[BUGFIX] Access check for delete pages expects array of integers 42/51342/4
authorMona Muzaffar <mona.muzaffar@gmx.de>
Wed, 18 Jan 2017 13:42:56 +0000 (14:42 +0100)
committerChristian Kuhn <lolli@schwarzbu.ch>
Thu, 26 Jan 2017 12:09:00 +0000 (13:09 +0100)
An error occurs in the createNamedParameter function
which expects an array but gets a string instead.

Change-Id: I393a6a87c912129ded28f677ca65c081fc4205e7
Resolves: #79309
Releases: master
Reviewed-on: https://review.typo3.org/51342
Tested-by: TYPO3com <no-reply@typo3.com>
Reviewed-by: Anja Leichsenring <aleichsenring@ab-softlab.de>
Tested-by: Anja Leichsenring <aleichsenring@ab-softlab.de>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
typo3/sysext/core/Classes/DataHandling/DataHandler.php

index de95dab..563c2fd 100644 (file)
@@ -8074,7 +8074,12 @@ class DataHandler
      */
     public function noRecordsFromUnallowedTables($inList)
     {
-        $inList = trim($this->rmComma(trim($inList)));
+        if (strpos($inList, ',') !== false) {
+            $pids = GeneralUtility::intExplode(',', $inList, true);
+        } else {
+            $inList = trim($this->rmComma(trim($inList)));
+            $pids = [$inList];
+        }
         if ($inList && !$this->admin) {
             foreach ($GLOBALS['TCA'] as $table => $_) {
                 $query = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable($table);
@@ -8085,7 +8090,7 @@ class DataHandler
                     ->from($table)
                     ->where($query->expr()->in(
                         'pid',
-                        $query->createNamedParameter($inList, Connection::PARAM_INT_ARRAY)
+                        $query->createNamedParameter($pids, Connection::PARAM_INT_ARRAY)
                     ))
                     ->execute()
                     ->fetchColumn(0);