[BUGFIX] Ignore cHash when given but not needed 95/60895/5
authorBenni Mack <benni@typo3.org>
Fri, 7 Jun 2019 07:29:11 +0000 (09:29 +0200)
committerGeorg Ringer <georg.ringer@gmail.com>
Sat, 8 Jun 2019 04:07:50 +0000 (06:07 +0200)
commitf070cd9b851498dc767875e5a9a47f80e59de397
tree0e66004305b519e3c002989dbfda0ce373c63dee
parent15e264de2a1db148e6bffa81f1e78ddb8abdf0e5
[BUGFIX] Ignore cHash when given but not needed

If a cHash GET parameter is given, but there
are no GET parameters that are relevant, a
hash_calc() call against an empty string is done.

However, the change now allows an invalid
cHash if no check is necessary. This could
happen when upgrading from older instances
where a cHash is not needed anymore.

Bots would not then fill up the error log
but get the new page (with a valid 200 result)

Resolves: #41033
Releases: master, 9.5
Change-Id: Id02701fcbece371a6b9ce0f92fe0be55dd972325
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60895
Tested-by: Andreas Fernandez <a.fernandez@scripting-base.de>
Tested-by: TYPO3com <noreply@typo3.com>
Tested-by: Georg Ringer <georg.ringer@gmail.com>
Reviewed-by: Andreas Fernandez <a.fernandez@scripting-base.de>
Reviewed-by: Georg Ringer <georg.ringer@gmail.com>
typo3/sysext/frontend/Classes/Middleware/PageArgumentValidator.php
typo3/sysext/frontend/Tests/Unit/Middleware/PageArgumentValidatorTest.php [new file with mode: 0644]