FrontendLoginController.php

Go to the documentation of this file.

<?php
 
/*
 * This file is part of the TYPO3 CMS project.
 *
 * It is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License, either version 2
 * of the License, or any later version.
 *
 * For the full copyright and license information, please read the
 * LICENSE.txt file that was distributed with this source code.
 *
 * The TYPO3 project - inspiring people to share!
 */
 
namespace ‪TYPO3\CMS\Felogin\Controller;
 
use Symfony\Component\Mime\Address;
use ‪TYPO3\CMS\Core\Authentication\LoginType;
use ‪TYPO3\CMS\Core\Configuration\Features;
use ‪TYPO3\CMS\Core\Context\Context;
use ‪TYPO3\CMS\Core\Crypto\PasswordHashing\PasswordHashFactory;
use ‪TYPO3\CMS\Core\Crypto\Random;
use ‪TYPO3\CMS\Core\Database\Connection;
use ‪TYPO3\CMS\Core\Database\ConnectionPool;
use ‪TYPO3\CMS\Core\Database\Query\Restriction\FrontendRestrictionContainer;
use ‪TYPO3\CMS\Core\Mail\MailMessage;
use ‪TYPO3\CMS\Core\Session\SessionManager;
use ‪TYPO3\CMS\Core\Site\SiteFinder;
use ‪TYPO3\CMS\Core\Utility\ArrayUtility;
use ‪TYPO3\CMS\Core\Utility\GeneralUtility;
use ‪TYPO3\CMS\Core\Utility\HttpUtility;
use ‪TYPO3\CMS\Core\Utility\MailUtility;
use ‪TYPO3\CMS\Frontend\Authentication\FrontendUserAuthentication;
use ‪TYPO3\CMS\Frontend\Plugin\AbstractPlugin;
use ‪TYPO3\CMS\FrontendLogin\Validation\RedirectUrlValidator;
 
class ‪FrontendLoginController extends ‪AbstractPlugin
{
    public ‪$prefixId = 'tx_felogin_pi1';
 
    public ‪$extKey = 'felogin';
 
    protected ‪$userIsLoggedIn;
 
    protected ‪$template;
 
    protected ‪$redirectUrl = '';
 
    protected ‪$noRedirect = false;
 
    protected ‪$logintype;
 
    public ‪$referer;
 
    protected ‪$urlValidator;
 
    public function ‪main($content, ‪$conf)
    {
        trigger_error(
            'The pibase felogin plugin is deprecated since TYPO3 10.4 and will be removed in version 11.0',
            E_USER_DEPRECATED
        );
        $this->urlValidator = GeneralUtility::makeInstance(
            RedirectUrlValidator::class,
            GeneralUtility::makeInstance(SiteFinder::class)
        );
 
        // Loading TypoScript array into object variable:
        $this->conf = ‪$conf;
        // Loading default pivars
        $this->‪pi_setPiVarDefaults();
        // Loading language-labels
        $this->‪pi_loadLL('EXT:felogin/Resources/Private/Language/locallang.xlf');
        // Init FlexForm configuration for plugin:
        $this->‪pi_initPIflexForm();
        $this->‪mergeflexFormValuesIntoConf();
        // GPvars:
        $this->logintype = GeneralUtility::_GP('logintype');
 
        if ($this->urlValidator->isValid((string)GeneralUtility::_GP('referer'))) {
            $this->referer = GeneralUtility::_GP('referer');
        } else {
            $this->referer = '';
        }
        $this->noRedirect = $this->piVars['noredirect'] || $this->conf['redirectDisable'];
        // If config.typolinkLinkAccessRestrictedPages is set, the var is return_url
        $this->redirectUrl = GeneralUtility::_GP('return_url') ?: (string)GeneralUtility::_GP('redirect_url');
        $this->redirectUrl = $this->urlValidator->isValid($this->redirectUrl) ? $this->redirectUrl : '';
        // Get Template
        $templateFile = $this->conf['templateFile'] ?: 'EXT:felogin/Resources/Private/Templates/FrontendLogin.html';
        ‪$template = GeneralUtility::getFileAbsFileName($templateFile);
        if (‪$template !== '' && file_exists(‪$template)) {
            $this->template = file_get_contents(‪$template);
        }
        // Is user logged in?
        $this->userIsLoggedIn = GeneralUtility::makeInstance(Context::class)->getPropertyFromAspect('frontend.user', 'isLoggedIn');
        // Redirect
        if ($this->conf['redirectMode'] && !$this->conf['redirectDisable'] && !$this->noRedirect) {
            ‪$redirectUrl = $this->‪processRedirect();
            if (!empty(‪$redirectUrl)) {
                $this->redirectUrl = $this->conf['redirectFirstMethod'] ? array_shift(‪$redirectUrl) : array_pop(‪$redirectUrl);
            } else {
                $this->redirectUrl = '';
            }
        }
        // What to display
        $content = '';
        if ($this->piVars['forgot'] && $this->conf['showForgotPasswordLink']) {
            $content .= $this->‪showForgot();
        } elseif ($this->piVars['forgothash']) {
            $content .= $this->‪changePassword();
        } else {
            if ($this->userIsLoggedIn && !$this->logintype) {
                $content .= $this->‪showLogout();
            } else {
                $content .= $this->‪showLogin();
            }
        }
        // Process the redirect
        if (
            $this->redirectUrl
            && !$this->noRedirect
            && (
                ($this->logintype === ‪LoginType::LOGIN && $this->userIsLoggedIn)
                || $this->logintype === ‪LoginType::LOGOUT
            )
        ) {
            if (!$this->frontendController->fe_user->isCookieSet() && $this->userIsLoggedIn) {
                $content .= $this->cObj->stdWrap($this->‪pi_getLL('cookie_warning'), $this->conf['cookieWarning_stdWrap.']);
            } else {
                // Add hook for extra processing before redirect
                $_params = [
                    'loginType' => ‪$this->logintype,
                    'redirectUrl' => &‪$this->redirectUrl
                ];
                foreach (‪$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['felogin']['beforeRedirect'] ?? [] as $_funcRef) {
                    if ($_funcRef) {
                        trigger_error(
                            sprintf(
                                'Hook "%s" got called by "%s" which is deprecated since TYPO3 10.4 and will be removed in version 11.0',
                                '$GLOBALS[\'TYPO3_CONF_VARS\'][\'EXTCONF\'][\'felogin\'][\'beforeRedirect\']',
                                $_funcRef
                            ),
                            E_USER_DEPRECATED
                        );
                        $ref = $this; // introduced for phpstan to not lose type information when passing $this into callUserFunction
                        GeneralUtility::callUserFunction($_funcRef, $_params, $ref);
                    }
                }
                ‪HttpUtility::redirect($this->redirectUrl);
            }
        }
        // Adds hook for processing of extra item markers / special
        foreach (‪$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['felogin']['postProcContent'] ?? [] as $_funcRef) {
            trigger_error(
                sprintf(
                    'Hook "%s" got called by "%s" which is deprecated since TYPO3 10.4 and will be removed in version 11.0',
                    '$GLOBALS[\'TYPO3_CONF_VARS\'][\'EXTCONF\'][\'felogin\'][\'postProcContent\']',
                    $_funcRef
                ),
                E_USER_DEPRECATED
            );
            $_params = [
                'content' => $content
            ];
            $ref = $this; // introduced for phpstan to not lose type information when passing $this into callUserFunction
            $content = GeneralUtility::callUserFunction($_funcRef, $_params, $ref);
        }
        return $this->conf['wrapContentInBaseClass'] ? $this->‪pi_wrapInBaseClass($content) : $content;
    }
 
