public static function FileStorage::htaccessLines in Zircon Profile 8
Same name and namespace in other branches
- 8.0 core/lib/Drupal/Component/PhpStorage/FileStorage.php \Drupal\Component\PhpStorage\FileStorage::htaccessLines()
Returns the standard .htaccess lines that Drupal writes to file directories.
Parameters
bool $private: (optional) Set to FALSE to return the .htaccess lines for an open and public directory. The default is TRUE, which returns the .htaccess lines for a private and protected directory.
Return value
string The desired contents of the .htaccess file.
See also
file_create_htaccess()
7 calls to FileStorage::htaccessLines()
- Composer::ensureHtaccess in core/
lib/ Drupal/ Core/ Composer/ Composer.php - Ensures that .htaccess and web.config files are present in Composer root.
- DirectoryTest::testFileCheckDirectoryHandling in core/
modules/ system/ src/ Tests/ File/ DirectoryTest.php - Test directory handling functions.
- FileSaveHtaccessLoggingTest::testHtaccessSave in core/
modules/ system/ src/ Tests/ File/ FileSaveHtaccessLoggingTest.php - Tests file_save_htaccess().
- FileStorage::ensureDirectory in core/
lib/ Drupal/ Component/ PhpStorage/ FileStorage.php - Ensures the directory exists, has the right permissions, and a .htaccess.
- FileStorage::save in core/
lib/ Drupal/ Component/ PhpStorage/ FileStorage.php - Saves PHP code to storage.
File
- core/
lib/ Drupal/ Component/ PhpStorage/ FileStorage.php, line 79 - Contains \Drupal\Component\PhpStorage\FileStorage.
Class
- FileStorage
- Stores the code as regular PHP files.
Namespace
Drupal\Component\PhpStorageCode
public static function htaccessLines($private = TRUE) {
$lines = <<<EOF
# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews
# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
# Override the handler again if we're run later in the evaluation list.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
php_flag engine off
</IfModule>
EOF;
if ($private) {
$lines = <<<EOF
# Deny all requests from Apache 2.4+.
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
# Deny all requests from Apache 2.0-2.2.
<IfModule !mod_authz_core.c>
Deny from all
</IfModule>
{<span class="php-variable">$lines</span>}
EOF;
}
return $lines;
}