[TYPO3-core] RFC: Enable pageNotFoundOnCHashError by default?

[Michael Stucki]

Well, the decision was made regarding the 4.1 release. However, we both
agreed that the change is correct and should still be added for 4.2, since
this should be soon enough now.

So a new patch request will follow shortly.

- michael

Ingmar Schlecht wrote:

> Hi guys,
> 
> Stucki and me just had a chat about this and decided to revert the
> patch, so the default of pageNotFoundOnCHashError is "0" again.
> 
> We'll get back to it during 4.2 development.
> 
> cheers
> Ingmar
> 
> Michael Stucki schrieb:
>> Hi Ingmar,
>> 
>>> I'm not sure if it was a good idea to introduce this patch.
>>>
>>> According to the last comments on http://bugs.typo3.org/view.php?id=4940
>>> there are quite a number of extensions having problems with the new
>>> default setting of pageNotFoundOnCHashError.
>> 
>> True, though there was also a comment by Andreas Bulling who confirmed
>> that an additional patch might fix some (most?) cases for this.
>> 
>> I have posted this patch two weeks ago and will repost it next...
>> 
>>> Apart from that, I could not see a security advantage at all in the new
>>> setting: The only thing this is about is whether an error-page should be
>>> shown or a non-cached page should be output to the user. No matter what
>>> the setting in question is, the user couldn't spam the cache table or
>>> anything, so no security gain here.
>> 
>> Well, the key problem is that this bug has been in extension for ages but
>> nobody noticed (causing no error message, but causing the page to be
>> non-cached). So it's mainly a question if we accept that behavior or not,
>> and of course this is just what we set by default, since everybody can
>> still override it if he likes...
>> 
>> I really think that we should keep the setting, but tell our users how
>> they can deal with it. There will be some failures in the beginning, but
>> the workaround is easy, and finally this will result in better extension
>> quality (chashes used more effectively + non-caching avoided where
>> possible).
>> 
>>> If I get it right, the only advantage of the new setting would be to
>>> warn administrators that the content of their pages is not cached, so
>>> they should fix their extensions to improve performance. However, such a
>>> message was already given to administrators by means of
>>>    $GLOBALS['TT']->setTSlogMessage('The cHash [...] did not match, so
>>>    caching is disabled [...]');
>> 
>> Yeah, but as you can see, nobody ever noticed or cared about

-- 
Use a newsreader! Check out
http://typo3.org/community/mailing-lists/use-a-news-reader/