[SECURITY] Enforce HTTP method assertions for backend modules

Resolves: #104456
Releases: main, 13.4, 12.4
Change-Id: Ic679584a343b6d35e81325a03148b0cff81f1d27
Security-Bulletin: TYPO3-CORE-SA-2025-003
Security-Bulletin: TYPO3-CORE-SA-2025-004
Security-Bulletin: TYPO3-CORE-SA-2025-005
Security-Bulletin: TYPO3-CORE-SA-2025-006
Security-Bulletin: TYPO3-CORE-SA-2025-007
Security-Bulletin: TYPO3-CORE-SA-2025-008
Security-References: CVE-2024-55893
Security-References: CVE-2024-55894
Security-References: CVE-2024-55920
Security-References: CVE-2024-55921
Security-References: CVE-2024-55922
Security-References: CVE-2024-55923
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/87744
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

Author: ohader

Classes/Controller/BackendLogController.php

@@ -25,6 +25,7 @@
 use TYPO3\CMS\Belog\Domain\Repository\LogEntryRepository;
 use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
 use TYPO3\CMS\Core\Database\ConnectionPool;
+use TYPO3\CMS\Core\Http\AllowedMethodsTrait;
 use TYPO3\CMS\Core\Type\Bitmask\Permission;
 use TYPO3\CMS\Core\Type\ContextualFeedbackSeverity;
 use TYPO3\CMS\Core\Utility\ExtensionManagementUtility;
@@ -39,6 +40,8 @@
  */
 class BackendLogController extends ActionController
 {
+    use AllowedMethodsTrait;
+
     public function __construct(
         protected readonly ModuleTemplateFactory $moduleTemplateFactory,
         protected readonly LogEntryRepository $logEntryRepository,
@@ -124,6 +127,11 @@ public function listAction(?Constraint $constraint = null, string $operation = '
             ->renderResponse('BackendLog/List');
     }
 
+    public function initializeDeleteMessageAction(): void
+    {
+        $this->assertAllowedHttpMethod($this->request, 'POST');
+    }
+
     /**
      * Delete all log entries that share the same message with the log entry given
      * in $errorUid

Resources/Private/Partials/Content/LogEntries.html

@@ -96,16 +96,16 @@ <h3>
                                     </td>
                                     <td class="col-control">
                                         <f:if condition="{logItem.error} == 1">
-                                            <f:link.action action="deleteMessage" arguments="{errorUid:logItem.uid}" class="btn btn-sm btn-warning">
+                                            <f:form.button class="btn btn-sm btn-warning" form="form-delete-message" type="submit" name="errorUid" value="{logItem.uid}">
                                                 <core:icon identifier="actions-delete" size="small"/>
                                                 <f:translate key="actions.deleteWarnings"/>
-                                            </f:link.action>
+                                            </f:form.button>
                                         </f:if>
                                         <f:if condition="{logItem.error} == 2">
-                                            <f:link.action action="deleteMessage" arguments="{errorUid:logItem.uid}" class="btn btn-sm btn-danger">
+                                            <f:form.button class="btn btn-sm btn-danger" form="form-delete-message" type="submit" name="errorUid" value="{logItem.uid}">
                                                 <core:icon identifier="actions-delete" size="small"/>
                                                 <f:translate key="actions.delete"/>
-                                            </f:link.action>
+                                            </f:form.button>
                                         </f:if>
                                         <f:if condition="{logItem.logData.history}">
                                             <a class="btn btn-sm btn-default" href="{be:moduleLink(route: 'record_history', arguments: '{historyEntry: logItem.logData.history}')}" title="{f:translate(key: 'showHistory')}">
@@ -121,6 +121,8 @@ <h3>
                 </div>
             </f:for>
         </f:for>
+
+        <f:form action="deleteMessage" id="form-delete-message" method="post" class="hidden"/>
     </f:then>
     <f:else>
         <f:be.infobox