Skip to content

[SECURITY] Ensure only allowed users can view redirects #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ayacoo merged 2 commits into from
Mar 16, 2026
Merged

[SECURITY] Ensure only allowed users can view redirects #46

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
160def0
[SECURITY] Ensure only allowed users can view redirects
ayacoo Mar 16, 2026
085f4cb
[SECURITY] Ensure only allowed users can view redirects
ayacoo Mar 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions Classes/Form/Element/RedirectElement.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
namespace Ayacoo\RedirectTab\Form\Element;

use Ayacoo\RedirectTab\Service\RedirectDemandService;
use Ayacoo\RedirectTab\UserFunctions\RedirectAccessDisplayCondition;
use Psr\Http\Message\UriInterface;
use TYPO3\CMS\Backend\Form\Element\AbstractFormElement;
use TYPO3\CMS\Backend\Routing\UriBuilder;
Expand All @@ -30,7 +31,9 @@ public function render(): array

$this->prepareView();

$redirectAccess = GeneralUtility::makeInstance(RedirectAccessDisplayCondition::class);
$this->view->assignMultiple([
'canEditRedirects' => $redirectAccess->canEditRedirects(),
'redirects' => $redirectDemandService->getRedirects((int)$currentPage),
'demand' => $redirectDemandService->getDemand(),
'pagination' => $redirectDemandService->preparePagination($redirectDemandService->getDemand()),
Expand Down
27 changes: 27 additions & 0 deletions Classes/UserFunctions/RedirectAccessDisplayCondition.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
<?php

declare(strict_types=1);

namespace Ayacoo\RedirectTab\UserFunctions;

use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;

class RedirectAccessDisplayCondition
{
private const TABLE_NAME = 'sys_redirect';

public function canListRedirects(): bool
{
return $this->getBackendUser()->isAdmin() || $this->getBackendUser()->check('tables_select', self::TABLE_NAME);
}

public function canEditRedirects(): bool
{
return $this->getBackendUser()->isAdmin() || $this->getBackendUser()->check('tables_modify', self::TABLE_NAME);
}

protected function getBackendUser(): BackendUserAuthentication
{
return $GLOBALS['BE_USER'];
}
}
2 changes: 2 additions & 0 deletions Configuration/TCA/Overrides/pages.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
<?php

use Ayacoo\RedirectTab\UserFunctions\RedirectAccessDisplayCondition;
use TYPO3\CMS\Core\Utility\ExtensionManagementUtility;

defined('TYPO3') || die();
Expand All @@ -10,6 +11,7 @@
'displayCond' => [
'AND' => [
'REC:NEW:false',
'USER:' . RedirectAccessDisplayCondition::class . '->canListRedirects',
],
],
'exclude' => true,
Expand Down
62 changes: 44 additions & 18 deletions Resources/Private/Templates/Backend/List.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,26 +64,48 @@
</f:link.external>
</f:else>
</f:if>
<f:if condition="{redirect.disabled} == 1">
<f:if condition="{canEditRedirects}">
<f:then>
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=0', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:unHide')}"><core:icon identifier="actions-edit-unhide" /></a>
<f:if condition="{redirect.disabled} == 1">
<f:then>
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=0', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:unHide')}"><core:icon identifier="actions-edit-unhide" /></a>
</f:then>
<f:else>
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=1', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:hide')}"><core:icon identifier="actions-edit-hide" /></a>
</f:else>
</f:if>
</f:then>
<f:else>
<a class="btn btn-default" href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'data[sys_redirect][{redirect.uid}][disabled]=1', currentUrlParameterName:'redirect')}" title="{f:translate(key:'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:hide')}"><core:icon identifier="actions-edit-hide" /></a>
<span class="btn btn-default disabled"><core:icon identifier="empty-empty" /></span>
</f:else>
</f:if>

<f:if condition="{canEditRedirects}">
<f:then>
<be:link.editRecord returnUrl="{returnUrl}" class="btn btn-default" table="sys_redirect" uid="{redirect.uid}" title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:edit')}">
<core:icon identifier="actions-open" />
</be:link.editRecord>
</f:then>
<f:else>
<span class="btn btn-default disabled"><core:icon identifier="empty-empty" /></span>
</f:else>
</f:if>
<f:if condition="{canEditRedirects}">
<f:then>
<a class="btn btn-default t3js-modal-trigger"
href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'cmd[sys_redirect][{redirect.uid}][delete]=1', currentUrlParameterName:'redirect')}"
title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:delete')}"
data-severity="warning"
data-title="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:label.confirm.delete_record.title')}"
data-bs-content="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:deleteWarning')}"
data-button-close-text="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:buttons.confirm.delete_record.no')}">
<core:icon identifier="actions-delete" />
</a>
</f:then>
<f:else>
<span class="btn btn-default disabled"><core:icon identifier="empty-empty" /></span>
</f:else>
</f:if>
<be:link.editRecord returnUrl="{returnUrl}" class="btn btn-default" table="sys_redirect" uid="{redirect.uid}" title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:edit')}">
<core:icon identifier="actions-open" />
</be:link.editRecord>
<a class="btn btn-default t3js-modal-trigger"
href="{be:moduleLink(route:'tce_db', arguments:'{redirect: returnUrl}', query:'cmd[sys_redirect][{redirect.uid}][delete]=1', currentUrlParameterName:'redirect')}"
title="{f:translate(key: 'LLL:EXT:core/Resources/Private/Language/locallang_mod_web_list.xlf:delete')}"
data-severity="warning"
data-title="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:label.confirm.delete_record.title')}"
data-bs-content="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:deleteWarning')}"
data-button-close-text="{f:translate(key: 'LLL:EXT:backend/Resources/Private/Language/locallang_alt_doc.xlf:buttons.confirm.delete_record.no')}">
<core:icon identifier="actions-delete" />
</a>
</div>
</td>
</tr>
Expand All @@ -96,9 +118,13 @@
<f:else>
<f:be.infobox state="-1" title="{f:translate(key: 'LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_not_found.title')}">
<p><f:translate key="LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_not_found.message"/></p>
<be:link.newRecord returnUrl="{returnUrl}" class="btn btn-primary" table="sys_redirect">
<f:translate key="LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_create"/>
</be:link.newRecord>
<f:if condition="{canEditRedirects}">
<f:then>
<be:link.newRecord returnUrl="{returnUrl}" class="btn btn-primary" table="sys_redirect">
<f:translate key="LLL:EXT:redirects/Resources/Private/Language/locallang_module_redirect.xlf:redirect_create"/>
</be:link.newRecord>
</f:then>
</f:if>
</f:be.infobox>
</f:else>
</f:if>
Expand Down
2 changes: 1 addition & 1 deletion composer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "ayacoo/redirect-tab",
"type": "typo3-cms-extension",
"version": "4.0.4",
"version": "4.0.5",
"description": "Show TYPO3 redirects in the page properties",
"authors": [
{
Expand Down
2 changes: 1 addition & 1 deletion ext_emconf.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
'author_email' => '[email protected]',
'state' => 'stable',
'clearCacheOnLoad' => 0,
'version' => '4.0.4',
'version' => '4.0.5',
'constraints' => [
'depends' => [
'typo3' => '13.4.24-13.4.99',
Expand Down
Loading