TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:09 +02:00
commit af8cc155b5
6818 changed files with 642608 additions and 0 deletions
@@ -0,0 +1,120 @@
+.. include:: /Includes.rst.txt
+
+.. _deprecation-87889-1705928143:
+
+=================================================================
+Deprecation: #87889 - TYPO3 backend entry point script deprecated
+=================================================================
+
+See :issue:`87889`
+
+Description
+===========
+
+The TYPO3 backend entry point script `/typo3/index.php` is no longer needed and
+deprecated in favor of handling all backend and frontend requests with `/index.php`.
+It is still in place in case webserver configuration has not been adapted yet.
+
+Note that the maintenance tool is still available via `/typo3/install.php`.
+
+
+Impact
+======
+
+The TYPO3 backend route path is made configurable in order to protect against
+application admin interface infrastructure enumeration (`WSTG-CONF-05`_).
+Therefore, all requests are handled by the PHP script `/index.php` in order to
+allow for variable admin interface URLs.
+(via :php:`$GLOBALS['TYPO3_CONF_VARS']['BE']['entryPoint']`).
+
+
+Affected installations
+======================
+
+All installations using the TYPO3 backend `/typo3`.
+
+
+Migration
+=========
+
+There is a silent update in place which automatically updates the
+webserver configuration file when accessing the install tool, at
+least for Apache and Microsoft IIS webservers.
+
+Note: This does not work if you are not using the default configuration,
+which is shipped with Core and automatically applied during the TYPO3
+installation process, as basis.
+
+If you however use a custom web server configuration you may adapt as follows:
+
+
+Apache configuration
+--------------------
+
+It is most important to rewrite all `typo3/*` requests to `/index.php`, but also
+`RewriteCond %{REQUEST_FILENAME} !-d` should be removed in order for a request
+to `/typo3/` to be directly served via `/index.php` instead of the deprecated
+entry point `/typo3/index.php`.
+
+Apache configuration before:
+
+.. code-block:: apache
+   :emphasize-lines: 2-4
+
+   RewriteCond %{REQUEST_FILENAME} !-f
+   RewriteCond %{REQUEST_FILENAME} !-d
+   RewriteCond %{REQUEST_FILENAME} !-l
+   RewriteRule ^typo3/(.*)$ %{ENV:CWD}typo3/index.php [QSA,L]
+
+   RewriteCond %{REQUEST_FILENAME} !-f
+   RewriteCond %{REQUEST_FILENAME} !-d
+   RewriteCond %{REQUEST_FILENAME} !-l
+   RewriteRule ^.*$ %{ENV:CWD}index.php [QSA,L]
+
+
+Apache configuration after:
+
+.. code-block:: apache
+   :emphasize-lines: 2
+
+   RewriteCond %{REQUEST_FILENAME} !-f
+   RewriteRule ^typo3/(.*)$ %{ENV:CWD}index.php [QSA,L]
+
+   RewriteCond %{REQUEST_FILENAME} !-f
+   RewriteCond %{REQUEST_FILENAME} !-d
+   RewriteCond %{REQUEST_FILENAME} !-l
+   RewriteRule ^.*$ %{ENV:CWD}index.php [QSA,L]
+
+
+Nginx configuration
+-------------------
+
+Nginx configuration before:
+
+.. code-block:: nginx
+   :emphasize-lines: 3
+
+    location /typo3/ {
+        absolute_redirect off;
+        try_files $uri /typo3/index.php$is_args$args;
+    }
+
+Nginx configuration after:
+
+.. code-block:: nginx
+   :emphasize-lines: 3
+
+    location /typo3/ {
+        absolute_redirect off;
+        try_files $uri /index.php$is_args$args;
+    }
+
+
+Related
+=======
+
+- :ref:`feature-87889-1705931337`
+
+.. _WSTG-CONF-05: https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/05-Enumerate_Infrastructure_and_Application_Admin_Interfaces
+
+.. index:: Backend, NotScanned, ext:backend