74 lines
2.3 KiB
ReStructuredText
74 lines
2.3 KiB
ReStructuredText
.. include:: /Includes.rst.txt
|
|
|
|
.. _breaking-91782:
|
|
|
|
======================================================================================================
|
|
Breaking: #91782 - lockToDomain feature for frontend users / groups and backend users / groups removed
|
|
======================================================================================================
|
|
|
|
See :issue:`91782`
|
|
|
|
Description
|
|
===========
|
|
|
|
TYPO3 Core shipped with a feature called "lockToDomain" for frontend and backend users which made the user login only valid if
|
|
the exact given HTTP_HOST matches the filled domain.
|
|
|
|
A similar functionality with the same name for groups existed, which only added the group to a specific user during a session,
|
|
if the user was accessing a TYPO3 site under a specific domain.
|
|
|
|
Both features have been removed.
|
|
|
|
Impact
|
|
======
|
|
|
|
Frontend users or backend users that have this option set previously, will now be able to login independent of the defined HTTP_HOST
|
|
header sent with the login page.
|
|
|
|
Regardless of any setting of the "lockToDomain" setting of a specific group, all groups added
|
|
to a user are now applied during login of a user, both for frontend and backend.
|
|
|
|
|
|
Affected Installations
|
|
======================
|
|
|
|
TYPO3 Installations using this feature in their database records are affected. Following SQL SELECT statements help to identify records
|
|
with a value for the features, which indicates those users and groups will now be able to log in without the domain restriction.
|
|
|
|
Frontend Users:
|
|
|
|
.. code-block:: sql
|
|
|
|
SELECT uid, pid, username FROM fe_users WHERE lockToDomain != '' AND lockToDomain IS NOT NULL;
|
|
|
|
Backend Users:
|
|
|
|
.. code-block:: sql
|
|
|
|
SELECT uid, pid, username FROM be_users WHERE lockToDomain != '' AND lockToDomain IS NOT NULL;
|
|
|
|
Frontend Groups:
|
|
|
|
.. code-block:: sql
|
|
|
|
SELECT uid, pid, username FROM fe_groups WHERE lockToDomain != '' AND lockToDomain IS NOT NULL;
|
|
|
|
Backend Groups:
|
|
|
|
.. code-block:: sql
|
|
|
|
SELECT uid, pid, username FROM be_groups WHERE lockToDomain != '' AND lockToDomain IS NOT NULL;
|
|
|
|
|
|
Migration
|
|
=========
|
|
|
|
Any installations needing this feature should build this in
|
|
custom extensions extending TCA and a custom Authentication Service.
|
|
|
|
In addition, if such a feature is needed for frontend users
|
|
or groups, it is recommended to use the storagePid option to limit
|
|
frontend user login by Storage Folders.
|
|
|
|
.. index:: Database, TCA, NotScanned, ext:core
|