    protected function ‪showForgot()
    {
        $markerArray = [];
        $subpart = $this->templateService->getSubpart($this->template, '###TEMPLATE_FORGOT###');
        $subpartArray = ($linkpartArray = []);
        $postData = GeneralUtility::_POST($this->prefixId);
        if ($postData['forgot_email']) {
            // Get hashes for compare
            $postedHash = $postData['forgot_hash'];
            $hashData = $this->frontendController->fe_user->getKey('ses', 'forgot_hash');
            if ($postedHash === $hashData['forgot_hash']) {
                $userTable = $this->frontendController->fe_user->user_table;
                $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable($userTable);
                $queryBuilder->setRestrictions(GeneralUtility::makeInstance(FrontendRestrictionContainer::class));
                $row = $queryBuilder
                    ->select('*')
                    ->from($userTable)
                    ->where(
                        $queryBuilder->expr()->orX(
                            $queryBuilder->expr()->eq(
                                'email',
                                $queryBuilder->createNamedParameter($this->piVars['forgot_email'], \PDO::PARAM_STR)
                            ),
                            $queryBuilder->expr()->eq(
                                'username',
                                $queryBuilder->createNamedParameter($this->piVars['forgot_email'], \PDO::PARAM_STR)
                            )
                        ),
                        $queryBuilder->expr()->in(
                            'pid',
                            $queryBuilder->createNamedParameter(
                                ‪GeneralUtility::intExplode(',', $this->getStorageFolders()),
                                Connection::PARAM_INT_ARRAY
                            )
                        )
                    )
                    ->execute()
                    ->fetch();
 
                $error = null;
                if ($row) {
                    // Generate an email with the hashed link
                    $error = $this->‪generateAndSendHash($row);
                } elseif ($this->conf['exposeNonexistentUserInForgotPasswordDialog']) {
                    $error = $this->‪pi_getLL('forgot_reset_message_error');
                }
                // Generate message
                if ($error) {
                    $markerArray['###STATUS_MESSAGE###'] = $this->cObj->stdWrap($error, $this->conf['forgotErrorMessage_stdWrap.']);
                } else {
                    $markerArray['###STATUS_MESSAGE###'] = $this->cObj->stdWrap(
                        $this->‪pi_getLL('forgot_reset_message_emailSent'),
                        $this->conf['forgotResetMessageEmailSentMessage_stdWrap.']
                    );
                }
                $subpartArray['###FORGOT_FORM###'] = '';
            } else {
                // Wrong email
                $markerArray['###STATUS_MESSAGE###'] = $this->‪getDisplayText('forgot_reset_message', $this->conf['forgotMessage_stdWrap.']);
                $markerArray['###BACKLINK_LOGIN###'] = '';
            }
        } else {
            $markerArray['###STATUS_MESSAGE###'] = $this->‪getDisplayText('forgot_reset_message', $this->conf['forgotMessage_stdWrap.']);
            $markerArray['###BACKLINK_LOGIN###'] = '';
        }
        $markerArray['###BACKLINK_LOGIN###'] = $this->‪getPageLink(htmlspecialchars($this->‪pi_getLL('forgot_header_backToLogin')), []);
        $markerArray['###STATUS_HEADER###'] = $this->‪getDisplayText('forgot_header', $this->conf['forgotHeader_stdWrap.']);
        $markerArray['###LEGEND###'] = htmlspecialchars($this->‪pi_getLL('legend', $this->‪pi_getLL('reset_password')));
        $markerArray['###ACTION_URI###'] = $this->‪getPageLink('', [$this->prefixId . '[forgot]' => 1], true);
        $markerArray['###EMAIL_LABEL###'] = htmlspecialchars($this->‪pi_getLL('your_email'));
        $markerArray['###FORGOT_PASSWORD_ENTEREMAIL###'] = htmlspecialchars($this->‪pi_getLL('forgot_password_enterEmail'));
        $markerArray['###FORGOT_EMAIL###'] = $this->prefixId . '[forgot_email]';
        $markerArray['###SEND_PASSWORD###'] = htmlspecialchars($this->‪pi_getLL('reset_password'));
        $markerArray['###DATA_LABEL###'] = htmlspecialchars($this->‪pi_getLL('enter_your_data'));
        $markerArray = array_merge($markerArray, $this->‪getUserFieldMarkers());
        // Generate hash
        $hash = md5($this->‪generatePassword(3));
        $markerArray['###FORGOTHASH###'] = $hash;
        // Set hash in feuser session
        $this->frontendController->fe_user->setKey('ses', 'forgot_hash', ['forgot_hash' => $hash]);
        return $this->templateService->substituteMarkerArrayCached($subpart, $markerArray, $subpartArray, $linkpartArray);
    }
 
    protected function ‪changePassword()
    {
        $markerArray = [];
        $subpartArray = ($linkpartArray = []);
        $done = false;
        $minLength = (int)$this->conf['newPasswordMinLength'] ?: 6;
        $subpart = $this->templateService->getSubpart($this->template, '###TEMPLATE_CHANGEPASSWORD###');
        $markerArray['###STATUS_HEADER###'] = $this->‪getDisplayText('change_password_header', $this->conf['changePasswordHeader_stdWrap.']);
        $markerArray['###STATUS_MESSAGE###'] = sprintf($this->‪getDisplayText(
            'change_password_message',
            $this->conf['changePasswordMessage_stdWrap.']
        ), $minLength);
 
