TYPO3 8.7/9.5 pibase $_POST not available?

Question

i am reworking some old typo3 project extensions. the problem is we have to stay on that pibase structure as it is supported by core anyway. so that extension does some simple CRUD operations, in my case an insert based on submitted values via $_POST. so the old extension just used $_POST directly which is not supported anymore, i guess since the PSR-7 Request/Response implementation.

but now how can i access the submitted values since $_POST is not available anymore and i do not have $this->request either because the extension extends AbstractPlugin.

edit: also we are not inside main() the codeblock is within sendMail()

i also have no idea were sendMail gets called from as there is no available documentation for pibase.

help is much appreciated

Answer 1

you can access the GET and POST parameters with \TYPO3\CMS\Core\Utility\GeneralUtility::_GP('name')

but for security reasons that might be filtered away.

we have the concept of cHashes which secure the site against injected parameter. all parameters must be known and are secured aby a hash. TYPO3 remembers the parameter by the cHash. if a cHash is given, the paramters are fetched from database and paramters given to the server are ignored.

for forms (like ext:form or ext:powermail) there are no cHashes generated and the fields of the form can be processed.

if you have 'naked' forms and plain php-files to process, you should change to a form extension where you can use the existing finishers and can add addional finishers (and validators), for these finishers the form data is secured against injection and you do not need to access $_GET or $_POST.

EDIT:
Here is a question/answer how to disable cHash calculation for single form values: TYPO3 - Deactivating cHash in own extension - 8LTS