---
title: "Permissions"
manual: "TYPO3 Explained"
version: "main"
permalink: "https://docs.typo3.org/permalink/t3coreapi:fal-administration-permissions@main"
source: "ApiOverview/Fal/Administration/Permissions.rst"
rendered: "2026-09-21T11:24:09+00:00"
---

# Permissions {#fal-administration-permissions}

Permissions in the file abstraction layer are the result of a
combination of various mechanisms.

-   [System permissions](https://docs.typo3.org/permalink/t3coreapi:system-permissions@main)
-   [File mounts](https://docs.typo3.org/permalink/t3coreapi:file-mounts@main)
-   [User permissions](https://docs.typo3.org/permalink/t3coreapi:user-permissions@main)
-   [Default upload folder](https://docs.typo3.org/permalink/t3coreapi:default-upload-folder@main)
-   [Frontend permissions](https://docs.typo3.org/permalink/t3coreapi:frontend-permissions@main)

## System permissions {#fal-administration-permissions-system}

System permissions are strictly enforced and may prevent an action
no matter what component triggered them.

Administrators always have full access. The only reason they might not
have access is that the underlying file system or storage service does
not allow access to a resource (for example, some file is read-only in the
local file system).

## File mounts {#fal-administration-permissions-mounts}

[File mounts](https://docs.typo3.org/permalink/t3coreapi:fal-administration-permissions-mounts@main)
restrict users to a certain folder in a certain storage. This is
an obvious permission restriction: users will never be able to act
on a file or folder outside of their allotted file mounts.

## User permissions {#fal-administration-permissions-user}

User permissions for files can be set in the
["File operation permissions" section](https://docs.typo3.org/permalink/t3coreapi:access-lists-file-permissions@main)
of the backend user or backend user group records.

It is also possible to set permissions using [user TSconfig](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/UserTsconfig/Index.html#usertsconfig),
defined either at backend user or backend user group level. The TSconfig way is
recommended because it allows for more flexibility. See some examples below and
read on in the section about [permissions](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/UserTsconfig/Permissions.html#userTsConfigPermissions)
in the user TSconfig reference.

The default permissions for backend users and backend user groups
are **read-only**:

**EXT:my_extension/Configuration/user.tsconfig**

```typoscript
permissions.file.default {
  addFile      = 0
  readFile     = 1
  writeFile    = 0
  copyFile     = 0
  moveFile     = 0
  renameFile   = 0
  deleteFile   = 0
  addFolder    = 0
  readFolder   = 1
  writeFolder  = 0
  copyFolder   = 0
  moveFolder   = 0
  renameFolder = 0
  deleteFolder = 0
  recursivedeleteFolder = 0
}

```

If no permissions are defined in TSconfig, the settings in the backend user
and in the backend user group record are taken into account and treated as
default permissions for all [storages](https://docs.typo3.org/permalink/t3coreapi:fal-architecture-components-storage@main).

### User permissions per storage {#fal-administration-permissions-user-storage}

Using [user TSconfig](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/UserTsconfig/Index.html#usertsconfig) it is possible to set
different permissions for different
[storages](https://docs.typo3.org/permalink/t3coreapi:fal-architecture-components-storage@main). This syntax uses the uid
of the targeted storage record.

The following example grants all permission for the storage with uid "1":

**EXT:my_extension/Configuration/user.tsconfig**

```typoscript
permissions.file.storage.1 {
  addFile      = 1
  readFile     = 1
  writeFile    = 1
  copyFile     = 1
  moveFile     = 1
  renameFile   = 1
  deleteFile   = 1
  addFolder    = 1
  readFolder   = 1
  writeFolder  = 1
  copyFolder   = 1
  moveFolder   = 1
  renameFolder = 1
  deleteFolder = 1
  recursivedeleteFolder = 1
}

```

> [!NOTE]
> Configured permissions for a *specific* storage take precedence over
> default permissions.