        $markerArray['###BACKLINK_LOGIN###'] = '';
        $uid = $this->piVars['user'];
        $piHash = $this->piVars['forgothash'];
        $hash = explode('|', rawurldecode($piHash));
        if ((int)$uid === 0) {
            $markerArray['###STATUS_MESSAGE###'] = $this->‪getDisplayText(
                'change_password_notvalid_message',
                $this->conf['changePasswordNotValidMessage_stdWrap.']
            );
            $subpartArray['###CHANGEPASSWORD_FORM###'] = '';
        } else {
            $user = $this->‪pi_getRecord('fe_users', (int)$uid);
            $userHash = $user['felogin_forgotHash'];
            $compareHash = explode('|', $userHash);
            if (!$compareHash || !$compareHash[1] || $compareHash[0] < time() || !hash_equals($compareHash[0], $hash[0])) {
                $hashEquals = false;
            } elseif (strlen($compareHash[1]) === 40) {
                $hashEquals = hash_equals($compareHash[1], GeneralUtility::hmac((string)$hash[1]));
            } else {
                // backward-compatibility for previous MD5 hashes
                $hashEquals = hash_equals($compareHash[1], md5($hash[1]));
            }
            if (!$hashEquals) {
                $markerArray['###STATUS_MESSAGE###'] = $this->‪getDisplayText(
                    'change_password_notvalid_message',
                    $this->conf['changePasswordNotValidMessage_stdWrap.']
                );
                $subpartArray['###CHANGEPASSWORD_FORM###'] = '';
            } else {
                // All is fine, continue with new password
                $postData = GeneralUtility::_POST($this->prefixId);
                if (isset($postData['changepasswordsubmit'])) {
                    if (strlen($postData['password1']) < $minLength) {
                        $markerArray['###STATUS_MESSAGE###'] = sprintf(
                            $this->‪getDisplayText(
                                'change_password_tooshort_message',
                                $this->conf['changePasswordTooShortMessage_stdWrap.']
                            ),
                            $minLength
                        );
                    } elseif ($postData['password1'] != $postData['password2']) {
                        $markerArray['###STATUS_MESSAGE###'] = sprintf(
                            $this->‪getDisplayText(
                                'change_password_notequal_message',
                                $this->conf['changePasswordNotEqualMessage_stdWrap.']
                            ),
                            $minLength
                        );
                    } else {
                        // Hash password using configured salted passwords hash mechanism for FE
                        $hashInstance = GeneralUtility::makeInstance(PasswordHashFactory::class)->getDefaultHashInstance('FE');
                        $newPass = $hashInstance->getHashedPassword($postData['password1']);
 
                        // Call a hook for further password processing
                        $hookPasswordValid = true;
                        if (‪$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['felogin']['password_changed']) {
                            $_params = [
                                'user' => $user,
                                'newPassword' => $newPass,
                                'newPasswordUnencrypted' => $postData['password1'],
                                'passwordValid' => true,
                                'passwordInvalidMessage' => '',
                            ];
                            foreach (‪$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['felogin']['password_changed'] as $_funcRef) {
                                trigger_error(
                                    sprintf(
                                        'Hook "%s" got called by "%s" which is deprecated since TYPO3 10.4 and will be removed in version 11.0',
                                        '$GLOBALS[\'TYPO3_CONF_VARS\'][\'EXTCONF\'][\'felogin\'][\'password_changed\']',
                                        $_funcRef
                                    ),
                                    E_USER_DEPRECATED
                                );
                                if ($_funcRef) {
                                    GeneralUtility::callUserFunction($_funcRef, $_params, $this);
                                }
                            }
                            $newPass = $_params['newPassword'];
                            $hookPasswordValid = $_params['passwordValid'];
 
                            if (!$hookPasswordValid) {
                                $markerArray['###STATUS_MESSAGE###'] = $_params['passwordInvalidMessage'];
                            }
                        }
 
                        // Change Password only if Hook returns valid
                        if ($hookPasswordValid) {
                            // Save new password and clear DB-hash
                            $userTable = $this->frontendController->fe_user->user_table;
                            $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable($userTable);
                            $queryBuilder->getRestrictions()->removeAll();
                            $queryBuilder->update($userTable)
                                ->set('password', $newPass)
                                ->set('felogin_forgotHash', '')
                                ->set('tstamp', (int)‪$GLOBALS['EXEC_TIME'])
                                ->where(
                                    $queryBuilder->expr()->eq(
                                        'uid',
                                        $queryBuilder->createNamedParameter($user['uid'], \PDO::PARAM_INT)
                                    )
                                )
                                ->execute();
                            $this->‪invalidateUserSessions((int)$user['uid']);
 
                            $markerArray['###STATUS_MESSAGE###'] = $this->‪getDisplayText(
                                'change_password_done_message',
                                $this->conf['changePasswordDoneMessage_stdWrap.']
                            );
                            $done = true;
                            $subpartArray['###CHANGEPASSWORD_FORM###'] = '';
                            $markerArray['###BACKLINK_LOGIN###'] = $this->‪getPageLink(
                                htmlspecialchars($this->‪pi_getLL('forgot_header_backToLogin')),
                                [$this->prefixId . '[redirectReferrer]' => 'off']
                            );
                        }
                    }
                }
                if (!$done) {
                    // Change password form
                    $markerArray['###ACTION_URI###'] = $this->‪getPageLink('', [
                        $this->prefixId . '[user]' => $user['uid'],
                        $this->prefixId . '[forgothash]' => $piHash
                    ], true);
                    $markerArray['###LEGEND###'] = htmlspecialchars($this->‪pi_getLL('change_password'));
                    $markerArray['###NEWPASSWORD1_LABEL###'] = htmlspecialchars($this->‪pi_getLL('newpassword_label1'));
                    $markerArray['###NEWPASSWORD2_LABEL###'] = htmlspecialchars($this->‪pi_getLL('newpassword_label2'));
                    $markerArray['###NEWPASSWORD1###'] = $this->prefixId . '[password1]';
                    $markerArray['###NEWPASSWORD2###'] = $this->prefixId . '[password2]';
                    $markerArray['###STORAGE_PID###'] = $this->‪shallEnforceLoginSigning() ? $this->‪getSignedStorageFolders() : $this->‪getStorageFolders();
                    $markerArray['###SEND_PASSWORD###'] = htmlspecialchars($this->‪pi_getLL('change_password'));
                    $markerArray['###FORGOTHASH###'] = $piHash;
                }
            }
        }
        return $this->templateService->substituteMarkerArrayCached($subpart, $markerArray, $subpartArray, $linkpartArray);
    }
 
