TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:09 +02:00
commit af8cc155b5
6818 changed files with 642608 additions and 0 deletions
@@ -0,0 +1,73 @@
+.. include:: /Includes.rst.txt
+
+.. _breaking-91782:
+
+======================================================================================================
+Breaking: #91782 - lockToDomain feature for frontend users / groups and backend users / groups removed
+======================================================================================================
+
+See :issue:`91782`
+
+Description
+===========
+
+TYPO3 Core shipped with a feature called "lockToDomain" for frontend and backend users which made the user login only valid if
+the exact given HTTP_HOST matches the filled domain.
+
+A similar functionality with the same name for groups existed, which only added the group to a specific user during a session,
+if the user was accessing a TYPO3 site under a specific domain.
+
+Both features have been removed.
+
+Impact
+======
+
+Frontend users or backend users that have this option set previously, will now be able to login independent of the defined HTTP_HOST
+header sent with the login page.
+
+Regardless of any setting of the "lockToDomain" setting of a specific group, all groups added
+to a user are now applied during login of a user, both for frontend and backend.
+
+
+Affected Installations
+======================
+
+TYPO3 Installations using this feature in their database records are affected. Following SQL SELECT statements help to identify records
+with a value for the features, which indicates those users and groups will now be able to log in without the domain restriction.
+
+Frontend Users:
+
+.. code-block:: sql
+
+   SELECT uid, pid, username FROM fe_users WHERE lockToDomain != '' AND lockToDomain IS NOT NULL;
+
+Backend Users:
+
+.. code-block:: sql
+
+   SELECT uid, pid, username FROM be_users WHERE lockToDomain != '' AND lockToDomain IS NOT NULL;
+
+Frontend Groups:
+
+.. code-block:: sql
+
+   SELECT uid, pid, username FROM fe_groups WHERE lockToDomain != '' AND lockToDomain IS NOT NULL;
+
+Backend Groups:
+
+.. code-block:: sql
+
+   SELECT uid, pid, username FROM be_groups WHERE lockToDomain != '' AND lockToDomain IS NOT NULL;
+
+
+Migration
+=========
+
+Any installations needing this feature should build this in
+custom extensions extending TCA and a custom Authentication Service.
+
+In addition, if such a feature is needed for frontend users
+or groups, it is recommended to use the storagePid option to limit
+frontend user login by Storage Folders.
+
+.. index:: Database, TCA, NotScanned, ext:core