/sysext/form/Classes/Controller/FormEditorController.php
typo3/sysext/form/Classes/Domain/Configuration/ArrayProcessing/ArrayProcessing.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/ArrayProcessing/ArrayProcessor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/ConfigurationService.php
typo3/sysext/form/Classes/Domain/Configuration/Exception/ArrayProcessorException.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/Exception/PropertyException.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/AbstractConverter.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/AddHmacDataConverter.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/AddHmacDataToFormElementPropertyConverter.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/AddHmacDataToPropertyCollectionElementConverter.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/ConverterDto.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/ConverterInterface.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/RemoveHmacDataConverter.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/AbstractValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/CollectionBasedValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/CreatableFormElementPropertiesValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/CreatablePropertyCollectionElementPropertiesValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/ElementBasedValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/FormElementHmacDataValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/PropertyCollectionElementHmacDataValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/ValidationDto.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/ValidatorInterface.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinitionConversionService.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinitionValidationService.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/AbstractExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/AdditionalElementPropertyPathsExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/ExtractorDto.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/ExtractorInterface.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/FormElement/IsCreatableFormElementExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/FormElement/MultiValuePropertiesExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/FormElement/PredefinedDefaultsExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/FormElement/PropertyPathsExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/PropertyCollectionElement/IsCreatablePropertyCollectionElementExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/PropertyCollectionElement/MultiValuePropertiesExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/PropertyCollectionElement/PredefinedDefaultsExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/PropertyCollectionElement/PropertyPathsExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Mvc/Property/TypeConverter/FormDefinitionArrayConverter.php
typo3/sysext/form/Tests/Unit/Controller/FormEditorControllerTest.php
typo3/sysext/form/Tests/Unit/Domain/Configuration/ConfigurationServiceTest.php
typo3/sysext/form/Tests/Unit/Domain/Configuration/FormDefinition/Validators/CreatableFormElementPropertiesValidatorTest.php [new file with mode: 0644]
typo3/sysext/form/Tests/Unit/Domain/Configuration/FormDefinition/Validators/CreatablePropertyCollectionElementPropertiesValidatorTest.php [new file with mode: 0644]
typo3/sysext/form/Tests/Unit/Domain/Configuration/FormDefinitionConversionServiceTest.php [new file with mode: 0644]
typo3/sysext/form/Tests/Unit/Domain/Configuration/FormDefinitionValidationServiceTest.php [new file with mode: 0644]
typo3/sysext/form/Tests/Unit/Mvc/Property/TypeConverter/FormDefinitionArrayConverterTest.php