Semantilizer does not work on TYPO3 version 13.4.15 and above

[ragnarok986]

Hello,

From version 13.4.15 and above semantilizer does not work correctly in backend anymore.
It shows no headline structure at all.

Once the TYPO3 version is downgraded to 13.4.14, everything works good.

Let me know if any additional information is needed.

Best Regards

TYPO3 version: 13.4.17
z7_semantilizer version: 4.3.2
Elements created with content blocks.

[nicolekalinowski]

Hello,
same issue after upgrading TYPO3 to 12.4.36. In Version 12.4.34 semantilizer works fine.

z7_semantilizer version: 4.1.3

Best regards,
Nicole

[raphaelthanner]

Hi @ragnarok986, hi @nicolekalinowski, thanks for your report.
I tested the Semantilizer on TYPO3 12.4.36 and 13.4.17 – it works fine on my systems.
Could you check the AJAX request in the TYPO3 backend that is fetching the content? This might help to narrow down the problem.

[nicolekalinowski]

Hi @raphaelthanner. Sorry, I'm not sure how to check the AJAX request. I'm working in a docker/ddev environmental and there are two errors in the chrome dev tools.

Failed to load resource: net::ERR_FAILED for https://mysite.ddev.site/path/to#rimyngr4rs

and

Access to XMLHttpRequest at 'https://mysite.ddev.site/path/to#y1da0rxbune' from origin 'https://mysiteddev.site' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

[lwinterhalder]

Thanks for the update — we’ve released versions 4.3.3 with the fix and 4.1.3 had the fix for the the original problem in this issue already, and the other problem seems related to two different domains, which we’re looking into and will report back on soon.

[nicolekalinowski]

Hi @lwinterhalder yes true. It's a multi-domain configuration. Semantilizer works fine for the domain but not for the second and further domain. I didn't recognized that before.

[schliesser]

@lwinterhalder @nicolekalinowski I've solved the multi-domain issue for my project with a middleware to set the headers Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers. The middleware is configurable via $GLOBALS['TYPO3_CONF_VARS'] and gathers the urls from the site configs. You need to define fully qualified domains as Base in the SiteConfigs, otherwise it will not work.

Configuration:

$GLOBALS['TYPO3_CONF_VARS']['HTTP']['cors']['access-control-request-headers'][] = 'x-semantilizer';
$GLOBALS['TYPO3_CONF_VARS']['HTTP']['cors']['access-control-request-method'][] = 'GET';
$GLOBALS['TYPO3_CONF_VARS']['HTTP']['cors']['access-control-request-method'][] = 'POST';

Middleware Registration:

'my-base/cors' => [
            'target' => CrossOriginResourceSharingHeaders::class,
            'after' => [
                'typo3/cms-frontend/csp-headers',
            ],
        ],

Middleware:

<?php

declare(strict_types=1);

/*
 * This file is part of the TYPO3 CMS project.
 *
 * It is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License, either version 2
 * of the License, or any later version.
 *
 * For the full copyright and license information, please read the
 * LICENSE.txt file that was distributed with this source code.
 *
 * The TYPO3 project - inspiring people to share!
 */

namespace TWT\MyBase\Middleware;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
use Psr\Log\LoggerInterface;
use TYPO3\CMS\Core\Site\SiteFinder;
use TYPO3\CMS\Core\Utility\GeneralUtility;

/**
 * Adds Cross-Origin-Resource-Sharing headers to response.
 */
final readonly class CrossOriginResourceSharingHeaders implements MiddlewareInterface
{
    public function __construct(
        private LoggerInterface $logger,
    ) {}

    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        $response = $handler->handle($request);
        $origin = $request->getHeader('Origin')[0] ?? null;

        if (!$origin) {
            return $response;
        }

        if ($response->hasHeader('Access-Control-Allow-Origin')) {
            $this->logger->info('Access-Control-Allow-Origin not enforced due to existence of custom header', [
                'uri' => (string)$request->getUri(),
            ]);
            return $response;
        }

        // Base must be a full url definition!
        $sites = GeneralUtility::makeInstance(SiteFinder::class)->getAllSites();
        foreach ($sites as $site) {
            $base = rtrim($site->getBase()->__toString(), '/');
            if ($base === $origin) {
                $response = $response->withHeader(
                    'Access-Control-Allow-Origin',
                    $base
                );
                break;
            }
        }

        // Allow whitelisted methods
        $methods = $request->getHeader('access-control-request-method');
        $allowedMethods = [];
        if ($methods && !empty($GLOBALS['TYPO3_CONF_VARS']['HTTP']['cors']['access-control-request-method'])) {
            foreach ($methods as $method) {
                $method = strtoupper($method);
                if (in_array($method, $GLOBALS['TYPO3_CONF_VARS']['HTTP']['cors']['access-control-request-headers'], true)) {
                    $allowedMethods[] = $method;
                }
            }

            $response = $response->withHeader(
                'Access-Control-Allow-Methods',
                implode(', ', $allowedMethods)
            );
        }

        // Allow whitelisted headers
        $headers = $request->getHeader('access-control-request-headers');
        $allowedHeaders = [];
        if ($headers && !empty($GLOBALS['TYPO3_CONF_VARS']['HTTP']['cors']['access-control-request-headers'])) {
            foreach ($headers as $header) {
                $header = strtolower($header);
                if (in_array($header, $GLOBALS['TYPO3_CONF_VARS']['HTTP']['cors']['access-control-request-headers'], true)) {
                    $allowedHeaders[] = $header;
                }
            }

            $response = $response->withHeader(
                'Access-Control-Allow-Headers',
                implode(', ', $allowedHeaders)
            );
        }

        return $response;
    }
}

[raphaelthanner]

Hi together, I created a new branch: "feature/multisite-cors-headers".
Based on @schliesser 's suggestion, I implemented a preflight check that validates origins against both configured site URLs and TYPO3's trustedHostsPattern. This enables proper CORS headers for cross-origin requests, allowing the backend to fetch page heading structures from different domains.
In addition, the site URLs are added to the CSP header in TYPO3 backend.

@lwinterhalder, @schliesser, @ragnarok986 can you check this in your setup?