[Neos] Calling non-Neos controller gives security error

Christian Müller christian.mueller at typo3.org
Tue Feb 25 21:18:24 CET 2014

Hey both of you,

Christian Loock wrote:
> To be honest I would be very surprised if it wasn't allready possible to
> request json in the Neos backend. The biggest problem is the very slim bit
> of documentation available at the moment. But maybe some of the Neos Devs
> can enlighten us^^
> 2014-02-25 16:32 GMT+01:00 Mathias Bolt Lesniak, LiliO<mathias at lilio.com>:
>> Hi Christian!
>> I've been digging deep, but it looks like it's not possible to change the
>> format within the "neos/" routing. That means enabling and using the Flow
>> default routes is the only way right now.

You don't need to enable full flow routes,
see the readme at [1] for an example routing setup. I think from this 
experience we will probably adjust the way we handle module routes. A 
simple way to make it easier would be to wrap only requests with format 
html and leave the rest alone. That would already fix 80% of all cases 
and yours too.

>> As long as everything is passed through
>> TYPO3\Neos\Controller\Backend\ModuleController, it will add its own
>> wrapping HTML code no matter what I do.
>> Maybe I should post a feature request?

We are aware of that :)


[1] https://github.com/chlu/Flowpack.Neos.NodeTypeEditor

Christian Müller
Flow / Neos Team Community Contact

TYPO3 .... inspiring people to share!
Get involved: http://typo3.org

More information about the Neos mailing list