[TYPO3-dev] secure downloads - css_styled_content > Ernesto, please comment <

[Ernesto Baschny [cron IT]]

Am 06.07.2011 16:25, schrieb Mathias Schreiber [wmdb]:
> Am 06.07.11 15:21, schrieb Georg Schönweger:
>> Hi Mathias,
>>
>> Am 06.07.2011 14:49, schrieb Mathias Schreiber [wmdb]:
>>> Do you have your extension (or access to the install) at hand?
>>> I have an idea what might be going wrong, but it is too complex to
>>> describe.
>> here it is;
>> http://kick.susi2.it/fileadmin/T3X_sni_t3uploads-0_0_0-z-201107061516.t3x
>> it is just ext_tables.(php|sql) .. do you need something else?
>
> ok.
> We took a look at it and to be honest I have bad news.
> Basically what you see is correct.
> TSFE invokes "getCompressedTCarray" to save up RAM (which I will
> investigate since the code does not make ANY sense).
> This compressed TCA does not have the columns section, thus
> t3lib_div::loadTCA (as CSC invokes) tries to load that info from the
> crtl section that is has (which is typo3/sysext/cms/tbl_tt_content.php)
> without ANY extended columns.
>
> So basically you can only "extend" to fields that come with TYPO3 by
> default.
>
> Some things to consider:
> a) remove that code from CSC since it does not really make too much sense
> b) get t3lib_div::loadTCA to load ALL TCA, not just the stuff prior to
> extending tables.
>
> What can you do?
> a) Use the hook in CSC ->render_uploads to do your thing
> b) xclass csc and modify override that part of the function
>
> Both ways kinda suck... sorry I couldn't help :(

The bug is that css_styled_content doesn't call 
$GLOBALS['TSFE']->includeTCA() before running t3lib_div::loadTCA(). The 
"ext_tables.php" are *not* loaded by default at all on the 
FE-environment, so that your additions to it won't be ever considered.

This is documented in loadTCA():

	* For complete TCA use $GLOBALS['TSFE']->includeTCA() instead.

In class.tx_cssstyledcontent_pi1.php, changing:

	t3lib_div::loadTCA('tt_content');

with:

	$GLOBALS['TSFE']->includeTCA();

Seems to do the trick. It adds some performance penalty to it, because 
it will load the TCA for "every" extension. Which is fine, because any 
extension might want to add additional fields for tt_content.

Please test it, and give me your feedbacks, and we might want to push 
this change to gerrit (please report the bug in the issue tracker).

Cheers,
Ernesto