Merge branch...

Merge branch '495-outdated-extension-versions-are-handled-as-insecure-in-extension-manager' into 'develop'

Resolve "Outdated extension versions are handled as insecure in Extension Manager"

Closes #495

See merge request services/extensions.typo3.org/ter!627

extensions/ter_fe2/Classes/Service/ExtensionIndexService.php

@@ -135,7 +135,9 @@ class ExtensionIndexService implements LoggerAwareInterface
                 $versionObj->appendChild(new \DOMElement('title', $this->xmlentities((string)$extensionVersionArr['title'])));
                 $versionObj->appendChild(new \DOMElement('description', $this->xmlentities((string)$extensionVersionArr['description'])));
                 $versionObj->appendChild(new \DOMElement('state', $this->xmlentities((string)$extensionVersionArr['state'])));
-                $versionObj->appendChild(new \DOMElement('reviewstate', (string)$extensionVersionArr['review_state']));
+                // Use "0" for outdated extension versions as the Extension Manager handles it as insecure
+                $reviewState = (string)((int)$extensionVersionArr['review_state'] !== -2 ? $extensionVersionArr['review_state'] : 0);
+                $versionObj->appendChild(new \DOMElement('reviewstate', $reviewState));
                 $versionObj->appendChild(new \DOMElement('category', $this->xmlentities((string)$extensionVersionArr['em_category'])));
                 if ($extensionVersionArr['category'] === 'distribution') {
                     $prefixDistributionFilePath = $extensionKey[0] . '/' . $extensionKey[1] . '/' . $extensionKey . '_' . $versionNumber . '_';

extensions/ter_fe2/Tests/Unit/Service/ExtensionIndexServiceTest.php

@@ -33,7 +33,7 @@ class ExtensionIndexServiceTest extends UnitTestCase
       <title/>
       <description/>
       <state/>
-      <reviewstate/>
+      <reviewstate>0</reviewstate>
       <category/>
       <downloadcounter/>
       <lastuploaddate/>
@@ -54,7 +54,7 @@ class ExtensionIndexServiceTest extends UnitTestCase
       <title/>
       <description/>
       <state/>
-      <reviewstate/>
+      <reviewstate>0</reviewstate>
       <category/>
       <downloadcounter/>
       <lastuploaddate/>
@@ -75,7 +75,7 @@ class ExtensionIndexServiceTest extends UnitTestCase
       <title/>
       <description/>
       <state/>
-      <reviewstate/>
+      <reviewstate>0</reviewstate>
       <category/>
       <downloadcounter/>
       <lastuploaddate/>
@@ -89,6 +89,48 @@ class ExtensionIndexServiceTest extends UnitTestCase
       <t3xfilemd5/>
       <documentation_link/>
     </version>
+  </extension>
+  <extension extensionkey="insecure">
+    <downloadcounter>131313</downloadcounter>
+    <version version="2.0.0">
+      <title/>
+      <description/>
+      <state/>
+      <reviewstate>-1</reviewstate>
+      <category/>
+      <downloadcounter/>
+      <lastuploaddate/>
+      <uploadcomment/>
+      <dependencies/>
+      <composerinfo/>
+      <authorname/>
+      <authoremail/>
+      <authorcompany>Security</authorcompany>
+      <ownerusername>thomas</ownerusername>
+      <t3xfilemd5/>
+      <documentation_link/>
+    </version>
+  </extension>
+  <extension extensionkey="outdated">
+    <downloadcounter>131313</downloadcounter>
+    <version version="2.0.0">
+      <title/>
+      <description/>
+      <state/>
+      <reviewstate>0</reviewstate>
+      <category/>
+      <downloadcounter/>
+      <lastuploaddate/>
+      <uploadcomment/>
+      <dependencies/>
+      <composerinfo/>
+      <authorname/>
+      <authoremail/>
+      <authorcompany>Old</authorcompany>
+      <ownerusername>thomas</ownerusername>
+      <t3xfilemd5/>
+      <documentation_link/>
+    </version>
   </extension>
     </extensions>
 ';
@@ -100,6 +142,7 @@ class ExtensionIndexServiceTest extends UnitTestCase
                 'versions' => [
                     '1.0.0' => [
                         'authorcompany' => 'ACME',
+                        'review_state' => 0,
                         'dependencies' => '[{"kind":"depends","extensionKey":"typo3","versionRange":"8.7.0-10.4.99"}]'
                     ]
                 ]
@@ -110,6 +153,7 @@ class ExtensionIndexServiceTest extends UnitTestCase
                 'versions' => [
                     '1.5.0' => [
                         'authorcompany' => 't3o',
+                        'review_state' => 0,
                         'dependencies' => '[]'
                     ]
                 ]
@@ -120,6 +164,29 @@ class ExtensionIndexServiceTest extends UnitTestCase
                 'versions' => [
                     '2.0.0' => [
                         'authorcompany' => 'INC',
+                        'review_state' => 0,
+                        'dependencies' => null
+                    ]
+                ]
+            ],
+            'insecure' => [
+                'downloads' => 131313,
+                'frontend_user' => 'thomas',
+                'versions' => [
+                    '2.0.0' => [
+                        'authorcompany' => 'Security',
+                        'review_state' => -1,
+                        'dependencies' => null
+                    ]
+                ]
+            ],
+            'outdated' => [
+                'downloads' => 131313,
+                'frontend_user' => 'thomas',
+                'versions' => [
+                    '2.0.0' => [
+                        'authorcompany' => 'Old',
+                        'review_state' => -2,
                         'dependencies' => null
                     ]
                 ]
@@ -130,6 +197,6 @@ class ExtensionIndexServiceTest extends UnitTestCase
         $resultString = $result->saveXML();
         // remove the lines with "<!--Index created
         $resultString = preg_replace('/\<!--Index created(.*)--\>\n/m', '', $resultString);
-        self::assertEquals($resultString, $expected);
+        self::assertEquals($expected, $resultString);
     }
 }

