Security · Question 7 of 12
Which barriers protect the standalone Install Tool at /typo3/install against unauthorized access?
2 answers are correct. Easy
Show answer
Answer
- A A file named ENABLE_INSTALL_TOOL must exist on the server
- B A separate Install Tool password is required, independent of backend passwords
Explanation
The Install Tool can reconfigure the system at the lowest level and does not require a backend login, which is why it is protected twice. First, the empty flag file ENABLE_INSTALL_TOOL must exist, in Composer installations for example in var/transient/ or config/; TYPO3 deletes it automatically after 60 minutes or on logout. Second, the Install Tool password is required, which since v14 can also be set with vendor/bin/typo3 install:password:set. In the backend, the Admin Tools are only accessible to administrators with maintainer privileges, not to editors.