Administrator manual

As an administrator, we make your life as lightweight as possible, unlike other similar extensions. The only point you need to tackle is to prevent direct access to /fileadmin/ at the web server level.

Note

You are naturally free to adapt the configuration to leave /fileadmin/ free to access but enable access check only for a given list of subdirectories. If so, your web server will bypass any possible restrictions the users defined to files and directories you choose to never ever protect.

Installation (Apache)

Edit file .htaccess (or your virtual host) to read:

RewriteCond %{REQUEST_URI} !/fileadmin/_processed_/.*$
RewriteRule ^fileadmin/.*$ %{ENV:CWD}index.php [QSA,L]

BEWARE: The position of this rule matters. With the .htaccess file shipped by TYPO3, add it after the "Access block for folders" and hidden files rules, so that these keep blocking _recycler_/, _temp_/ and the like, but before the rule that stops rewrite processing for known directories, which would otherwise never let the request reach TYPO3:

# Access block for folders
RewriteRule _(?:recycler|temp)_/ - [F]
# ...

# fal_protect
RewriteCond %{REQUEST_URI} !/fileadmin/_processed_/.*$
RewriteRule ^fileadmin/.*$ %{ENV:CWD}index.php [QSA,L]

# Stop rewrite processing, if we are in any known directory
RewriteRule ^(?:fileadmin/|typo3conf/|typo3temp/|uploads/) - [L]

Should a request for a file within a recycler or temporary folder reach TYPO3 nonetheless, the extension refuses it as well.

Installation (Nginx)

Edit your server block to read:

location / {
  rewrite ^/fileadmin/(?!(_processed_/)) /index.php last;

  # snip
}

or, if that better fits your setup, like that:

location ~ /fileadmin/(?!(_processed_/)) {
  rewrite ^(.+)$ /index.php last;
}

Tip

By default, files are delivered by PHP, which keeps a PHP worker busy for the whole download. On busy websites, let the web server transfer the files instead, see File delivery.

Access to exclude fields

In order for your editors to edit protection on folders, make sure they are granted access to the fe_groups field for Folder (tx_falprotect_folder):

Granting access to updating folder permissions

Similarly, editing protection on files requires access to following exclude fields of File Metadata (sys_file_metadata):

Visible (visible)
Start (starttime)
Stop (endtime)
Access (fe_groups)

In addition, make sure to allow "modify" access on both tables tx_falprotect_folder and sys_file_metadata.

Security considerations

By design, the "_processed_" folder (/fileadmin/_processed_/) is not protected and its content (thumbnails or resized/cropped images) is always freely accessible. The rules above exclude this directory from useless processing by TYPO3 but even if you ask to process absolutely everything by this extension, files within the "_processed_" folder are always public.

NOTE: Since version > 1.2.0 all ProcessedFiles are resolved to the original FAL resource. As result you can also protect the "_processed_" folder, if the resolution of the original file rights is correct for your purpose.

Recycler

TYPO3 supports the concept of a recycler folder where deleted files will automatically land, if that folder exists:

You may create as many recycler folders as you want by simply creating new folders with the name _recycler_. The behaviour is that any deleted file will land in the "nearest" recycler folder.

As such, a protected file may land at a higher level in the folder structure and thus be suddenly publicly available.

We think that files within a recycler folder should never be publicly accessible and would suggest administrators to block direct access to any recycler folder at the server level (taken from the suggested configuration for TYPO3):

Apache

RewriteRule _(?:recycler|temp)_/ - [F]

Nginx

# Restrict access to deleted files in Recycler directories
location ~ ^/fileadmin/(.*/)?_recycler_/ {
  deny all;
  access_log off;
  log_not_found off;
}

404 or 403?

By default, the extension will return a 404 Not Found error if a file is not found. This is a security measure to prevent attackers from guessing file names. If you prefer to return a 403 Forbidden error instead, you can do so by changing the default setting in the extension configuration.

Content Security Policy

TYPO3 creates a file /fileadmin/.htaccess that sends a Content-Security-Policy header for every file in the storage. It keeps uploaded HTML or SVG files from running scripts in the context of your website.

As requests to protected files are rewritten to index.php, this .htaccess file no longer applies to them. The extension therefore sends the same policies itself: a sandbox for all files, relaxed to allow inline styles for SVG files and the PDF viewer for PDF files.

If you prefer to send your own policy, e.g., from the web server configuration, disable Send Content-Security-Policy (content_security_policy) in the extension configuration.