[TYPO3-mvc] Upgrading an application from Extbase 1.3

[Helmut Hummel]

Hi François,

On 26.04.12 14:25, François Suter wrote:

> Is it really as
> bad as it sounds (i.e. anyone sending a properly crafted request can
> change any property of any object?).

Exactly that.

This might be tackled in future versions of extbase and is transparently 
handled by the FLOW3 security framework (if properly configured), but 
especially with the new property mapper the developer needs to know and 
take care of potential problems with that fact.

Kind regards,
Helmut

-- 
Helmut Hummel
TYPO3 Security Team Leader, TYPO3 v4 Core Team Member

TYPO3 .... inspiring people to share!
Get involved: typo3.org