    protected function ‪generateAndSendHash($user)
    {
        $hours = (int)$this->conf['forgotLinkHashValidTime'] > 0 ? (int)$this->conf['forgotLinkHashValidTime'] : 24;
        $validEnd = time() + 3600 * $hours;
        $validEndString = date($this->conf['dateFormat'], $validEnd);
        $hash = md5(GeneralUtility::makeInstance(Random::class)->generateRandomBytes(64));
        $randHash = $validEnd . '|' . $hash;
        $randHashDB = $validEnd . '|' . GeneralUtility::hmac($hash);
 
        // Write hash to DB
        $userTable = $this->frontendController->fe_user->user_table;
        $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable($userTable);
        $queryBuilder->getRestrictions()->removeAll();
        $queryBuilder->update($userTable)
            ->set('felogin_forgotHash', $randHashDB)
            ->where(
                $queryBuilder->expr()->eq(
                    'uid',
                    $queryBuilder->createNamedParameter($user['uid'], \PDO::PARAM_INT)
                )
            )
            ->execute();
 
        // Send hashlink to user
        $this->conf['linkPrefix'] = -1;
        $isAbsRefPrefix = !empty($this->frontendController->absRefPrefix);
        $isBaseURL = !empty($this->frontendController->baseUrl);
        $isFeloginBaseURL = !empty($this->conf['feloginBaseURL']);
        $link = $this->‪pi_getPageLink((int)$this->frontendController->id, '', [
            $this->prefixId . '[user]' => $user['uid'],
            $this->prefixId . '[forgothash]' => $randHash
        ]);
        // Prefix link if necessary
        if ($isFeloginBaseURL) {
            // First priority, use specific base URL
            // "absRefPrefix" must be removed first, otherwise URL will be prepended twice
            if ($isAbsRefPrefix) {
                $link = substr($link, strlen($this->frontendController->absRefPrefix));
            }
            $link = $this->conf['feloginBaseURL'] . $link;
        } elseif ($isAbsRefPrefix) {
            // Second priority
            // absRefPrefix must not necessarily contain a hostname and URL scheme, so add it if needed
            $link = GeneralUtility::locationHeaderUrl($link);
        } elseif ($isBaseURL) {
            // Third priority
            // Add the global base URL to the link
            $link = $this->frontendController->baseUrlWrap($link);
        } else {
            // No prefix is set, return the error
            return $this->‪pi_getLL('change_password_nolinkprefix_message');
        }
        $msg = sprintf($this->‪pi_getLL('forgot_validate_reset_password'), $user['username'], $link, $validEndString);
        // Add hook for extra processing of mail message
        $params = [
            'message' => &$msg,
            'user' => &$user
        ];
        foreach (‪$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['felogin']['forgotPasswordMail'] ?? [] as $reference) {
            trigger_error(
                sprintf(
                    'Hook "%s" got called by "%s" which is deprecated since TYPO3 10.4 and will be removed in version 11.0',
                    '$GLOBALS[\'TYPO3_CONF_VARS\'][\'EXTCONF\'][\'felogin\'][\'forgotPasswordMail\']',
                    $reference
                ),
                E_USER_DEPRECATED
            );
            if ($reference) {
                GeneralUtility::callUserFunction($reference, $params, $this);
            }
        }
        if ($user['email']) {
            $this->‪sendMail($msg, $user['email'], '', $this->conf['email_from'] ?? '', $this->conf['email_fromName'] ?? '', $this->conf['replyTo'] ?? '');
        }
 
        return '';
    }
 
    protected function ‪showLogout()
    {
        $markerArray = [];
        $subpart = $this->templateService->getSubpart($this->template, '###TEMPLATE_LOGOUT###');
        $subpartArray = ($linkpartArray = []);
        $markerArray['###STATUS_HEADER###'] = $this->‪getDisplayText('status_header', $this->conf['logoutHeader_stdWrap.']);
        $markerArray['###STATUS_MESSAGE###'] = $this->‪getDisplayText('status_message', $this->conf['logoutMessage_stdWrap.']);
        $this->cObj->stdWrap($this->‪flexFormValue('message', 's_status'), $this->conf['logoutMessage_stdWrap.']);
        $markerArray['###LEGEND###'] = htmlspecialchars($this->‪pi_getLL('logout'));
        $markerArray['###ACTION_URI###'] = $this->‪getPageLink('', [], true);
        $markerArray['###LOGOUT_LABEL###'] = htmlspecialchars($this->‪pi_getLL('logout'));
        $markerArray['###NAME###'] = htmlspecialchars($this->frontendController->fe_user->user['name']);
        $markerArray['###STORAGE_PID###'] = $this->‪shallEnforceLoginSigning() ? $this->‪getSignedStorageFolders() : $this->‪getStorageFolders();
        $markerArray['###USERNAME###'] = htmlspecialchars($this->frontendController->fe_user->user['username']);
        $markerArray['###USERNAME_LABEL###'] = htmlspecialchars($this->‪pi_getLL('username'));
        $markerArray['###NOREDIRECT###'] = $this->noRedirect ? '1' : '0';
        $markerArray['###PREFIXID###'] = ‪$this->prefixId;
        $markerArray = array_merge($markerArray, $this->‪getUserFieldMarkers());
        if ($this->redirectUrl) {
            // Use redirectUrl for action tag because of possible access restricted pages
            $markerArray['###ACTION_URI###'] = htmlspecialchars($this->redirectUrl);
            $this->redirectUrl = '';
        }
        return $this->templateService->substituteMarkerArrayCached($subpart, $markerArray, $subpartArray, $linkpartArray);
    }
 
