[SECURITY] Respect permissions of storages in a file collection 98/53898/2
authorGeorg Ringer <georg.ringer@gmail.com>
Tue, 5 Sep 2017 09:36:54 +0000 (11:36 +0200)
committerOliver Hader <oliver.hader@typo3.org>
Tue, 5 Sep 2017 09:36:55 +0000 (11:36 +0200)
commitc7769dbe60d1e9e5c78da4656abdf540d258312d
tree33ef187cde8594bd81077f2dda4db226b69bb294
parent41297d168aedbdccbf822e75befc6f3e43e9ddce
[SECURITY] Respect permissions of storages in a file collection

If a user creates a sys_file_collection record, only those
storage records must be shown which are allowed for the
user.

Resolves: #82029
Releases: master, 8.7, 7.6
Security-Commit: 2592124689d6625e394a2f63ca1a12510c402609
Security-Bulletin: TYPO3-CORE-SA-2017-005
Change-Id: Idf5b79d6939f54edeb20a432ea41e9341e970bc5
Reviewed-on: https://review.typo3.org/53898
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
typo3/sysext/backend/Classes/Form/FormDataProvider/AbstractItemProvider.php
typo3/sysext/backend/Classes/Form/FormDataProvider/TcaSelectItems.php
typo3/sysext/core/Classes/Resource/Service/UserFileMountService.php