Constants

FILE_DENY_PATTERN_DEFAULT

Default value of $GLOBALS['TYPO3_CONF_VARS']['BE']['fileDenyPattern'].

Defined in:

\TYPO3\CMS\Core\Resource\Security\FileNameValidator::FILE_DENY_PATTERN_DEFAULT

Example:

\\.(php[3-8]?|phpsh|phtml|pht|phar|shtml|cgi)(\\..*)?$|\\.pl$|^\\.htaccess$

Available in frontend:

Yes

TYPO3

TYPO3 still has some extension PHP script files executed in global context without class or callable encapsulation, namely ext_localconf.php, ext_tables.php and files within Configuration/TCA/Overrides/. When those files are located within the public document root of an instance and called via HTTP directly, they may error out and render error messages. This can be a security risk. To prevent this, those files must have a security gate as first line:

<?php

defined('TYPO3') or die();

// ... your code

It is defined to true in early TYPO3 bootstrap.