From 8d812a648b3817112fe5fcb81e0a0e7ccc1800c0 Mon Sep 17 00:00:00 2001
From: Andreas Kokott <kokott@brainworxx.de>
Date: Fri, 27 Feb 2026 14:00:35 +0100
Subject: [PATCH] fix fileupload hmac validation, handle multi or single
 property value for upload formfield

---
 .../TypeConverter/UploadedFileReferenceConverter.php   |  3 ++-
 .../ViewHelpers/Form/UploadedResourceViewHelper.php    | 10 ++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/Classes/Mvc/Property/TypeConverter/UploadedFileReferenceConverter.php b/Classes/Mvc/Property/TypeConverter/UploadedFileReferenceConverter.php
index f2f01b5..32f9552 100644
--- a/Classes/Mvc/Property/TypeConverter/UploadedFileReferenceConverter.php
+++ b/Classes/Mvc/Property/TypeConverter/UploadedFileReferenceConverter.php
@@ -8,6 +8,7 @@
 use TYPO3\CMS\Core\SingletonInterface;
 use TYPO3\CMS\Core\Utility\GeneralUtility;
 use TYPO3\CMS\Extbase\Error\Error;
+use TYPO3\CMS\Form\Security\HashScope;
 use TYPO3\CMS\Extbase\Property\PropertyMappingConfigurationInterface;
 use TYPO3\CMS\Form\Mvc\Property\Exception\TypeConverterException;
 use TYPO3\CMS\Form\Mvc\Property\TypeConverter\PseudoFileReference;
@@ -70,7 +71,7 @@ protected function convertFromPointerToResource($source, $targetType, array $con
                     try {
                         // File references use numeric resource pointers, direct
                         // file relations are using "file:" prefix (e.g. "file:5")
-                        $resourcePointer = $this->hashService->validateAndStripHmac($resourcePointerSource);
+                        $resourcePointer = $this->hashService->validateAndStripHmac($resourcePointerSource,HashScope::ResourcePointer->prefix());
                         if (strpos($resourcePointer, 'file:') === 0) {
                             $fileUid = (int)substr($resourcePointer, 5);
                             $resource = $this->createFileReferenceFromFalFileObject($this->resourceFactory->getFileObject($fileUid));
diff --git a/Classes/ViewHelpers/Form/UploadedResourceViewHelper.php b/Classes/ViewHelpers/Form/UploadedResourceViewHelper.php
index 7872a93..2292d2c 100644
--- a/Classes/ViewHelpers/Form/UploadedResourceViewHelper.php
+++ b/Classes/ViewHelpers/Form/UploadedResourceViewHelper.php
@@ -104,15 +104,20 @@ public function render(): string
         $this->tag->addAttribute('type', 'file');
 
         if (isset($this->arguments['multiple'])) {
+            $multiple = true;
             $this->tag->addAttribute('name', $name . '[]');
         } else {
             $this->tag->addAttribute('name', $name);
+            $multiple = false;
         }
 
         $this->setErrorClassAttribute();
         $output .= $this->tag->render();
 
         if ($resources !== null) {
+            if ($resources instanceof FileReference) {
+                $resources = [$resources];
+            }
             foreach ($resources as $key => $resource) {
                 $resourcePointerIdAttribute = '';
                 if ($this->hasArgument('id')) {
@@ -126,6 +131,9 @@ public function render(): string
                 }
                 $output .= '<input type="hidden" name="' . htmlspecialchars($this->getName()) . '[submittedFile][resourcePointer][]" value="' . htmlspecialchars($this->hashService->appendHmac((string)$resourcePointerValue, HashScope::ResourcePointer->prefix())) . '"' . $resourcePointerIdAttribute . ' />';
             }
+            if ($multiple == false) {
+                $resources = reset($resources);
+            }
             $this->templateVariableContainer->add($as, $resources);
             $output .= $this->renderChildren();
             $this->templateVariableContainer->remove($as);
@@ -157,6 +165,8 @@ protected function getUploadedResources()
                 $ex = $this->propertyMapper->convert($resource, FileReference::class);
                 $return = array_merge($return, $ex);
             }
+        } elseif ($resources instanceof FileReference) {
+            return $resources;
         }
         return $return;
     }