Qwissit TYPO3

TYPO3 security

Access control and IDOR

12 of 60 questions in the app

Broken access control

  1. What does broken access control mean? Easy

IDOR

  1. What is an IDOR hole (insecure direct object reference)? Easy
  2. What is often enough to retrieve foreign records with an IDOR hole? Easy
  3. What is the typical consequence of an IDOR hole in a form plugin? Easy

Extbase

  1. How does an Extbase controller load an order safely? Easy

Function rights

  1. What is a missing function-level access check? Easy

Frontend access

  1. How do you protect content in the frontend for certain users? Easy
  2. Does a page that is not linked anywhere protect its content? Easy

Extbase

  1. How does an Extbase controller load an order that should belong only to its owner? Medium
  2. Which calls lift built-in barriers in Extbase repositories and belong in the code only deliberately? Medium

Extbase

  1. A shop plugin shows orders with showAction(Order $order). Fluid builds the link with the uid. Which corrections close the IDOR hole? Hard

Trusted properties

  1. A form for editing one's own profile sends __identity. An attacker inserts a foreign uid. Which statements are correct? Hard

Certifications & exams

Which exam comes next?

You can already practise for 19 exams, and 21 are up for a vote. See all certifications with their official information, cast your vote or suggest your exam.

See all certifications