    protected function ‪showLogin()
    {
        $subpart = $this->templateService->getSubpart($this->template, '###TEMPLATE_LOGIN###');
        $subpartArray = ($linkpartArray = ($markerArray = []));
        $gpRedirectUrl = '';
        $markerArray['###LEGEND###'] = htmlspecialchars($this->‪pi_getLL('oLabel_header_welcome'));
        if ($this->logintype === ‪LoginType::LOGIN) {
            if ($this->userIsLoggedIn) {
                // login success
                $markerArray['###STATUS_HEADER###'] = $this->‪getDisplayText('success_header', $this->conf['successHeader_stdWrap.']);
                $markerArray['###STATUS_MESSAGE###'] = $this->‪getDisplayText('success_message', $this->conf['successMessage_stdWrap.']);
                $markerArray = array_merge($markerArray, $this->‪getUserFieldMarkers());
                $subpartArray['###LOGIN_FORM###'] = '';
                // Hook for general actions after after login has been confirmed (by Thomas Danzl <thomas@danzl.org>)
                foreach (‪$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['felogin']['login_confirmed'] ?? [] as $_funcRef) {
                    $_params = [];
                    trigger_error(
                        sprintf(
                            'Hook "%s" got called by "%s" which is deprecated since TYPO3 10.4 and will be removed in version 11.0',
                            '$GLOBALS[\'TYPO3_CONF_VARS\'][\'EXTCONF\'][\'felogin\'][\'login_confirmed\']',
                            $_funcRef
                        ),
                        E_USER_DEPRECATED
                    );
                    if ($_funcRef) {
                        GeneralUtility::callUserFunction($_funcRef, $_params, $this);
                    }
                }
                // show logout form directly
                if ($this->conf['showLogoutFormAfterLogin']) {
                    $this->redirectUrl = '';
                    return $this->‪showLogout();
                }
            } else {
                // Hook for general actions on login error
                $params = [];
                foreach (‪$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['felogin']['login_error'] ?? [] as $funcRef) {
                    trigger_error(
                        sprintf(
                            'Hook "%s" got called by "%s" which is deprecated since TYPO3 10.4 and will be removed in version 11.0',
                            '$GLOBALS[\'TYPO3_CONF_VARS\'][\'EXTCONF\'][\'felogin\'][\'login_error\']',
                            $funcRef
                        ),
                        E_USER_DEPRECATED
                    );
                    if ($funcRef) {
                        GeneralUtility::callUserFunction($funcRef, $params, $this);
                    }
                }
                // login error
                $markerArray['###STATUS_HEADER###'] = $this->‪getDisplayText('error_header', $this->conf['errorHeader_stdWrap.']);
                $markerArray['###STATUS_MESSAGE###'] = $this->‪getDisplayText('error_message', $this->conf['errorMessage_stdWrap.']);
                $gpRedirectUrl = GeneralUtility::_GP('redirect_url');
            }
        } else {
            if ($this->logintype === ‪LoginType::LOGOUT) {
                // login form after logout
                $markerArray['###STATUS_HEADER###'] = $this->‪getDisplayText('logout_header', $this->conf['logoutHeader_stdWrap.']);
                $markerArray['###STATUS_MESSAGE###'] = $this->‪getDisplayText('logout_message', $this->conf['logoutMessage_stdWrap.']);
            } else {
                // login form
                $markerArray['###STATUS_HEADER###'] = $this->‪getDisplayText('welcome_header', $this->conf['welcomeHeader_stdWrap.']);
                $markerArray['###STATUS_MESSAGE###'] = $this->‪getDisplayText('welcome_message', $this->conf['welcomeMessage_stdWrap.']);
            }
        }
 
        // This hook allows to call User JS functions.
        // The methods should also set the required JS functions to get included
        $onSubmit = '';
        $extraHidden = '';
        $onSubmitAr = [];
        $extraHiddenAr = [];
        // Check for referer redirect method. if present, save referer in form field
        if (GeneralUtility::inList($this->conf['redirectMode'], 'referer') || GeneralUtility::inList($this->conf['redirectMode'], 'refererDomains')) {
            ‪$referer = $this->referer ?: GeneralUtility::getIndpEnv('HTTP_REFERER');
            if (‪$referer) {
                $extraHiddenAr[] = '<input type="hidden" name="referer" value="' . htmlspecialchars(‪$referer) . '" />';
                if ($this->piVars['redirectReferrer'] === 'off') {
                    $extraHiddenAr[] = '<input type="hidden" name="' . $this->prefixId . '[redirectReferrer]" value="off" />';
                }
            }
        }
        $_params = [];
        foreach (‪$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['felogin']['loginFormOnSubmitFuncs'] ?? [] as $funcRef) {
            trigger_error(
                sprintf(
                    'Hook "%s" got called by "%s" which is deprecated since TYPO3 10.4 and will be removed in version 11.0',
                    '$GLOBALS[\'TYPO3_CONF_VARS\'][\'EXTCONF\'][\'felogin\'][\'loginFormOnSubmitFuncs\']',
                    $funcRef
                ),
                E_USER_DEPRECATED
            );
            [$onSub, $hid] = GeneralUtility::callUserFunction($funcRef, $_params, $this);
            $onSubmitAr[] = $onSub;
            $extraHiddenAr[] = $hid;
        }
        if (!empty($onSubmitAr)) {
            $onSubmit = implode('; ', $onSubmitAr) . '; return true;';
        }
        if (!empty($extraHiddenAr)) {
            $extraHidden = implode(LF, $extraHiddenAr);
        }
        if (!$gpRedirectUrl && $this->redirectUrl) {
            $gpRedirectUrl = ‪$this->redirectUrl;
        }
        // Login form
        $markerArray['###ACTION_URI###'] = $this->‪getPageLink('', [], true);
        // Used by kb_md5fepw extension...
        $markerArray['###EXTRA_HIDDEN###'] = $extraHidden;
        $markerArray['###LEGEND###'] = htmlspecialchars($this->‪pi_getLL('login'));
        $markerArray['###LOGIN_LABEL###'] = htmlspecialchars($this->‪pi_getLL('login'));
        // Used by kb_md5fepw extension...
        $markerArray['###ON_SUBMIT###'] = $onSubmit;
        $markerArray['###PASSWORD_LABEL###'] = htmlspecialchars($this->‪pi_getLL('password'));
        $markerArray['###STORAGE_PID###'] = $this->‪shallEnforceLoginSigning() ? $this->‪getSignedStorageFolders() : $this->‪getStorageFolders();
        $markerArray['###USERNAME_LABEL###'] = htmlspecialchars($this->‪pi_getLL('username'));
        $markerArray['###REDIRECT_URL###'] = htmlspecialchars($gpRedirectUrl);
        $markerArray['###NOREDIRECT###'] = $this->noRedirect ? '1' : '0';
        $markerArray['###PREFIXID###'] = ‪$this->prefixId;
        $markerArray = array_merge($markerArray, $this->‪getUserFieldMarkers());
        if ($this->conf['showForgotPasswordLink']) {
            $linkpartArray['###FORGOT_PASSWORD_LINK###'] = explode('|', $this->‪getPageLink('|', [$this->prefixId . '[forgot]' => 1]));
            $markerArray['###FORGOT_PASSWORD###'] = htmlspecialchars($this->‪pi_getLL('forgot_header'));
        } else {
            $subpartArray['###FORGOTP_VALID###'] = '';
        }
        // The permanent login checkbox should only be shown if permalogin is not deactivated (-1),
        // not forced to be always active (2) and lifetime is greater than 0
        $permalogin = (int)‪$GLOBALS['TYPO3_CONF_VARS']['FE']['permalogin'];
        if (
            $this->conf['showPermaLogin']
            && ($permalogin === 0 || $permalogin === 1)
            && ‪$GLOBALS['TYPO3_CONF_VARS']['FE']['lifetime'] > 0
        ) {
            $markerArray['###PERMALOGIN###'] = htmlspecialchars($this->‪pi_getLL('permalogin'));
            if ($permalogin === 1) {
                $markerArray['###PERMALOGIN_HIDDENFIELD_ATTRIBUTES###'] = 'disabled="disabled"';
                $markerArray['###PERMALOGIN_CHECKBOX_ATTRIBUTES###'] = 'checked="checked"';
            } else {
                $markerArray['###PERMALOGIN_HIDDENFIELD_ATTRIBUTES###'] = '';
                $markerArray['###PERMALOGIN_CHECKBOX_ATTRIBUTES###'] = '';
            }
        } else {
            $subpartArray['###PERMALOGIN_VALID###'] = '';
        }
        return $this->templateService->substituteMarkerArrayCached($subpart, $markerArray, $subpartArray, $linkpartArray);
    }
 
