[UPMERGE] 5.1 -> 2026.x

[dpfaffenbauer]

Upmerge of 5.1 into 2026.x — the final leg of this round.

Remember! The upmerge should always be merged with the Merge pull request button.

⏰ Time-sensitive

The scheduled Upmerge PR workflow (cron 0 2 * * *) does git reset --hard 5.1 on this branch nightly and force-pushes it, which has destroyed a resolution here before. Merge before the next run or this has to be rebuilt.

Refreshed after #3181 merged, so 2026.x now receives the whole chain: 4.1 → 5.0 → 5.1 → 2026.x.

What it carries forward

• Fix open redirect vulnerabilities in redirect parameter handling #2963 — security fix: open redirect via the _redirect parameter, including the new login success/failure handlers
• Messenger: fix empty "Failed At" column by emitting the key the UI reads #3179 — Messenger: emit the "Failed At" date under the key the UI reads (backend half only, see below)
• Messenger: drop the redundant failedAt field from MessengerFailedMessage #3180 — Messenger: drop the redundant failedAt field from MessengerFailedMessage

Security-relevant files, all arriving intact

file	role
ResourceBundle/Controller/RedirectUrlValidationTrait.php	new — the single validateRedirectUrl() implementation
CoreBundle/Security/ShopUserAuthenticationSuccessHandler.php	new — validates the post-login redirect target
CoreBundle/Security/ShopUserAuthenticationFailureHandler.php	new — reads the failure path from the request bags directly
CoreBundle/Resources/config/services/handler.yml	wires both handlers
CoreBundle/Resources/config/pimcore/security.yml	registers both on the shop firewall
FrontendBundle/Controller/{Cart,Customer,Frontend,Register,Security}Controller.php	consume the trait instead of trusting _redirect
StorageListBundle/Controller/StorageListController.php	same
features/ui/frontend/account/login.feature, Behat/Context/Ui/Frontend/LoginContext.php	regression coverage

All three new classes verified present by path on the merged tree; exactly one validateRedirectUrl() definition exists, so nothing landed twice. Both handlers appear in handler.yml and in the firewall config.

Conflicts resolved (79 files)

78 Studio build artifacts — 5.1 rebuilt its Studio bundles into different content-hash directories than the ones committed on 2026.x. Per convention these are never rebuilt during an upmerge, so all 22 affected bundles had their entire Resources/public/studio/ tree restored verbatim from 2026.x.

1 modify/delete: MessengerBundle/Resources/public/pimcore/js/list.js — this is #3179's second half, the classic ExtJS store field. 2026.x deleted this file, along with all 463 classic ExtJS files, in 720355156f ("remove ExtJS / Classic Admin, bump Pimcore to 2026.1"). Resolved in favour of the 2026.x deletion, consistent with how the newsletter deletion is handled.

That does not lose the fix on 2026.x, which was verified rather than assumed: the Studio replacement MessengerFailedGrid.tsx already reads the corrected key (dataIndex: 'failed_at', key: 'failed_at'), and the backend on the merged tree emits 'failed_at' from both jsonSerialize() and the #[SerializedName('failed_at')] accessor. So the ExtJS half is simply not applicable here — 2026.x gets the backend fix and its own Studio grid consumes it. Zero classic ExtJS files are reintroduced by this merge.

Verification

root replace set equality (auto-merged silently, checked anyway):
  split packages: 66 | replace entries: 66 | missing [] | extra []
  sorted=True, identical to full regeneration=True
studio artifacts differing from 2026.x : 0
build directories per bundle           : 22 checked, 0 deviations
split-package composer invariant       : checked=66 bad=0
newsletter-bundle in any composer.json : 0     (#3166 deletion holds)
DocumentContext / phpstan / extension  : 0 files touched  (#3169 shape holds)
classic admin firewall in security.yml : 0 occurrences
classic ExtJS files on merged tree     : 0
frontend regex on merged tree          : ^/(?!admin|pimcore-studio)[^/]*   (#3164 intact)
root config/packages/security.yaml     : not touched

Net diff against 2026.x is 15 files — #2963's set, plus #3179's backend half and #3180's one-line removal, with #3179's ExtJS half correctly absent:

 features/ui/frontend/account/login.feature         |  7 ++
 .../Behat/Context/Ui/Frontend/LoginContext.php     |  8 ++
 .../Resources/config/pimcore/security.yml          |  2 +
 .../Resources/config/services/handler.yml          |  9 +++
 .../ShopUserAuthenticationFailureHandler.php       | 72 ++++++++++++++++++
 .../ShopUserAuthenticationSuccessHandler.php       | 41 ++++++++++
 .../FrontendBundle/Controller/CartController.php   | 14 +++-
 .../Controller/CustomerController.php              |  8 +-
 .../Controller/FrontendController.php              |  3 +
 .../Controller/RegisterController.php              |  7 +-
 .../Controller/SecurityController.php              | 21 +++++-
 .../Messenger/FailedMessageDetails.php             |  2 +-
 .../assets/pimcore-studio/src/types/index.ts       |  1 -
 .../Controller/RedirectUrlValidationTrait.php      | 87 ++++++++++++++++++++++
 .../Controller/StorageListController.php           | 10 ++-
 15 files changed, 283 insertions(+), 9 deletions(-)

php -l clean on every changed PHP file; composer validate reports only the pre-existing payum/payum warning.

Note on #2974

#2974 (parent product price / createUnmanagedCopy helper) was still open at rebuild time and createUnmanagedCopy is not present on 5.1, so the createDataCopy() conflict it is expected to cause on 2026.x does not arise in this round.

Ordering

#3183 (merged) → #3181 (merged) → this PR. This completes the round.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud