Deprecation: #99098 - Static usage of FormProtectionFactory

Description

\TYPO3\CMS\Core\FormProtection\FormProtectionFactory has been constructed in a static class manner in TYPO3 v6.2, using a static property based instance cache to avoid recreating instances for a specific typed FormProtection implementation. This design made it impossible to retrieve an instance of this class via dependency injection. Another side-effect was that ensuring a properly cleared state between tests has been hard and often spread to other tests and thus influencing them.

To mitigate these issues, \TYPO3\CMS\Core\FormProtection\FormProtectionFactory is now transformed to a non-static class usage with injected services and the Core runtime cache, removing the static property cache.

Based on these changes, the old static methods get() and purgeInstances() are now deprecated.

There are two general ways to get a specific FormProtection implementation:

auto-detected from request: $formProtectionFactory->createFromRequest()
create for a specific type: $formProtectionFactory->createForType()

Possible types for $formProtectionFactory->createForType() are frontend backend, installtool or disabled.

Impact

Using any of the following class methods

\TYPO3\CMS\Core\FormProtection\FormProtectionFactory::get()
\TYPO3\CMS\Core\FormProtection\FormProtectionFactory::purgeInstances()

will trigger a PHP deprecation notice and will throw a fatal PHP error in TYPO3 v13.

Affected installations

The extension scanner will find extensions calling FormProtectionFactory::get() or FormProtectionFactory::purgeInstances() as "strong" matches.

Migration

Provided implementation by TYPO3 core

Before

// use TYPO3\CMS\Core\FormProtection\FormProtectionFactory;

// BackendFormProtection
$formProtection = FormProtectionFactory::get(BackendFormProtection::class);
$formProtection = FormProtectionFactory::get('backend');

// FrontendFormProtection
$formProtection = FormProtectionFactory::get(FrontedFormProtection::class);
$formProtection = FormProtectionFactory::get('frontend');

// Default / Disabled FormProtection
$formProtection = FormProtectionFactory::get(DisabledFormProtection::class);
$formProtection = FormProtectionFactory::get('default');

After

It is recommended to use FormProtectionFactory->createForRequest() to auto-detect which type is needed and return the corresponding instance:

// use TYPO3\CMS\Core\FormProtection\FormProtectionFactory;

// Better: Get FormProtectionFactory injected by DI.
$formProtectionFactory = GeneralUtility::makeInstance(FormProtectionFactory::class);
// $request is assumed to be available, for instance in controller classes.
$formProtection = $formProtectionFactory->createFromRequest($request);

To create a specific type directly, using following replacements:

// use TYPO3\CMS\Core\FormProtection\FormProtectionFactory;
// Better: Get FormProtectionFactory injected by DI.
$formProtectionFactory = GeneralUtility::makeInstance(FormProtectionFactory::class);

// BackendFormProtection
$formProtection = $formProtectionFactory->createFromType('backend');

// FrontendFormProtection
$formProtection = $formProtectionFactory->createFromType('frontend');

// Default / Disabled FormProtection
$formProtection = $formProtectionFactory->createFromType('disabled');

Custom FormProtection-based implementation

Before

// use TYPO3\CMS\Core\FormProtection\FormProtectionFactory;

$formProtection = FormProtectionFactory::get(
    Vendor\ExtensionKey\FormProtection\CustomFormProtection::class,
    $customService,
    'someDirectValue',
    ...
);

After

// Create an instance of the class yourself, take care of an
// instance cache if needed.
GeneralUtility::makeInstance(
    Vendor\ExtensionKey\FormProtection\CustomFormProtection::class,
    $constructorArguments
);