Configuration

Site Sets (TYPO3 13.4+)

mpc/mp-core is an aggregator that is based on mpc/mp-core-base as well as all functionalities. All you need to do is mpc/mp-core integrate it into your website. If you require fine-tuned control, add mpc/mp-core-base and select individual features.

Set roles

 

Important: When creating a custom site set, you must dependencies: [mpc/mp-core-base, …] — never mpc/mp-core. Establishing dependencies on a child set via the aggregator results in a SetRegistry recursion deadlock.

 

mpc/mp-core-base Dependencies

Required: typo3/form, typo3/redirects, typo3/indexed-search

Optional (used during installation): georgringer/news-recordlinks, georgringer/news-sitemap, mpc/mpc-vidply, mpc/mpc-rss

Enabling sets

Backend: Site management -> Sites -> ‘Sets’ tab -> Enable and organise sets.

YAML (config/sites/[site]/config.yaml):

base: 'https://example.com'
rootPageId: 1
dependencies:
  - mpc/mp-core

Or select individual sets specifically:

dependencies:
  - mpc/mp-core-base
  - mpc/mp-core-container
  - mpc/mp-core-seo

Website settings

Can be edited via Website Management → Websites → Settings or config/sites/[site]/settings.yaml.

Regenerate after changes settings.definitions.yaml / settings.yaml:

node Documentation/scripts/sync-site-settings.mjs

Core (shared — mpc/mp-core / registered via mpc/mp-core-base)

Definitions and default values for website settings can be found in Configuration/Sets/mp-core/settings.definitions.yaml and settings.yaml. The base set simply refers to these files.

Source: Configuration/Sets/mp-core/

 

Schema Standard — default in settings.definitions.yaml (‘Website Settings’ user interface). Default value provided – value from settings.yaml if it overrides the schema (column — = as in the schema).

 

PIDs

Configuration

Value

Navigation

Meta

Templates & Paths

Container (mpc/mp-core-container)

Source: Configuration/Sets/mp-core-container/

Messages (mpc/mp-core-news)

Source: Configuration/Sets/mp-core-news/

Form (mpc/mp-core-form)

Source: Configuration/Sets/mp-core-form/

SEO (mpc/mp-core-seo)

Source: Configuration/Sets/mp-core-seo/

Using settings in TypoScript

Website settings are defined as simple TypoScript constants under their dotted key (without settings. prefix), e.g. {$navigation.maxDepth}, {$config.admPanel}, {$PIDs.pidWebFonts}. The path settings (pageTemplates, basePath, …) are additionally provided with a settings. prefix, which is why the mpcSitepackage.* path constants must be set to {$settings.pageTemplates}.

For values that need to be resolved at render time (e.g. within config, page.metaor in DataProcessor properties), read them directly via the site:settings.* data getter rather than via a constant:

# Flat constant (resolved at TypoScript parse time)
page.10.dataProcessing.110.levels = {$navigation.maxDepth}

# Runtime getter (preferred for config / meta / processor stdWrap)
config.compressJs.data = site:settings.performance.compressJs // {$config.compressJs}
page.meta.robots.data = site:settings.meta.robots

Font design tokens are not used via TypoScript: they are generated from the web font data sets (see Web Fonts) WebFontProcessor and as custom CSS properties in Resources/Private/Partials/Page/Styles.html.

Web fonts

Editors can host their own fonts (uploaded to or selected from the file manager) instead of using system fonts. This feature replaces the previous design.fonts.* string settings.

Data model

The ‘Applies to’ field for a family assigns it to a custom CSS property:

Editor workflow

1. Create a system folder to store the records and set its page ID in the PIDs.pidWebFonts website setting. Leave the setting set to 0 to store the records on the website’s root page.
2. In the list module for this folder, create a web font family: enter the font family name (e.g. Inter), a fallback stack (e.g. sans-serif) and select ‘Applies to’.
3. Add one font per weight/style. Upload a file via the file manager or select a woff2 file via the file manager and set the weight (100–900) and style (normal/italic).
4. Clear the front-end cache. WebFontProcessor This generates the @font-face rules and the :root variable assignments in the nonce-protected inline block <style> block in the page <head>.

rendering pipeline

Webfont records (FAL files)
  -> WebFontProcessor (page.headerData.2040.dataProcessing.20)
  -> WebFontCssBuilder (validate + sanitize, build @font-face + :root CSS)
  -> {webFontsCss} in Styles.html
  -> <f:asset.css useNonce="1"> + mpc:format.cssSanitize

All values are checked against fixed whitelists in terms of WebFontCssBuilder (weighting, style, font-display, file format, custom variable name, unicode-range), and the family name, fallback and URL are sanitised to remove any characters that might fall outside the scope of the CSS declaration, ensuring that a value provided by an attacker can never be used in the inline <style> .

Restrictions

• CSP: Self-hosted fonts with fileadmin are ‘Same-Origin’ and are already restricted by font-src 'self' in Configuration/ContentSecurityPolicies.php. To serve fonts from a different domain, that origin must be font-src via a site-specific config/sites/<id>/csp.yaml.
• Backend permissions: Administrators can edit the entries immediately. Backend groups without administrator rights require tables_modify (and tables_select) for tx_mpcore_domain_model_webfontfamily and tx_mpcore_domain_model_webfontface.
• A family is only displayed if it contains at least one face with a resolvable font file; otherwise, the :root assignment is skipped (the family name alone would not load anything).

Website configuration (config.yaml)

In addition to the website settings, mp-core extends the website data set and website language by Configuration/SiteConfiguration/Overrides/sites.php. Configure these under ‘Site Management’ → ‘Sites’ → [Site] → ‘Configuration’ (or under config/sites/[site]/config.yaml).

Language-specific palettes: copyrightText, logo fields and logoText / logoTextHidden may vary depending on the website’s language.

TypoScript structure

Configuration/
├── ContentSecurityPolicies.php     # Frontend CSP mutations auto-applied when
│                                   # the `security.frontend.*ContentSecurityPolicy`
│                                   # feature toggle is on (see "Content Security
│                                   # Policy" below)
├── Services.yaml                   # PSR-4 autowiring for `Mpc\MpCore\*`; explicit
│                                   # `public: true` for DataProcessors and the
│                                   # `ColorPickerValueItems` itemsProcFunc; optional
│                                   # `Services.local.yaml` import (see below)
├── Services.local.yaml             # (optional, gitignored) local-only DI overrides
├── Sets/
│   ├── mp-core/
│   │   ├── config.yaml               # Aggregator (depends on all feature sets)
│   │   ├── settings.yaml             # Shared Site Settings defaults
│   │   ├── settings.definitions.yaml # Shared Site Settings schema
│   │   ├── constants.typoscript, setup.typoscript, page.tsconfig
│   ├── mp-core-base/
│   │   └── config.yaml               # System deps + pointers to mp-core settings
│   ├── mp-core-container/
│   │   ├── config.yaml, settings.yaml, settings.definitions.yaml
│   │   ├── constants.typoscript, setup.typoscript
│   ├── mp-core-news/
│   │   ├── config.yaml, settings.yaml, settings.definitions.yaml
│   │   ├── constants.typoscript, setup.typoscript
│   ├── mp-core-form/
│   │   ├── config.yaml, settings.yaml, settings.definitions.yaml
│   │   ├── constants.typoscript, setup.typoscript
│   └── mp-core-seo/
│       ├── config.yaml, settings.yaml, settings.definitions.yaml
│       ├── constants.typoscript, setup.typoscript
├── TypoScript/
│   ├── constants.typoscript, setup.typoscript
│   ├── VueComponents.typoscript
│   ├── Helper/PageClass.typoscript
│   ├── Constants/*.typoscript
│   └── Setup/
│       ├── 10.Config, 20.Page, 30.Page.Styles, 40.Page.Scripts
│       ├── 50.Page.Navigation, 60.Lib, 90.CleanupRTE
│       ├── Page/*.typoscript
│       └── ContentElements/tt_content/*.typoscript
└── Extensions/
    ├── constants.typoscript, setup.typoscript

Dependency injection (Services.yaml)

Configuration/Services.yaml automatically binds the Mpc\MpCore\* namespace and registers the services that TYPO3 needs to resolve outside the container as public: true:

DI overrides that are only valid locally (Services.local.yaml)

The delivered Services.yaml imports an optional sibling file with ignore_errors: not_found, so that projects can register locally scoped services (tooling commands, ad hoc helpers) without modifying the published file or interrupting container compilation if the file is missing:

# Configuration/Services.local.yaml  (gitignored)
services:
  Mpc\MpCore\Command\ImportDocumentationCommand:
    tags:
      - { name: console.command, command: 'docsite:import' }

Configuration/Services.local.yaml is listed in .gitignore listed for precisely this pattern.

Content Security Policy (ContentSecurityPolicies.php)

Configuration/ContentSecurityPolicies.php contains a strict front-end CSP, which is automatically applied by TYPO3 13.4+ as soon as one of these feature toggles is enabled (System -> Settings -> Feature Toggles):

• security.frontend.enforceContentSecurityPolicy -- Enforcement mode
• security.frontend.reportContentSecurityPolicy -- Report-only mode

The included policy modifies the default TYPO3 front-end settings as follows:

Overrides per website

Operators can configure the policy per website via config/sites/<id>/csp.yaml:

inheritDefault: true
mutations:
  - mode: extend
    directive: img-src
    sources: ["https://cdn.example.com"]
  - mode: extend
    directive: form-action
    sources: ["https://newsletter.example.com"]

configuration of the trust boundary colour for the website

inline CSS variables in Resources/Private/Partials/Page/Styles.html are now forwarded via the mpc:format.cssColor ViewHelper, which is passed to Mpc\MpCore\Service\CssColorValidator. Only syntactically valid CSS colours (named, #rgb[a], #rrggbb[aa], rgb()/rgba()/hsl()/hsla()) are output; incorrect or attacker-provided website configuration entries are silently discarded, so that they never leave the inline <style> .

The same validator is also used in Mpc\MpCore\UserFunc\ColorPickerValueItems , so that the backend colour picker’s drop-down menu also filters out invalid slots and limits the labels to 200 characters.

Template path configuration

page.10 = FLUIDTEMPLATE
page.10 {
  templateRootPaths {
    0 = EXT:mp_core/Resources/Private/Templates/Page/
    10 = {$settings.pageTemplates}
  }
  partialRootPaths {
    0 = EXT:mp_core/Resources/Private/Partials/
    10 = {$settings.pagePartials}
  }
  layoutRootPaths {
    0 = EXT:mp_core/Resources/Private/Layouts/
    10 = {$settings.pageLayouts}
  }
}

Path priority: 0 = Core, 10 = Extension, 20+ = Project. Higher numbers take precedence over lower ones.

Overrides by extensions

plugin.tx_news.view.templateRootPaths.10 = EXT:mp_core/Resources/Extensions/news/Templates/
plugin.tx_form.view.templateRootPaths.10 = EXT:mp_core/Resources/Extensions/form/Templates/
plugin.tx_indexedsearch.view.templateRootPaths.10 = EXT:mp_core/Resources/Extensions/indexed_search/Templates/

Conditional configuration

Navigation bundles depend on the ‘Site Configuration’ field navType (see Configuration/SiteConfiguration/Overrides/sites.php):

[traverse(site("configuration"), "navType") == "1"]
  page.includeJSFooter.navigationPrimary = EXT:mp_core/Resources/Public/JavaScripts/navigationPrimary.js
[END]

TCA overwrites

Quick overview

Page fields (pages.php)

Global Link Wizard (tt_content_00_base.php)

Palette: link_config

Custom content elements

File metadata / links

Common customisation patterns

Adding a field to an existing element

$myColumns = [
    'tx_my_field' => [
        'label' => 'My Field',
        'config' => ['type' => 'input', 'size' => 30],
    ],
];
ExtensionManagementUtility::addTCAcolumns('tt_content', $myColumns);
ExtensionManagementUtility::addToAllTCAtypes('tt_content', 'tx_my_field', 'textmedia', 'after:bodytext');

Database schema

Add columns ext_tables.sqland then run ‘Admin Tools’ -> ‘Maintenance’ -> ‘Analyse database structure’.

CREATE TABLE tt_content (
    tx_my_field varchar(255) DEFAULT '' NOT NULL
);

Tips

1. Use existing pallets from tt_content_00_base.php and tt_content_00_header.php
2. Prefix custom fields with tx_ to avoid conflicts
3. Use ‘LLL:EXT:...’ references for all labels
4. Use ‘displayCond’ for conditional field visibility: 'displayCond' => 'FIELD:my_toggle:=:1'
5. Use ‘Site Settings’ instead of hard-coded TypoScript values
6. Observe the path numbering: 0 (Core), 10 (Extension), 20+ (Project)

Further information

• Backend – RTE, ‘TSconfig’ page, content preview
• Content elements – TCA field reference per CType
• Frontend – Build system and asset pipeline
• Favicons – Favicon generation
• TYPO3 TCA Reference
• TYPO3 Site Sets
• TYPO3 TypoScript Reference
• b13/container