0

First of all, I have to deal with a project-related upgrade of a TYPO3 version and am also relatively new to the nginx web server. Therefore I ask for patience with me. ;-) I'm also not quite sure, if this question would be better on stackoverflow.com instead of serverfault.com. So if it is a question more for stackoverflow, please let me know, I will transfer it.

As written above, I have upgraded a TYPO3 installation from version 7.6 to 8.7 and transferred the site from an IIS (windows) server to an ubuntu 18.04 system with nginx.

I have now discovered the following: The first click on an internal link on the website in the menu e.g. domain.com/prices works correctly. The URL domain.com/prices is called and also shown in the URL. Now when the page has been reloaded, the same menu item Link now looks like this...

domain.com/index.php?id=8&L=1%20or%20%281%2C2%29%3D%28select%2Afrom%28select%20name_const%28CHAR%28111%2C108%2C111%2C108%2C111%2C115%2C104%2C101%2C114%29%2C1%29%2Cname_const%28CHAR%28111%2C108%2C111%2C108%2C111%2C108%2C111%2C115%2C104%2C101%2C114%29%2C1%29%29a%29%20- -%20and%201%3D1

...instead of the usual domain.com/prices. First I thought, it could be an issue with the configuration of nginx, but now I think it is a different topic here. Anybody a hint what can cause this behaviour? If you need more information, please let me know, I will try to provide it as soon as possible. Many thanks in advance for your help!

UPDATE

I just have seen, that it depends on the extension real url. I need to check, how this extension needs to be configured.

dns_nx
  • 101
  • 4
  • That looks more like an attempt at a SQL injection attack. Are you sure this traffic is legitimate? Are you sure your site is not compromised? – Michael Hampton Jul 27 '20 at 19:18
  • Actually I cannot say for sure. I will try to find out. But the loaded page from the link(s) are looking correctly, when I click on it. The content is correct. – dns_nx Jul 27 '20 at 21:20

1 Answers1

0

Ok. Now I found the solution. It was a config setting of my typo3 installtion:

config.linkVars

which was set initially to

config.linkVars = L

After I found this bug report

https://github.com/dmitryd/typo3-realurl/issues/333

I saw that I need to limit the L-value for security reasons. In our case 0 for german, 1 for english, 2 for french:

config.linkVars = L(0-2)

Then all worked fine.

dns_nx
  • 101
  • 4