private/typo3conf/LocalConfiguration.php

@@ -10,12 +10,12 @@ return [
         'Connections' => [
             'Default' => [
                 'charset' => 'utf8',
-                'dbname' => getenv('DB_NAME'),
+                'dbname' => false,
                 'driver' => 'mysqli',
-                'host' => getenv('DB_HOST'),
-                'password' => getenv('DB_PASSWORD'),
+                'host' => false,
+                'password' => false,
                 'port' => 3306,
-                'user' => getenv('DB_USERNAME'),
+                'user' => false,
             ],
         ],
     ],
@@ -59,12 +59,12 @@ return [
             'TYPO3FEUserExist' => '0',
             'enableBELDAPAuthentication' => '0',
             'enableBESSO' => '0',
-            'enableFELDAPAuthentication' => '1',
+            'enableFELDAPAuthentication' => '0',
             'enableFESSO' => '0',
             'forceLowerCaseUsername' => '0',
             'keepBEGroups' => '0',
             'keepBESSODomainName' => '0',
-            'keepFEGroups' => '1',
+            'keepFEGroups' => '0',
             'keepFESSODomainName' => '0',
             'throwExceptionAtLogin' => '1',
             'useExtConfConfiguration' => '0',
@@ -74,52 +74,27 @@ return [
             'showSampleTasks' => '1',
         ],
         'solr' => [
-            'allowLegacySiteMode' => '0',
             'allowSelfSignedCertificates' => '0',
             'useConfigurationFromClosestTemplate' => '0',
             'useConfigurationMonitorTables' => '',
             'useConfigurationTrackRecordsOutsideSiteroot' => '1',
         ],
         't3olayout' => [
-            'loginFormPid' => '12',
-            'loginPid' => '8',
+            'loginFormPid' => '',
+            'loginPid' => '',
         ],
         'ter' => [
-            'repositoryDir' => '/var/www/html/private/fileadmin/ter/',
+            'repositoryDir' => '',
         ],
         'ter_rest' => [
-            'routing' => [
-                'routeArguments' => [
-                    'String' => \T3o\TerRest\Routing\RouteArgument\StringArgument::class,
-                    'Integer' => \T3o\TerRest\Routing\RouteArgument\IntegerArgument::class,
-                    'Object' => \T3o\TerRest\Routing\RouteArgument\ObjectArgument::class,
-                    'Array' => \T3o\TerRest\Routing\RouteArgument\ArrayArgument::class
-                ],
-                'formData' => [
-                    'String' => \T3o\TerRest\Routing\FormData\StringData::class,
-                    'Integer' => \T3o\TerRest\Routing\FormData\IntegerData::class,
-                    'Boolean' => \T3o\TerRest\Routing\FormData\BooleanData::class,
-                    'Binary' => \T3o\TerRest\Routing\FormData\BinaryData::class
-                ],
-                'responseTypes' => [
-                    '*/*' => \TYPO3\CMS\Core\Http\JsonResponse::class,
-                    'application/json' => \TYPO3\CMS\Core\Http\JsonResponse::class
-                ],
-                'enableFeUserAuthentication' => true
-            ],
-            'extensionVersionFiles' => '.t3x,.gif,.png,.svg,_Distribution.png,_Distribution.svg,_DistributionWelcome.png,_DistributionWelcome.svg',
-            'extensionMaxUploadSize' => 31457280,
-            'extensionKeyPattern' => '^((?!(tx|user|pages|tt|sys|ts_language|csh))[a-z]{1}[a-z0-9_]+)$',
-            'apiPath' => '/api/',
-            'schemaPath' => 'EXT:ter_rest/Resources/Private/Schema/',
-            'extensionDownloadUrl' => 'https://extensions.typo3.org/extension/download/',
-            'abandonUser' => 'abandoned_extensions',
-            'randomLength' => getenv('TER_REST_RANDOM_LENGTH'),
-            'defaultLifetime' => getenv('TER_REST_DEFAULT_LIFETIME'),
-            'jwtSubject' => getenv('TER_REST_JWT_SUBJECT'),
-            'jwtLatency' => getenv('TER_REST_JWT_LATENCY'),
-            'signatureIdentifier' => getenv('TER_REST_SIGNATURE_IDENTIFIER')
-        ]
+            'abandonUser' => '',
+            'apiPath' => '',
+            'extensionDownloadUrl' => '',
+            'extensionKeyPattern' => '',
+            'extensionMaxUploadSize' => '',
+            'extensionVersionFiles' => '',
+            'schemaPath' => '',
+        ],
     ],
     'FE' => [
         'cacheHash' => [