---
title: "Deprecation: #90147 - Unified File Name Validator"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:deprecation-90147"
source: "Changelog/10.4/Deprecation-90147-UnifiedFileNameValidator.rst"
modified: "2026-09-15T10:46:36+00:00"
---

# Deprecation: #90147 - Unified File Name Validator

See [forge#90147](https://forge.typo3.org/issues/90147)

## Description

The logic for validating if a new (uploaded) or renamed file's name is allowed
is now available in an encapsulated PHP class `FileNameValidator`.

The functionality is moved so all logic is encapsulated in one single place:

-   PHP constant `FILE_DENY_PATTERN_DEFAULT` is migrated into a class constant.
-   `LocalConfiguration.php` setting is only used when it differs from the default.
-   The `GeneralUtility` method has been marked as deprecated and calls `FileNameValidator->isValid()` directly.

This optimization helps to only utilize and use PHPs memory if
needed, and avoids to define run-time constants or variables.
Logic is only initialized when needed - e.g. when uploading files or using TYPO3's importer via EXT:impexp.

In addition, the PHP constant `PHP_EXTENSIONS_DEFAULT` which is not
in use anymore, has been marked as deprecated, too.

## Impact

Using the method `GeneralUtility::verifyFilenameAgainstDenyPattern()` directly will trigger a PHP `E_USER_DEPRECATED` error.

Using the constants will continue to work but will stop doing so TYPO3 v11.0, when they will be removed.

The system-wide setting to override the default file deny pattern,
`$GLOBALS['TYPO3_CONF_VARS']['BE']['fileDenyPattern']` is only set when
different from the systems default. If it is the same, the option is not set anymore by TYPO3 Core.

## Affected Installations

TYPO3 installations with PHP code calling the mentioned method directly or using one of the global constants directly.

## Migration

Instead of calling

`GeneralUtility::verifyFilenameAgainstDenyPattern($filename)`

use

`GeneralUtility::makeInstance(FileNameValidator::class)->isValid($filename);`

Instead of using the constant `FILE_DENY_PATTERN_DEFAULT`, use `FileNameValidator::DEFAULT_FILE_DENY_PATTERN`.

For the PHP constant `PHP_EXTENSIONS_DEFAULT` there is no replacement, as it has no benefit for TYPO3 Core anymore.

The extension scanner will detect the method calls or the usage of the constants.