---
title: "Deprecation: #85196 - Protect SetupModuleController"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:deprecation-85196"
source: "Changelog/9.4/Deprecation-85196-ProtectSetupModuleController.rst"
typo3-version: "9.4"
typo3-major: 9
type: "deprecation"
issue: 85196
forge: "https://forge.typo3.org/issues/85196"
tags: ["Backend", "PHP-API", "PartiallyScanned", "ext:setup"]
rendered: "2026-09-17T12:41:04+00:00"
---

# Deprecation: #85196 - Protect SetupModuleController {#deprecation-85196-protect-setupmodulecontroller}

See [forge#85196](https://forge.typo3.org/issues/85196)

## Description {#description}

This file is about third party usage (consumer that call the class as well as
signals or hooks depending on it) of `\TYPO3\CMS\Setup\Controller\SetupModuleController`.

A series of class properties changed visibility to protected.
They will trigger PHP `E_USER_DEPRECATED` errors if called from outside:

-   `$OLD_BE_USER`
-   `$MOD_MENU`
-   `$MOD_SETTINGS`
-   \[not scanned\] `$content`
-   `$overrideConf`
-   `$languageUpdate`

These methods have been marked as deprecated and will be removed with TYPO3 v10:

-   `getFormProtection()`
-   `simulateUser()`

## Impact {#impact}

Calling one of the methods mentioned above or accessing one of the properties on an instance of
`SetupModuleController` will trigger a PHP `E_USER_DEPRECATED` error in TYPO3 v9 and a PHP fatal error in TYPO3 v10.

## Affected Installations {#affected-installations}

The extension scanner will find most usages, but may also find some false positives. The most
common property and method names like `$content` are not registered and will not be found
if an extension uses that on an instance of `SetupModuleController`.

## Migration {#migration}

In general, extensions should not instantiate and re-use controllers of the core. Existing
usages should be rewritten to be free of calls like these.