in2code-de / luxletter

Newsletter system for TYPO3

Home Page:https://www.in2code.de/agentur/typo3-extensions/luxletter/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Domain of fetched images is wrong

ses2013 opened this issue · comments

typo3 11.5.27
luxletter 20

In a multiple Domain Setup with a perfect site:configuration
base with full domain and /
correct "Sender configuration"
some images are fetched from the wrong domain.

How can that be?

They will be shown but I wonder if there any security issues if an email comes from
domain xxx.org and the images from domain yyy.com ?
cross site reference?

I just digged into the code and found the part where the domain is set (see https://github.com/in2code-de/luxletter/blob/develop/ext_localconf.php#L44). So, the domain of the request is used for adding prefixes to images. This means: When you are logged in into TYPO3 backend via domain1, domain1 is used for the images and not domain2 (what would be configured in site configuration) when you add a new newsletter record.

The bad news: In my eyes there is no simple way in TYPO3 11 to set correct domain prefixes for images. Yes, middleware would be a solution but this would need some time.

The good news: There is a new feature in TYPO3 12, that allows to automatically absolute links for images, links, etc... by simply writing config.forceAbsoluteUrls = 1 in TypoScript setup (or more specific fluidStyledMailContent.config.forceAbsoluteUrls = 1 for fluidStyledMailContent). And that configuration overrules other settings with absRefPrefix.

At the moment I would tend to go for the current solution and add forceAbsoluteUrls for TYPO3 12 and newer. For your case: Are you able to update to TYPO3 12 or backport the feature from https://review.typo3.org/c/Packages/TYPO3.CMS/+/76463 (e.g. via composer patches)?

You could also embed images (via extension manager settings) to prevent wrong domains.
Any update for me here?

Your replay was very helpfull. I can live with that.
And yet disturbing that such a elemtar, obvious request is not possible to implement in typo3 11.
So thanks for your effort.

Thx, I will close this issue for now :)