Constants¶

FILE_DENY_PATTERN_DEFAULT¶

Default value of $GLOBALS['TYPO3_CONF_VARS']['BE']['fileDenyPattern'].

Defined in:

\TYPO3\CMS\Core\Resource\Security\FileNameValidator::FILE_DENY_PATTERN_DEFAULT

Example:

\\.(php[3-8]?|phpsh|phtml|pht|phar|shtml|cgi)(\\..*)?$|\\.pl$|^\\.htaccess$

Available in frontend:

Yes

TYPO3¶

TYPO3 still has some extension PHP script files executed in global context without class or callable encapsulation, namely ext_localconf.php, ext_tables.php and files within Configuration/TCA/Overrides/. When those files are located within the public document root of an instance and called via HTTP directly, they may error out and render error messages. This can be a security risk. To prevent this, those files must have a security gate as first line:

<?php

defined('TYPO3') or die();

// ... your code

It is defined to true in early TYPO3 bootstrap.

Migration¶

Migrate all usages to use the new enum \TYPO3\CMS\Core\Resource\FileType as follows:

• \TYPO3\CMS\Core\Resource\AbstractFile::FILETYPE_UNKNOWN → \TYPO3\CMS\Core\Resource\FileType::UNKNOWN->value
• \TYPO3\CMS\Core\Resource\AbstractFile::FILETYPE_TEXT → \TYPO3\CMS\Core\Resource\FileType::TEXT->value
• \TYPO3\CMS\Core\Resource\AbstractFile::FILETYPE_IMAGE → \TYPO3\CMS\Core\Resource\FileType::IMAGE->value
• \TYPO3\CMS\Core\Resource\AbstractFile::FILETYPE_AUDIO → \TYPO3\CMS\Core\Resource\FileType::AUDIO->value
• \TYPO3\CMS\Core\Resource\AbstractFile::FILETYPE_VIDEO → \TYPO3\CMS\Core\Resource\FileType::VIDEO->value
• \TYPO3\CMS\Core\Resource\AbstractFile::FILETYPE_APPLICATION → \TYPO3\CMS\Core\Resource\FileType::APPLICATION->value