wt_doorman¶

What does it do?¶

You can secure the whole TYPO3 installation with filtering of GET and POST params.

Developers can include the class to filter values of there process

What is the process?¶

Doorman is a small php class which provides an easy cleaning method of piVars against bad behaviour like XSS (Cross Site Scripting) and SQL injection, etc...).

Just include the class.tx_wtdoorman_security.php and send your piVars to this class. You'll get a filtered variant of your piVars.

You can set what a GET or POST param should contain (integer, alphanum, text or a defined value).

See below for integration example.

NOTE: wt_doorman uses a newer removeXSS class as offered in the current TYPO3 4.2

Who can use wt_doorman?¶

• Admins can secure the whole TYPO3 installation against bad code from GET or POST vars
• Developers can secure there extension with filtering of piVars

Step by step:¶

• Import wt_doorman from TER
• Set some values in the extension manager (see example below) which should be allowed for the whole TYPO3 installation OR Include this class to your extension (see example below)
• Check with the debug output if all works as expected (don't forget to disable the debug output again!)
• Send and receive your piVars array
• That's all

Don't do it in this way 1¶

// This is the worst case for XSS

// ...

$content .= $this->piVars['uid'];

return $this->pi_wrapInBaseClass($content);

Don't do it in this way 2¶

// This is the worst case for SQL injection

// ...

$res = $GLOBALS['TYPO3_DB']->exec_SELECTquery (

'*',

'tx_yourtable',

'uid = '.$this->piVars['uid'],

'',

'');

Using wt_doorman to clean piVars¶

if(t3lib_extMgm::isLoaded('wt_doorman', 0)) require_once(t3lib_ext Mgm::extPath('wt_doorman').'class.tx_wtdoorman_security.php'); // load security class

class tx_yourextension_pi1 extends tslib_pibase {

function main() {

if (class_exists('tx_wtdoorman_security')) {

$this->sec = t3lib_div::makeInstance('tx_wtdoorman_security'); // Create new instance for security class

$this->sec->secParams = array ( // Allowed piVars type (int, text, alphanum, "value")

'uid' => 'int', // piVar show should be an integer

'pointer' => 'int', // piVar pointer should be an integer

'filter' => array (

'name' => 'alphanum', // piVar filter|name should be alphanum

'email' => 'text' // piVar filter|email should be text

)

);

$this->piVars = $this->sec->sec($this->piVars); // overwrite piVars with piVars from doorman class

} else unset ($this->piVars); // clear piVars if doorman not available

$content .= $this->piVars['uid']; // could be only an integer – no more XSS problem

return $this->pi_wrapInBaseClass($content);

}

}

Data type¶

int¶

addslashes¶

text¶

alphanum¶

alphanum ++ sign¶

“value”¶

htmlentities¶

removeXSS¶

Example piVar¶

tx_extension_pi1[uid]=3¶

tx_extension_pi1[name]=Alex¶

tx_extension_pi1[description]=I%20love%20it¶

tx_extension_pi1[show]=detailview¶

tx_extension_pi1[show]=none¶

tx_extension_pi1[filter]['name']=Alex¶

tx_extension_pi1[field111]=Alex¶

tx_extension_pi1[filter][field111]=Alex¶

All available configurations in extension manager¶

Example for global filtering of piVars¶

The first three lines of rows of the extension manager possibilities can be used to save the whole TYPO3 installation.

Screenshot of “debug mode”¶

When should I use this class¶

• If you are an admin and want to stop bad input from outside
• If you are a developer and want to have cleaned piVars

Why should I use this class in my extension¶

• I will extend this class as often as possible
• You can save some code
• You could be sure against bad behaviour (from piVar hacks)
• wt_doorman uses a newer removeXSS class as offered in TYPO3 4.2

((generated))¶