Skip to content

UserIntegration uses GeneralUtility::getIndpEnv(), deprecated in TYPO3 v14.3 — corrupts backend AJAX responses when display_errors is on #125

Description

@contemas-tschmidt

Problem

UserIntegration::processEvent() calls GeneralUtility::getIndpEnv('REMOTE_ADDR'), which TYPO3 deprecated in v14.3:

https://github.com/networkteam/sentry_client/blob/master/Classes/Integration/UserIntegration.php#L42

Deprecated: GeneralUtility::getIndpEnv() is deprecated since TYPO3 v14.3 and will be
removed in TYPO3 v15.0. Use NormalizedParams from the PSR-7 request instead.
in .../vendor/typo3/cms-core/Classes/Utility/GeneralUtility.php on line 2148

Because the event processor runs whenever an event is captured, the notice is emitted on ordinary requests. On a server with display_errors=On PHP prints it into the response body — and since it is emitted before the payload, it corrupts backend AJAX responses. In our case it took out the page tree entirely:

/typo3/ajax/page/tree/fetchData returned

<br /><b>Deprecated</b>: GeneralUtility::getIndpEnv() is deprecated ...<br />{"allowDragMove":true,...}

so JSON.parse failed in the browser and the tree stayed empty. Setting reportUserInformation = none works around it, because UserIntegration is only registered when that setting is not none — at the cost of losing user id and anonymised IP on all events.

Yes, display_errors=On in production is our problem and we fixed that too. But with TYPO3 v15 the method is gone, so this needs a change regardless.

Environment

  • networkteam/sentry-client 6.0.0 (latest release)
  • TYPO3 14.3.5, PHP 8.4

Suggested fix

NormalizedParams has been available since TYPO3 9.2 (changelog), so it is present in every version this extension supports (^12.0 || ^13.0 || ^14.0) — no version constraint would have to be dropped:

$ipAddress = null;
$request = $GLOBALS['TYPO3_REQUEST'] ?? null;
if ($request instanceof ServerRequestInterface) {
    $normalizedParams = $request->getAttribute('normalizedParams');
    if ($normalizedParams instanceof NormalizedParams) {
        $ipAddress = $normalizedParams->getRemoteAddress();
    }
}
if (is_string($ipAddress) && $ipAddress !== '') {
    $userData['ip_address'] = IpAnonymizationUtility::anonymizeIp($ipAddress);
}

ServerRequestInterface is already imported in the file. Guarding on the request being present also keeps the CLI path safe, which seems worth having given #121.

Happy to open a PR if you'd like it in that shape.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions