Deprecation: #90147 - Unified File Name Validator

See forge#90147

Description

The logic for validating if a new (uploaded) or renamed file's name is allowed is now available in an encapsulated PHP class FileNameValidator.

The functionality is moved so all logic is encapsulated in one single place:

  • PHP constant FILE_DENY_PATTERN_DEFAULT is migrated into a class constant.
  • LocalConfiguration.php setting is only used when it differs from the default.
  • The GeneralUtility method has been marked as deprecated and calls FileNameValidator->isValid() directly.

This optimization helps to only utilize and use PHPs memory if needed, and avoids to define run-time constants or variables. Logic is only initialized when needed - e.g. when uploading files or using TYPO3's importer via EXT:impexp.

In addition, the PHP constant PHP_EXTENSIONS_DEFAULT which is not in use anymore, has been marked as deprecated, too.

Impact

Using the method GeneralUtility::verifyFilenameAgainstDenyPattern() directly will trigger a PHP E_USER_DEPRECATED error.

Using the constants will continue to work but will stop doing so TYPO3 v11.0, when they will be removed.

The system-wide setting to override the default file deny pattern, $GLOBALS['TYPO3_CONF_VARS']['BE']['fileDenyPattern'] is only set when different from the systems default. If it is the same, the option is not set anymore by TYPO3 Core.

Affected Installations

TYPO3 installations with PHP code calling the mentioned method directly or using one of the global constants directly.

Migration

Instead of calling

GeneralUtility::verifyFilenameAgainstDenyPattern($filename)

use

GeneralUtility::makeInstance(FileNameValidator::class)->isValid($filename);

Instead of using the constant FILE_DENY_PATTERN_DEFAULT, use FileNameValidator::DEFAULT_FILE_DENY_PATTERN.

For the PHP constant PHP_EXTENSIONS_DEFAULT there is no replacement, as it has no benefit for TYPO3 Core anymore.

The extension scanner will detect the method calls or the usage of the constants.