I have noted that CiviCRM creates .htaccess with the Deny from all command in stead of the Require all denied. This causes security issues with my new setup at a hosting site.

Drupal has support for both:

# Deny all requests from Apache 2.4+.
<IfModule mod_authz_core.c>
  Require all denied

# Deny all requests from Apache 2.0-2.2.
<IfModule !mod_authz_core.c>
  Deny from all

When is CiviCRM going to support Apache 2.4?

  • This is a good catch! Are you able to submit a pull request for this improvement? – Jon G - Megaphone Tech Dec 10 '17 at 23:05

Ok. This is my first try using Github. Changed civicrm-core/CRM/Utils/File.php and committed to master branch with a proper summary and description. Change tag 875f1c8.

Do I have to do anything else? Should I enter anything in the issue list?

| improve this answer | |
  • That's great! Could you edit your answer to link to provide a link to your pull request. – William Mortada Dec 13 '17 at 9:19
  • Well, I tried, but I am not used to do this. I created a JIRA issue: issues.civicrm.org/jira/browse/CRM-21571 – Ed van Leeuwen Dec 16 '17 at 15:43
  • I have used GitHub Desktop to commit the change, but I cannot see the result in GitHub. I tried to create a pull request manually, but I am reluctant to go further in case I am messing things up . – Ed van Leeuwen Dec 16 '17 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.