FileStorage::htaccessLines

public static FileStorage::htaccessLines($private = TRUE)

Returns the standard .htaccess lines that Drupal writes to file directories.

Parameters

bool $private: (optional) Set to FALSE to return the .htaccess lines for an open and public directory. The default is TRUE, which returns the .htaccess lines for a private and protected directory.

Return value

string The desired contents of the .htaccess file.

File

core/lib/Drupal/Component/PhpStorage/FileStorage.php, line 74

Class

FileStorage: Stores the code as regular PHP files.

Namespace

Drupal\Component\PhpStorage

Code

public static function htaccessLines($private = TRUE) {
  $lines = <<<EOF
# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews
 
# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
 
# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>
EOF;
 
  if ($private) {
    $lines = <<<EOF
# Deny all requests from Apache 2.4+.
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>
 
# Deny all requests from Apache 2.0-2.2.
<IfModule !mod_authz_core.c>
  Deny from all
</IfModule>
$lines
EOF;
  }
 
  return $lines;
}

Links:

https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Component%21PhpStorage%21FileStorage.php/function/FileStorage%3A%3AhtaccessLines/8.2.x

doc_Drupal

2025-01-10 15:47:30

Comments