### User permissions details {#fal-administration-permissions-user-details}

This model for permissions behaves very similar to permission systems
on Unix and Linux systems. Folders are seen as a collection of files and
folders. If you want to change *that collection* by adding, removing or renaming
files or folders you need to have **write permissions for the folder** as well.
If you only want to change the content of a file you need write permissions
for the file but not for the containing folder.

Here is the detail of what the various permission options mean:

-   **`addFile`**

    Create new files, upload files.

-   **`readFile`**

    Show content of files.

-   **`writeFile`**

    Edit or save contents of files, even if NO write permissions to folders are granted.

-   **`copyFile`**

    Allow copying of files; needs writeFolder permissions for the target folder.

-   **`moveFile`**

    Allow moving files; needs writeFolder permissions for source and target folders.

-   **`renameFile`**

    Allow renaming files; needs writeFolder permissions.

-   **`deleteFile`**

    Delete a file; needs writeFolder permissions.

-   **`addFolder`**

    Add or create new folders; needs writeFolder permissions for the parent folder.

-   **`readFolder`**

    List contents of folder.

-   **`writeFolder`**

    Permission to change contents of folder (add files, rename files, add folders,
    rename folders). Changing contents of existing files is not governed by this
    permission!

-   **`copyFolder`**

    Needs writeFolder permissions for the target folder.

-   **`moveFolder`**

    Needs writeFolder permissions for both target and source folder (because it is
    removed from the latter, which changes the folder).

-   **`renameFolder`**

    Needs writeFolder permissions (because it changes the folder itself and also
    the containing folder's contents).

-   **`deleteFolder`**

    Remove an (empty) folder; needs write folder permissions.

-   **`recursivedeleteFolder`**

    Remove a folder even if it has contents; needs write folder permissions.

## Default upload folder {#fal-administration-permissions-upload-folder}

When nothing else is defined, any file uploaded by a user will end up
in `fileadmin/user_upload/`. The user TSconfig property
[defaultUploadFolder](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/UserTsconfig/Options.html#useroptions-defaultUploadFolder), allows
to define a different default upload folder on a backend user or backend user
group level, for example:

**EXT:my_extension/Configuration/user.tsconfig**

```typoscript
options.defaultUploadFolder = 3:users/uploads/
```

It is also possible to modify default upload folder per page
(or subtree) using page TSConfig property `options.defaultUploadFolder`,
for example:

**EXT:my_extension/Configuration/page.tsconfig**

```typoscript
# Set default upload folder to "fileadmin/page_upload" on PID 1
[page["uid"] == 1]
  options.defaultUploadFolder = 1:/page_upload/
[end]

```

There are a number of circumstances where it might be convenient
to change the default upload folder. The PSR-14 event
[AfterDefaultUploadFolderWasResolvedEvent](https://docs.typo3.org/permalink/t3coreapi:afterdefaultuploadfolderwasresolvedevent@main) exists to provide
maximum flexibility in that regard. For example, take a look at the extension
[default_upload_folder](https://github.com/beechit/default_upload_folder), which makes it possible to define a default upload
folder for a given field of a given table (using custom TSconfig).

## Frontend permissions {#fal-administration-permissions-frontend}

The system extension [filemetadata](https://packagist.org/packages/typo3/cms-filemetadata) adds a `fe_groups` field to the
[sys_file_metadata](https://docs.typo3.org/permalink/t3coreapi:fal-architecture-database-sys-file-metadata@main) table.
This makes it possible to attach frontend permissions to files. However, these
permissions are not enforced in any way by the TYPO3 Core. It is up to extension
developers to create tools which make use of these permissions.

As an example, you may want to take a look at extension
[`beechit/fal-securedownload`](https://packagist.org/packages/beechit/fal-securedownload)
which also makes use of the "Is publicly available?" property of
[File storages](https://docs.typo3.org/permalink/t3coreapi:fal-administration-storages@main).