‪TYPO3CMS  ‪main
Public Member Functions | Protected Member Functions | Protected Attributes | List of all members
TYPO3\CMS\Core\Resource\Security\FilePermissionAspect Class Reference
Inheritance diagram for TYPO3\CMS\Core\Resource\Security\FilePermissionAspect:
TYPO3\CMS\Core\DataHandling\DataHandlerCheckModifyAccessListHookInterface

Public Member Functions

 __construct (ResourceFactory $resourceFactory=null)
 
 checkModifyAccessList (&$accessAllowed, $table, DataHandler $parent)
 
 processDatamap_preProcessFieldArray (&$incomingFieldArray, string $table, $id, DataHandler $dataHandler)
 

Protected Member Functions

 logError (string $table, int $id, string $message, DataHandler $dataHandler)
 
 usesLegacyStorage (File $file)
 
bool usesDisallowedFileMount (File $file, string $fileAction, mixed $backendUser)
 
list<?File > resolveReferencedFiles (array $data, string $propertyName)
 
 resolveReferencedFile (array $data, string $propertyName)
 
 resolveFile (int $fileId)
 
 isValidStorageData (array $data)
 

Protected Attributes

ResourceFactory $resourceFactory
 

Detailed Description

DataHandler hook handling to avoid direct access to sys_file related entities:

  • ‪denies any write access to sys_file (in datamap and cmdmap, unless it is an internal process)
  • ‪denies any write access to sys_file that is on legacy storage
  • ‪denies any write access to sys_file_reference, referencing a file on legacy storage, or not part of the file-mounts of the corresponding user
  • ‪denies any write access to sys_file_metadata, referencing a file on legacy storage, or not part of the file-mounts of the corresponding user

Definition at line 40 of file FilePermissionAspect.php.

Constructor & Destructor Documentation

◆ __construct()

TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::__construct ( ResourceFactory  $resourceFactory = null)

Definition at line 44 of file FilePermissionAspect.php.

References TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\$resourceFactory.

Member Function Documentation

◆ checkModifyAccessList()

TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::checkModifyAccessList ( &  $accessAllowed,
  $table,
DataHandler  $parent 
)

Denies write access to sys_file in general, unless it is an internal process.

Parameters
bool&$accessAllowed
string$table
DataHandler$parent

Implements TYPO3\CMS\Core\DataHandling\DataHandlerCheckModifyAccessListHookInterface.

Definition at line 56 of file FilePermissionAspect.php.

◆ isValidStorageData()

TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::isValidStorageData ( array  $data)
protected

Definition at line 194 of file FilePermissionAspect.php.

References TYPO3\CMS\Core\Utility\MathUtility\canBeInterpretedAsInteger().

Referenced by TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\processDatamap_preProcessFieldArray().

◆ logError()

TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::logError ( string  $table,
int  $id,
string  $message,
DataHandler  $dataHandler 
)
protected

Definition at line 118 of file FilePermissionAspect.php.

References TYPO3\CMS\Core\DataHandling\DataHandler\log().

Referenced by TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\processDatamap_preProcessFieldArray().

◆ processDatamap_preProcessFieldArray()

TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::processDatamap_preProcessFieldArray ( &  $incomingFieldArray,
string  $table,
  $id,
DataHandler  $dataHandler 
)

Checks file related data being processed in DataHandler:

  • ‪sys_file (only if checkModifyAccessList passed -> during internal process)
  • ‪sys_file_reference
  • ‪sys_file_metadata
Parameters
mixed$incomingFieldArray
string$table
int | string$id
DataHandler$dataHandler

Definition at line 75 of file FilePermissionAspect.php.

References TYPO3\CMS\Core\Utility\MathUtility\canBeInterpretedAsInteger(), TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\isValidStorageData(), TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\logError(), TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\resolveFile(), TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\resolveReferencedFile(), TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\resolveReferencedFiles(), TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\usesDisallowedFileMount(), and TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\usesLegacyStorage().

◆ resolveFile()

TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::resolveFile ( int  $fileId)
protected

Definition at line 185 of file FilePermissionAspect.php.

Referenced by TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\processDatamap_preProcessFieldArray(), TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\resolveReferencedFile(), and TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\resolveReferencedFiles().

◆ resolveReferencedFile()

TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::resolveReferencedFile ( array  $data,
string  $propertyName 
)
protected

Definition at line 176 of file FilePermissionAspect.php.

References TYPO3\CMS\Core\Utility\MathUtility\canBeInterpretedAsInteger(), and TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\resolveFile().

Referenced by TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\processDatamap_preProcessFieldArray().

◆ resolveReferencedFiles()

list<?File> TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::resolveReferencedFiles ( array  $data,
string  $propertyName 
)
protected
Returns
‪list<?File>

Definition at line 159 of file FilePermissionAspect.php.

References TYPO3\CMS\Core\Utility\MathUtility\canBeInterpretedAsInteger(), TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\resolveFile(), and TYPO3\CMS\Core\Utility\GeneralUtility\trimExplode().

Referenced by TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\processDatamap_preProcessFieldArray().

◆ usesDisallowedFileMount()

bool TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::usesDisallowedFileMount ( File  $file,
string  $fileAction,
mixed  $backendUser 
)
protected
Parameters
non-empty-string$fileAction
BackendUserAuthentication | mixed$backendUser
Returns
‪bool

Definition at line 142 of file FilePermissionAspect.php.

References TYPO3\CMS\Core\Resource\AbstractFile\getStorage(), and TYPO3\CMS\Core\Resource\AbstractFile\getUid().

Referenced by TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\processDatamap_preProcessFieldArray().

◆ usesLegacyStorage()

TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::usesLegacyStorage ( File  $file)
protected

Definition at line 132 of file FilePermissionAspect.php.

References TYPO3\CMS\Core\Resource\AbstractFile\getStorage(), and TYPO3\CMS\Core\Resource\AbstractFile\getUid().

Referenced by TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\processDatamap_preProcessFieldArray().

Member Data Documentation

◆ $resourceFactory

ResourceFactory TYPO3\CMS\Core\Resource\Security\FilePermissionAspect::$resourceFactory
protected

Definition at line 42 of file FilePermissionAspect.php.

Referenced by TYPO3\CMS\Core\Resource\Security\FilePermissionAspect\__construct().