    protected function ‪processRedirect()
    {
        $redirect_url = [];
        if ($this->conf['redirectMode']) {
            $redirectMethods = ‪GeneralUtility::trimExplode(',', $this->conf['redirectMode'], true);
            foreach ($redirectMethods as $redirMethod) {
                if ($this->userIsLoggedIn && $this->logintype === ‪LoginType::LOGIN) {
                    // Logintype is needed because the login-page wouldn't be accessible anymore after a login (would always redirect)
                    switch ($redirMethod) {
                        case 'groupLogin':
                            // taken from dkd_redirect_at_login written by Ingmar Schlecht; database-field changed
                            $groupData = $this->frontendController->fe_user->groupData;
                            if (!empty($groupData['uid'])) {
 
                                // take the first group with a redirect page
                                $userGroupTable = $this->frontendController->fe_user->usergroup_table;
                                $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable($userGroupTable);
                                $queryBuilder->getRestrictions()->removeAll();
                                $row = $queryBuilder
                                    ->select('felogin_redirectPid')
                                    ->from($userGroupTable)
                                    ->where(
                                        $queryBuilder->expr()->neq(
                                            'felogin_redirectPid',
                                            $queryBuilder->createNamedParameter('', \PDO::PARAM_STR)
                                        ),
                                        $queryBuilder->expr()->in(
                                            'uid',
                                            $queryBuilder->createNamedParameter(
                                                $groupData['uid'],
                                                Connection::PARAM_INT_ARRAY
                                            )
                                        )
                                    )
                                    ->execute()
                                    ->fetch();
 
                                if ($row) {
                                    $redirect_url[] = $this->‪pi_getPageLink($row['felogin_redirectPid']);
                                }
                            }
                            break;
                        case 'userLogin':
 
                            $userTable = $this->frontendController->fe_user->user_table;
                            $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable($userTable);
                            $queryBuilder->getRestrictions()->removeAll();
                            $row = $queryBuilder
                                ->select('felogin_redirectPid')
                                ->from($userTable)
                                ->where(
                                    $queryBuilder->expr()->neq(
                                        'felogin_redirectPid',
                                        $queryBuilder->createNamedParameter('', \PDO::PARAM_STR)
                                    ),
                                    $queryBuilder->expr()->eq(
                                        $this->frontendController->fe_user->userid_column,
                                        $queryBuilder->createNamedParameter(
                                            $this->frontendController->fe_user->user['uid'],
                                            \PDO::PARAM_INT
                                        )
                                    )
                                )
                                ->execute()
                                ->fetch();
 
                            if ($row) {
                                $redirect_url[] = $this->‪pi_getPageLink($row['felogin_redirectPid']);
                            }
 
