2

I have a piBase extension which has a listing of records and a detail page. When calling the listing first, everything is fine, realurl (version 2.0.15, TYPO3 version 7.6.10) creates the urls for the detail pages with cHash parameter, e.g.

cHash=dc3409cee49ff80a6b8173357a474bd3&id=168&tx_myext_pi1[event]=1062

But when truncating all four realurl tables, clearing the frontend cache and accessing a detail page of a record directly, realurl creates the url for this page without cHash:

id=168&tx_myext_pi1[event]=1062

When trying the same in an Extbase extension (e.g. EXT:news) I get a 404 error and the generated url is also without cHash:

id=102&tx_news_pi1[news]=speaking-path-of-news

Why is the cHash parameter missing? Is this a bug?

Sven
  • 722
  • 1
  • 7
  • 25

2 Answers2

5

Realurl <= 2.0.14 recalculated cHash if it was missing. Since 2.0.15 security team forced me to disable this feature. Missing cHash is an expected outcome of the security team's request. I made some efforts to mitigate the problem but it cannot be fully solved. Sorry.

User366
  • 765
  • 4
  • 9
  • But generating the page without cHash can't be acceptable. This leads to wrong page contents. Wouldn't it be better to show the 404 page or an error message, if a page is requested, where realurl has no cHash parameter? – Sven Sep 27 '16 at 05:42
  • No, it wouldn't because page can also work without cHash. For example, search GET forms do not use cHash. – User366 Nov 27 '19 at 15:50
0

In realurl 2.0.15 the cHash was disabled by security aspects. You can update to realurl 2.1.x

Michael Gnessner
  • 139
  • 13
  • realurl 2.1.2 doesn't solve the problem, these urls are still created without cHash parameter. – Sven Sep 27 '16 at 06:21
  • Yes, version 2.1.4 seems to solve this problem, thank you for the new version! – Sven Oct 10 '16 at 12:50
  • Sorry, problem is not solved. Still there are entries in table "tx_realurl_urldata" without cHash parameter. I've implemented a workaround in my piBase extension: if(!$GLOBALS['TSFE']->beUserLogin && !t3lib_div::_GP('cHash')) { $GLOBALS['TSFE']->pageNotFoundAndExit('Record does not exist.'); } – Sven Oct 12 '16 at 10:24
  • Firsts, realurl never generates cHash. TYPO3 generates cHash. If you are getting entries without cHash, it means that your code did not ask TYPO3 to create cHash. Check your code and see if you are adding `useCacheHash = 1` in typolinks. The responsibility is user's! – User366 Nov 27 '19 at 15:51