[SECURITY] Filter disallowed properties in form editor 48/57548/2
authorRalf Zimmermann <ralf.zimmermann@tritum.de>
Thu, 12 Jul 2018 09:32:45 +0000 (11:32 +0200)
committerOliver Hader <oliver.hader@typo3.org>
Thu, 12 Jul 2018 09:32:48 +0000 (11:32 +0200)
commitbca913e9d8da4b349c72203b9448c04fcb074f60
treef203f5fcbeacc2cd2a8fc14c42df07cea6061a89
parent71ff71477a466a9ca33025efbd6e19618f5ca91a
[SECURITY] Filter disallowed properties in form editor

The form editor save and preview actions now check the submitted
form definition against configured possibilities within the form
editor setup.

Releases: master, 8.7
Resolves: #85044
Security-Commit: bcf5957567fe680866303c0758c37b26afb2c58f
Security-Bulletin: TYPO3-CORE-SA-2018-003
Change-Id: Id3d260681419b992553c98a9a408280094191c27
Reviewed-on: https://review.typo3.org/57548
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
45 files changed:
typo3/sysext/core/Documentation/Changelog/8.7.x/Important-85044-FilterDisallowedPropertiesInFormEditor.rst [new file with mode: 0644]
typo3/sysext/form/Classes/Controller/FormEditorController.php
typo3/sysext/form/Classes/Domain/Configuration/ArrayProcessing/ArrayProcessing.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/ArrayProcessing/ArrayProcessor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/ConfigurationService.php
typo3/sysext/form/Classes/Domain/Configuration/Exception/ArrayProcessorException.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/Exception/PropertyException.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/AbstractConverter.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/AddHmacDataConverter.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/AddHmacDataToFormElementPropertyConverter.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/AddHmacDataToPropertyCollectionElementConverter.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/ConverterDto.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/ConverterInterface.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Converters/RemoveHmacDataConverter.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/AbstractValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/CollectionBasedValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/CreatableFormElementPropertiesValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/CreatablePropertyCollectionElementPropertiesValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/ElementBasedValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/FormElementHmacDataValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/PropertyCollectionElementHmacDataValidator.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/ValidationDto.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinition/Validators/ValidatorInterface.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinitionConversionService.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FormDefinitionValidationService.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/AbstractExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/AdditionalElementPropertyPathsExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/ExtractorDto.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/ExtractorInterface.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/FormElement/IsCreatableFormElementExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/FormElement/MultiValuePropertiesExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/FormElement/PredefinedDefaultsExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/FormElement/PropertyPathsExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/PropertyCollectionElement/IsCreatablePropertyCollectionElementExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/PropertyCollectionElement/MultiValuePropertiesExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/PropertyCollectionElement/PredefinedDefaultsExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Domain/Configuration/FrameworkConfiguration/Extractors/PropertyCollectionElement/PropertyPathsExtractor.php [new file with mode: 0644]
typo3/sysext/form/Classes/Mvc/Property/TypeConverter/FormDefinitionArrayConverter.php
typo3/sysext/form/Tests/Unit/Controller/FormEditorControllerTest.php
typo3/sysext/form/Tests/Unit/Domain/Configuration/ConfigurationServiceTest.php
typo3/sysext/form/Tests/Unit/Domain/Configuration/FormDefinition/Validators/CreatableFormElementPropertiesValidatorTest.php [new file with mode: 0644]
typo3/sysext/form/Tests/Unit/Domain/Configuration/FormDefinition/Validators/CreatablePropertyCollectionElementPropertiesValidatorTest.php [new file with mode: 0644]
typo3/sysext/form/Tests/Unit/Domain/Configuration/FormDefinitionConversionServiceTest.php [new file with mode: 0644]
typo3/sysext/form/Tests/Unit/Domain/Configuration/FormDefinitionValidationServiceTest.php [new file with mode: 0644]
typo3/sysext/form/Tests/Unit/Mvc/Property/TypeConverter/FormDefinitionArrayConverterTest.php