                            break;
                        case 'login':
                            if ($this->conf['redirectPageLogin']) {
                                $redirect_url[] = $this->‪pi_getPageLink((int)$this->conf['redirectPageLogin']);
                            }
                            break;
                        case 'getpost':
                            $redirect_url[] = ‪$this->redirectUrl;
                            break;
                        case 'referer':
                            // Avoid redirect when logging in after changing password
                            if ($this->piVars['redirectReferrer'] !== 'off') {
                                // Avoid forced logout, when trying to login immediately after a logout
                                $redirect_url[] = preg_replace('/[&?]logintype=[a-z]+/', '', $this->referer);
                            }
                            break;
                        case 'refererDomains':
                            // Auto redirect.
                            // Feature to redirect to the page where the user came from (HTTP_REFERER).
                            // Allowed domains to redirect to, can be configured with plugin.tx_felogin_pi1.domains
                            // Thanks to plan2.net / Martin Kutschker for implementing this feature.
                            // also avoid redirect when logging in after changing password
                            if (isset($this->conf['domains']) && $this->conf['domains']
                                && (!isset($this->piVars['redirectReferrer']) || $this->piVars['redirectReferrer'] !== 'off')
                            ) {
                                $url = ‪$this->referer;
                                // Is referring url allowed to redirect?
                                $match = [];
                                if (preg_match('#^http://([[:alnum:]._-]+)/#', $url, $match)) {
                                    $redirect_domain = $match[1];
                                    $found = false;
                                    foreach (‪GeneralUtility::trimExplode(',', $this->conf['domains'], true) as $d) {
                                        if (preg_match('/(?:^|\\.)' . $d . '$/', $redirect_domain)) {
                                            $found = true;
                                            break;
                                        }
                                    }
                                    if (!$found) {
                                        $url = '';
                                    }
                                }
                                // Avoid forced logout, when trying to login immediately after a logout
                                if ($url) {
                                    $redirect_url[] = preg_replace('/[&?]logintype=[a-z]+/', '', $url);
                                }
                            }
                            break;
                    }
                } elseif ($this->logintype === ‪LoginType::LOGIN) {
                    // after login-error
                    switch ($redirMethod) {
                        case 'loginError':
                            if ($this->conf['redirectPageLoginError']) {
                                $redirect_url[] = $this->‪pi_getPageLink((int)$this->conf['redirectPageLoginError']);
                            }
                            break;
                    }
                } elseif ($this->logintype == '' && $redirMethod === 'login' && $this->conf['redirectPageLogin']) {
                    // If login and page not accessible
                    $this->cObj->typoLink('', [
                        'parameter' => $this->conf['redirectPageLogin'],
                        'linkAccessRestrictedPages' => true
                    ]);
                    $redirect_url[] = $this->cObj->lastTypoLinkUrl;
                } elseif ($this->logintype == '' && $redirMethod === 'logout' && $this->conf['redirectPageLogout'] && $this->userIsLoggedIn) {
                    // If logout and page not accessible
                    $redirect_url[] = $this->‪pi_getPageLink((int)$this->conf['redirectPageLogout']);
                } elseif ($this->logintype === ‪LoginType::LOGOUT) {
                    // after logout
                    // Hook for general actions after after logout has been confirmed
                    foreach (‪$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['felogin']['logout_confirmed'] ?? [] as $_funcRef) {
                        trigger_error(
                            sprintf(
                                'Hook "%s" got called by "%s" which is deprecated since TYPO3 10.4 and will be removed in version 11.0',
                                '$GLOBALS[\'TYPO3_CONF_VARS\'][\'EXTCONF\'][\'felogin\'][\'logout_confirmed\']',
                                $_funcRef
                            ),
                            E_USER_DEPRECATED
                        );
                        $_params = [];
                        if ($_funcRef) {
                            $ref = $this; // introduced for phpstan to not lose type information when passing $this into callUserFunction
                            GeneralUtility::callUserFunction($_funcRef, $_params, $ref);
                        }
                    }
                    switch ($redirMethod) {
                        case 'logout':
                            if ($this->conf['redirectPageLogout']) {
                                $redirect_url[] = $this->‪pi_getPageLink((int)$this->conf['redirectPageLogout']);
                            }
                            break;
                    }
                } else {
                    // not logged in
                    // Placeholder for maybe future options
                    switch ($redirMethod) {
                        case 'getpost':
                            // Preserve the get/post value
                            $redirect_url[] = ‪$this->redirectUrl;
                            break;
                    }
                }
            }
        }
        // Remove empty values, but keep "0" as value (that's why "strlen" is used as second parameter)
        if (!empty($redirect_url)) {
            return array_filter($redirect_url, static function (string $value) {
                return $value !== '';
            });
        }
        return [];
    }
 
    protected function ‪mergeflexFormValuesIntoConf()
    {
        $flex = [];
        if ($this->‪flexFormValue('showForgotPassword', 'sDEF')) {
            $flex['showForgotPasswordLink'] = $this->‪flexFormValue('showForgotPassword', 'sDEF');
        }
        if ($this->‪flexFormValue('showPermaLogin', 'sDEF')) {
            $flex['showPermaLogin'] = $this->‪flexFormValue('showPermaLogin', 'sDEF');
        }
        if ($this->‪flexFormValue('showLogoutFormAfterLogin', 'sDEF')) {
            $flex['showLogoutFormAfterLogin'] = $this->‪flexFormValue('showLogoutFormAfterLogin', 'sDEF');
        }
        if ($this->‪flexFormValue('pages', 'sDEF')) {
            $flex['pages'] = $this->‪flexFormValue('pages', 'sDEF');
        }
        if ($this->‪flexFormValue('recursive', 'sDEF')) {
            $flex['recursive'] = $this->‪flexFormValue('recursive', 'sDEF');
        }
        if ($this->‪flexFormValue('redirectMode', 's_redirect')) {
            $flex['redirectMode'] = $this->‪flexFormValue('redirectMode', 's_redirect');
        }
        if ($this->‪flexFormValue('redirectFirstMethod', 's_redirect')) {
            $flex['redirectFirstMethod'] = $this->‪flexFormValue('redirectFirstMethod', 's_redirect');
        }
        if ($this->‪flexFormValue('redirectDisable', 's_redirect')) {
            $flex['redirectDisable'] = $this->‪flexFormValue('redirectDisable', 's_redirect');
        }
        if ($this->‪flexFormValue('redirectPageLogin', 's_redirect')) {
            $flex['redirectPageLogin'] = $this->‪flexFormValue('redirectPageLogin', 's_redirect');
        }
        if ($this->‪flexFormValue('redirectPageLoginError', 's_redirect')) {
            $flex['redirectPageLoginError'] = $this->‪flexFormValue('redirectPageLoginError', 's_redirect');
        }
        if ($this->‪flexFormValue('redirectPageLogout', 's_redirect')) {
            $flex['redirectPageLogout'] = $this->‪flexFormValue('redirectPageLogout', 's_redirect');
        }
        $pid = $flex['pages'] ? $this->‪pi_getPidList($flex['pages'], (int)$flex['recursive']) : 0;
        if ($pid > 0) {
            $flex['storagePid'] = $pid;
        }
        $this->conf = array_merge($this->conf, $flex);
    }
 
    protected function ‪flexFormValue($var, $sheet)
    {
        return $this->‪pi_getFFvalue($this->cObj->data['pi_flexform'], 'settings.' . $var, $sheet);
    }
 
