diff --git a/Documentation/ApiOverview/GlobalValues/Constants/Index.rst b/Documentation/ApiOverview/GlobalValues/Constants/Index.rst index 96359dc4fc..0c0a678082 100644 --- a/Documentation/ApiOverview/GlobalValues/Constants/Index.rst +++ b/Documentation/ApiOverview/GlobalValues/Constants/Index.rst @@ -69,6 +69,38 @@ Available in frontend: Yes +.. index:: + Constants; TYPO3 +.. _globals-constants-typo3: + +TYPO3 +----- + +TYPO3 still has some extension PHP script files executed in global context +without class or callable encapsulation, namely :file:`ext_localconf.php`, +:file:`ext_tables.php` and files within :file:`Configuration/TCA/Overrides/`. +When those files are located within the public document root of an instance and +called via HTTP directly, they may error out and render error messages. This can +be a security risk. To prevent this, those files **must** have a security gate +as first line: + +.. code-block:: php + + ` + * :ref:`ext_tables.php ` + * :ref:`Configuration/TCA/Overrides/ ` + + .. index:: Constants; Filetypes File types diff --git a/Documentation/ExtensionArchitecture/FileStructure/ExtLocalconf.rst b/Documentation/ExtensionArchitecture/FileStructure/ExtLocalconf.rst index 8ced1d50dc..967b968278 100644 --- a/Documentation/ExtensionArchitecture/FileStructure/ExtLocalconf.rst +++ b/Documentation/ExtensionArchitecture/FileStructure/ExtLocalconf.rst @@ -110,6 +110,7 @@ The skeleton of the :file:`ext_localconf.php` looks like this: // Add your code here })(); +Read :ref:`why the check for the TYPO3 constant is necessary `. .. index:: Extension development; PageTSconfig diff --git a/Documentation/ExtensionArchitecture/FileStructure/ExtTables.rst b/Documentation/ExtensionArchitecture/FileStructure/ExtTables.rst index 08f0b5ccbd..d79d72917a 100644 --- a/Documentation/ExtensionArchitecture/FileStructure/ExtTables.rst +++ b/Documentation/ExtensionArchitecture/FileStructure/ExtTables.rst @@ -122,6 +122,8 @@ new records of your table to be added on Standard pages call: 'tx_myextension_domain_model_mymodel' ); +Read :ref:`why the check for the TYPO3 constant is necessary `. + .. index:: Extension development; Scheduler task registration .. _extension-configuration-files-scheduler: diff --git a/Documentation/ExtensionArchitecture/HowTo/ExtendingTca/Examples/Index.rst b/Documentation/ExtensionArchitecture/HowTo/ExtendingTca/Examples/Index.rst index 52b6b05790..ca57dde078 100644 --- a/Documentation/ExtensionArchitecture/HowTo/ExtendingTca/Examples/Index.rst +++ b/Documentation/ExtensionArchitecture/HowTo/ExtendingTca/Examples/Index.rst @@ -66,6 +66,8 @@ Here's the complete code, taken from file 'tx_examples_options, tx_examples_special' ); +Read :ref:`why the check for the TYPO3 constant is necessary `. + .. note:: The second example :php:`tx_examples_special` only works when the