You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Editing a page which is disabled for the default language (l18n_cfg = 3) creates invalid internal requests during Garbage collection when the SYS trustedHostsPattern is set to 'SERVER_NAME':
Core: Error handler (BE): PHP Warning: Undefined array key "SERVER_NAME" in /var/www/html/app/vendor/typo3/cms-core/Classes/Middleware/VerifyHostHeader.php line 103
To Reproduce
Steps to reproduce the behavior:
Setup Page: Create a page with a translation and disable the default language via [l18n_cfg] = 3 setting, make sure to have indexing ([no_search] = 0)enabled for the page
Maybe some condition to check for disabled default languages when creating the FrontendController?
Or simply add a condition to the TYPO3 Core VerifyHostHeader Middleware to return false when the request doesn't match. But I'm not sure wether that breaks the solr garbage collection? 🤔
/** * Checks if the provided host header value matches the trusted hosts pattern without any preprocessing. */protectedfunctionhostHeaderValueMatchesTrustedHostsPattern(string$hostHeaderValue, array$serverParams): bool
{
if ($this->trustedHostsPattern === self::ENV_TRUSTED_HOSTS_PATTERN_SERVER_NAME) {
$host = strtolower($hostHeaderValue);
// Default port to be verified if HTTP_HOST does not contain explicit port information.// Deriving from raw/local webserver HTTPS information (not taking possible proxy configurations into account)// as we compare against the raw/local server information (SERVER_PORT).$port = self::webserverUsesHttps($serverParams) ? '443' : '80';
$parsedHostValue = parse_url('http://' . $host);
if (isset($parsedHostValue['port'])) {
$host = $parsedHostValue['host'];
$port = (string)$parsedHostValue['port'];
}
// NEW: Fail on missing env variablesif (!isset($serverParams['SERVER_NAME'], $serverParams['SERVER_PORT'])) {
returnfalse;
}
// Allow values that equal the server name// Note that this is only secure if name base virtual host are configured correctly in the webserver$hostMatch = $host === strtolower($serverParams['SERVER_NAME']) && $port === $serverParams['SERVER_PORT'];
} else {
// In case name based virtual hosts are not possible, we allow setting a trusted host pattern// See https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/ for further details$hostMatch = (bool)preg_match('/^' . $this->trustedHostsPattern . '$/i', $hostHeaderValue);
}
return$hostMatch;
}
Screenshots
Used versions (please complete the following information):
TYPO3 Version: 12.4.24
Browser: chrome
EXT:solr Version: 12.0.5
Used Apache Solr Version: 9.6.1
PHP Version: 8.3.15
MySQL Version: 8.0.36
Additional context
Backtrace Ausgabe in vendor/typo3/cms-core/Classes/Middleware/VerifyHostHeader.php->hostHeaderValueMatchesTrustedHostsPattern():
The text was updated successfully, but these errors were encountered:
schliesser
changed the title
[BUG] Please add a speaking title
[BUG] Undefined array key "SERVER_NAME" on save when default language is disabled for page
Jan 7, 2025
Describe the bug
Editing a page which is disabled for the default language (l18n_cfg = 3) creates invalid internal requests during Garbage collection when the SYS trustedHostsPattern is set to 'SERVER_NAME':
To Reproduce
Steps to reproduce the behavior:
[l18n_cfg] = 3
setting, make sure to have indexing ([no_search] = 0
)enabled for the page[SYS][trustedHostsPattern] = 'SERVER_NAME'
[SYS][exceptionalErrors] = 4096
[hidden]
)Expected behavior
No error in log ;-)
Maybe some condition to check for disabled default languages when creating the FrontendController?
Or simply add a condition to the TYPO3 Core VerifyHostHeader Middleware to return false when the request doesn't match. But I'm not sure wether that breaks the solr garbage collection? 🤔
Screenshots
Used versions (please complete the following information):
Additional context
Backtrace Ausgabe in
vendor/typo3/cms-core/Classes/Middleware/VerifyHostHeader.php->hostHeaderValueMatchesTrustedHostsPattern()
:The text was updated successfully, but these errors were encountered: