TYPO3 Core

Georg Ringer wrote in #note-1:

Thanks for creating this issue! While we understand that this makes it a bit harder during development we still won't make it configurable because this will lead to sites in production having it disabled as well. Therefore this is neither configurable nor completely deactivated.

As solution you can either:

• open the install tool as standalone
• use cli to clear the caches

You should also consider the case when passwords are not used anymore. As an example we are using Single Sign-on providers and trying hard to get rid of all passwords. As we all know passwords are one of the main security issues in authentication processes.

Currently there is no SSO for the Install Tool – therefore we can't use the Backend Install Tool feature anymore. I can understand your point for production reasons where this feature should be deactivated anyway – but for development purposes it is really giving us a hard time now.

1) We should either make it configuration for development context (this is an admin setting and an admin should always know what he is doing)
2) SSO or LoginProvider should also work for the Install Tool.

Second, according to the TYPO3 documentation integrators should use this feature as well: https://docs.typo3.org/m/typo3/reference-coreapi/master/en-us/Security/GuidelinesIntegrators/InstallTool.html

We don't give integrators nor any developers any known passwords anymore because we are using SSO (the Install Tool password are generated randomly – fire and forget).
We are now forced to deal with passwords again, which makes the process more insecure (again).

I understand your concerns and totally agree in terms of security point of view.
But if this feature is bound to the context (means, it is or can be disabled in development-context), in my opinion there will be no security issue, as the development-context should only be used on local dev systems. An online system which runs in development-context is lost anyway.

• use cli to clear the caches

True, but not so convenient with typing all the time. Also the same issue applies for the database-migration/comparison during development...

I can totally agree with Bastian, if this feature is bound to the development context i cannot see the security concern anymore

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/68094

Patch set 1 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/68112

Patch set 1 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/68097