    protected function ‪getPageLink($label, ‪$piVars, $returnUrl = false)
    {
        $additionalParams = is_array(‪$piVars) && !empty(‪$piVars) ? ‪$piVars : [];
        // Should GETvars be preserved?
        if ($this->conf['preserveGETvars']) {
            $additionalParams = array_merge_recursive($additionalParams, $this->‪getPreserveGetVars());
        }
        $this->conf['linkConfig.']['parameter'] = $this->frontendController->id;
        if (!empty($additionalParams)) {
            $this->conf['linkConfig.']['additionalParams'] = ‪HttpUtility::buildQueryString($additionalParams, '&');
        }
        if ($returnUrl) {
            return htmlspecialchars($this->cObj->typoLink_URL($this->conf['linkConfig.']));
        }
        return $this->cObj->typoLink($label, $this->conf['linkConfig.']);
    }
 
    protected function ‪getPreserveGetVars()
    {
        $getVars = GeneralUtility::_GET();
        unset(
            $getVars['id'],
            $getVars['no_cache'],
            $getVars['logintype'],
            $getVars['redirect_url'],
            $getVars['cHash'],
            $getVars[$this->prefixId]
        );
        if ($this->conf['preserveGETvars'] === 'all') {
            $preserveQueryParts = $getVars;
        } else {
            $preserveQueryStringProperties = ‪GeneralUtility::trimExplode(',', $this->conf['preserveGETvars']);
            $preserveQueryParts = [];
            parse_str(implode('=1&', $preserveQueryStringProperties) . '=1', $preserveQueryParts);
            $preserveQueryParts = ‪ArrayUtility::intersectRecursive($getVars, $preserveQueryParts);
        }
        return $preserveQueryParts;
    }
 
    protected function ‪generatePassword($len)
    {
        $pass = '';
        while ($len--) {
            $char = random_int(0, 35);
            if ($char < 10) {
                $pass .= '' . $char;
            } else {
                $pass .= chr($char - 10 + 97);
            }
        }
        return $pass;
    }
 
    protected function ‪getDisplayText($label, $stdWrapArray = [])
    {
        $text = $this->‪flexFormValue($label, 's_messages') ? $this->cObj->stdWrap($this->‪flexFormValue($label, 's_messages'), $stdWrapArray) : $this->cObj->stdWrap($this->‪pi_getLL($label), $stdWrapArray);
        $replace = $this->‪getUserFieldMarkers();
        return strtr($text, $replace);
    }
 
    protected function ‪getUserFieldMarkers()
    {
        $marker = [];
        // replace markers with fe_user data
        if ($this->frontendController->fe_user->user) {
            // All fields of fe_user will be replaced, scheme is ###FEUSER_FIELDNAME###
            foreach ($this->frontendController->fe_user->user as $field => $value) {
                ‪$conf = $this->conf['userfields.'][$field . '.'] ?? [];
                ‪$conf = array_replace_recursive(['htmlSpecialChars' => '1'], ‪$conf);
                $marker['###FEUSER_' . strtoupper($field) . '###'] = $this->cObj->stdWrap($value, ‪$conf);
            }
            // Add ###USER### for compatibility
            $marker['###USER###'] = $marker['###FEUSER_USERNAME###'];
        }
        return $marker;
    }
 
    protected function ‪invalidateUserSessions(int $userId)
    {
        $sessionManager = GeneralUtility::makeInstance(SessionManager::class);
        $sessionBackend = $sessionManager->getSessionBackend('FE');
        $sessionManager->invalidateAllSessionsByUserId($sessionBackend, $userId, $this->frontendController->fe_user);
    }
 
    protected function ‪sendMail(string $message, string $recipients, string $cc, string $senderAddress, string $senderName = '', string $replyTo = ''): bool
    {
        if (trim($message) === '') {
            return false;
        }
 
        $mail = GeneralUtility::makeInstance(MailMessage::class);
        $senderName = trim($senderName);
        $senderAddress = trim($senderAddress);
        if ($senderAddress !== '') {
            $mail->from(new Address($senderAddress, $senderName));
        }
        $parsedReplyTo = ‪MailUtility::parseAddresses($replyTo);
        if (!empty($parsedReplyTo)) {
            $mail->replyTo(...$parsedReplyTo);
        }
        // First line is subject
        $messageParts = explode(LF, trim($message), 2);
        $subject = trim($messageParts[0]);
        $plainMessage = trim($messageParts[1]);
        $parsedRecipients = ‪MailUtility::parseAddresses($recipients);
        if (!empty($parsedRecipients)) {
            $mail->to(...$parsedRecipients)
                ->subject($subject)
                ->text($plainMessage);
            $mail->send();
        }
        $parsedCc = ‪MailUtility::parseAddresses($cc);
        if (!empty($parsedCc)) {
            $from = $mail->getFrom();
            $mail = GeneralUtility::makeInstance(MailMessage::class);
            if (!empty($parsedReplyTo)) {
                $mail->replyTo($parsedReplyTo);
            }
            $mail->from($from)
                ->to(...$parsedCc)
                ->subject($subject)
                ->text($plainMessage);
            $mail->send();
        }
        return true;
    }
 
    protected function ‪getStorageFolders(): string
    {
        if ((bool)(‪$GLOBALS['TYPO3_CONF_VARS']['FE']['checkFeUserPid'] ?? false) === false) {
            $storagePidList = '0';
        } elseif ($this->conf['storagePid']) {
            if ((int)$this->conf['recursive']) {
                $storagePidList = $this->‪pi_getPidList($this->conf['storagePid'], (int)$this->conf['recursive']);
            } else {
                $storagePidList = $this->conf['storagePid'];
            }
        } else {
            throw new \RuntimeException('No storage folder (option storagePid) for frontend users given.', 1450904202);
        }
 
        return $storagePidList;
    }
 
    protected function ‪getSignedStorageFolders(): string
    {
        $pidList = $this->‪getStorageFolders();
        return sprintf(
            '%s@%s',
            $pidList,
            GeneralUtility::hmac($pidList, FrontendUserAuthentication::class)
        );
    }
 
    protected function ‪shallEnforceLoginSigning(): bool
    {
        return GeneralUtility::makeInstance(Features::class)
            ->isFeatureEnabled('security.frontend.enforceLoginSigning');
    }
}