Question
Page-TSconfig and Frontend Access Control Integration
Ash Cedar
0 reputation · 24 Jul 2020, 15:22 UTC
132.8K views
Loading…
0 reputation · 24 Jul 2020, 15:22 UTC
TYPO3 manages page visibility through a combination of the 'Access' tab in page properties and TypoScript rendering configurations. While the hierarchical page tree ensures that access rights are inherited from parent nodes, there is a potential conflict when Page-TSconfig is used to modify backend behavior or frontend rendering logic on a per-page basis.
The primary goal is to ensure that custom Page-TSconfig directives do not inadvertently bypass the frontend access restrictions defined in the page properties, particularly when complex TypoScript overrides are active. There is uncertainty regarding whether specific Page-TSconfig settings can override the 'Hidden' or 'Deleted' flags during the rendering process in TYPO3 v12.
35775 reputation · 24 Jul 2020, 21:43 UTC
In TYPO3 v12, Page-TSconfig cannot override frontend access restrictions defined in the Page Properties Access tab. Directives set via Page-TSconfig are designed to configure the Backend (BE) user interface and behavior; they do not possess the authority to bypass core frontend visibility flags such as 'Hidden' or 'Deleted'.
The potential for conflict is mitigated by the architectural separation between configuration and access control:
typo3hidden or deleted status of a record.The TYPO3 internal cache is designed to be permission-aware. When dynamic user group permissions are active, the system generates cache identifiers (cache keys) that include the user's group membership. This ensures that a page cached for a user with high-level access is not served to a user without those permissions.
To verify that your specific configuration is secure, perform the following scoped tests:
This behavior assumes the use of the standard TYPO3 Page Repository. If your project utilizes custom PHP extensions that override PageRepository or implement custom routing logic that manually fetches records without checking the hidden or deleted flags, the standard access controls may be bypassed. This is a code-level vulnerability, not a configuration issue.
Diagnostic Detail Needed: Are you using any custom PHP extensions or modified PageRepository classes to handle page routing?
Use comments to ask for clarification. Post a solution as an answer.
35,775 reputation · 25 Jul 2020, 01:26 UTC
It is important to distinguish between backend configuration and the frontend rendering pipeline. In TYPO3 v12, Page-TSconfig is primarily designed to configure the Backend User Interface (BE) and certain administrative behaviors; it does not possess the authority to override the Hidden or Deleted flags defined in the Page Properties.
The visibility check occurs early in the request lifecycle. If a page is marked as hidden, the rendering engine triggers a 404 or a redirect before any page-specific TSconfig directives are processed for frontend output. While you can use config.pageNotFound_handling to customize the experience of a missing page, this does not grant access to the hidden content itself.
To verify this in your environment, you can set a page to 'Hidden' and attempt to force its rendering via a custom TSconfig directive. The system should still return a page-not-found response, confirming that access control remains decoupled from configuration directives.