68 lines
2.5 KiB
ReStructuredText
68 lines
2.5 KiB
ReStructuredText
:navigation-title: Security
|
|
|
|
.. include:: /Includes.rst.txt
|
|
.. _security:
|
|
|
|
=========================================
|
|
Security considerations regarding exports
|
|
=========================================
|
|
|
|
Exported content in TYPO3 can contain sensitive or restricted information that
|
|
needs to be properly secured. This document outlines the recommended best
|
|
practices for managing the security risks associated with exporting content.
|
|
The following sections explain:
|
|
|
|
- Why you should **disable the export extension when not in use** to reduce
|
|
the risk of unintentional data exposure.
|
|
- How to **prevent unauthorized access** by restricting the visibility of
|
|
export options in the TYPO3 interface.
|
|
- Why it is important to **secure the export directory** to block unauthorized
|
|
file access on different webserver setups.
|
|
- How to **report a security issue** to the TYPO3 Security Team if you
|
|
identify vulnerabilities not addressed in this guide.
|
|
|
|
.. contents:: Table of contents
|
|
|
|
.. _security-disable-extension:
|
|
|
|
Disable the extension when not in use
|
|
=====================================
|
|
|
|
Exported content may contain sensitive and restricted information related to
|
|
your site. It is recommended that this extension be deactivated when it is not
|
|
in use to prevent content being exported in error.
|
|
|
|
.. _security-prevent-unauthorized-access:
|
|
|
|
Prevent unauthorized access
|
|
===========================
|
|
|
|
The export function is available by default for editors without admin rights.
|
|
It is limited to content to which the editor has access. The export
|
|
functionality can be hidden in the editor's context menu by using the user
|
|
TSconfig setting :ref:`contextMenu disableItems
|
|
<t3tsref:useroptions-contextMenu-key-disableItems>`.
|
|
|
|
Note that it cannot be completely disabled as there are currently other entry
|
|
points.
|
|
|
|
.. _security-secure-export-directory:
|
|
|
|
Secure the export directory
|
|
===========================
|
|
|
|
Exports are stored in :path:`fileadmin/user_upload/_temp_/importexport/`.
|
|
TYPO3 will automatically create a :file:`.htaccess` file to prevent access to
|
|
this folder from external sources. On Nginx webservers, the :file:`.htaccess`
|
|
file has no effect. Follow the :ref:`Security guidelines for System
|
|
Administrators <t3coreapi:security-administrators>` to find out how to prevent
|
|
access to specific directories on Nginx webservers.
|
|
|
|
.. _security-reporting-issue:
|
|
|
|
Reporting a security issue
|
|
==========================
|
|
|
|
If you believe you have found a security-related issue that is not listed
|
|
here, please contact the :ref:`TYPO3 Security Team <t3coreapi:security-team>`.
|