[TYPO3-formidable] Install tool broken in TYPO3 4.4.1/4.3.4 if ameos_formidable is installed

[Andreas Becker]

+1


On Fri, Jul 30, 2010 at 3:21 PM, Oliver Klee
<typo3-german-02 at oliverklee.de>wrote:

> Hi all,
>
> it looks like the install tool login is broken in TYPO3 4.4.1/4.3.4 if
> ameos_formidable is installed. Particularly, the session fixation fix in
> the install tool gets broken by this line in FORMidable's
> ext_localconf.php:
>
> if(!isset($GLOBALS["_SESSION"])) {
>    session_start();
> }
>
> From the bug report <http://bugs.typo3.org/view.php?id=15265>:
>
>
> [snip]
> which starts a PHP session on every request (be it BE or FE). This
> conflicts with any other TYPO3 session, one of which is used by the
> install tool.
>
> I am not sure why ameos_formidable needs its own _SESSION, but it might
> be better if it uses the TYPO3 session management, or only starting the
> session when really needed (in the frontend probably?).
>
> [...]
>
> A potential bugfix in ameos_formidable is wrap a:
> if (TYPO3_MODE === "FE") {
> }
> around the session initialization in ext_localconf.php.
>
> [snip]
>
>
> Would it be possible to release fixed FORMidable versions 2.x and 1.1.x
> (the latter to the TER) very quickly?
>
> Thanks a lot,
>
>
> Oliver
> --
> Certified TYPO3 Integrator | TYPO3 Security Team Member
> _______________________________________________
> TYPO3-project-formidable mailing list
> TYPO3-project-formidable at lists.typo3.org
> http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-project-formidable
>