causal/fal-protect

Protect everything within /fileadmin/ based on associated folder and file restrictions (visibility, user groups and dates of publication).

1.6.3 2024-12-13 14:32 UTC

Requires

• php: >=7.2.0 <=7.4.99 || >=8.0.0 <=8.4.99
• typo3/cms-core: ^10 || ^11 || ^12 || ^13

GPL-2.0-or-later

• Xavier Perseguers

• security
• files
• secure
• protection
• directories
• TYPO3 CMS
• fal

README

This extension protects everything within /fileadmin/ or other relative storages based on associated folder and file restrictions (visibility, user groups and dates of publication):

Unlike other similar extensions securing the File Abstraction Layer (FAL) of TYPO3, this extension aims at making it straightforward to block direct access to your sensitive assets.

No need to configure anything, just install and enable as usual, block direct access at the server level (Apache/Nginx see below) and... that's it!

Our motto? KISS!

Installation (Apache)

Edit file .htaccess to read:

RewriteCond %{REQUEST_URI} !/fileadmin/_processed_/.*$
RewriteRule ^fileadmin/.*$ %{ENV:CWD}index.php [QSA,L]

BEWARE: Be sure to add this rule before any other related rule.

Installation (Nginx)

Edit your server block to read:

location / {
    rewrite ^/fileadmin/(?!(_processed_/)) /index.php last;

    # snip
}

or, if that better fits your setup, like that:

location ~ /fileadmin/(?!(_processed_/)) {
    rewrite ^(.+)$ /index.php last;
}

Why 404 instead of 403 by default?

In case you try to access a restricted file and do not have the right to do so, the logical HTTP status code to use should be either a 403 Forbidden (or possibly a 401 Unauthorized) but by doing so, you make it clear for a malicious user that the resource exists but is not accessible.

We prefer, by default, to issue a 404 Not Found but you can freely choose to issue a 403 Forbidden in the extension settings. This is particularly useful if you plan to redirect to a login page when a user tries to access a restricted resource.

Complete documentation

A more complete documentation can be found on https://docs.typo3.org/p/causal/fal-protect/main/en-us/.