Compatibility with Apache v2.4

[hameau]

Apache v2.4 is now appearing in the wild. There are some steps that need to be taken to ensure compatibility, particularly with .htaccess Deny and Allow directives.

Apparently, hosting providers may not include the Apache compatibility module (but that may be a symptom of early adoption).

Forum reference (with workaround):
http://get-simple.info/forums/showthread.php?pid=40784#pid40784

Apache docs:
https://httpd.apache.org/docs/current/upgrading.html
https://httpd.apache.org/docs/current/howto/access.html

(Aside: may tie in with .htaccess rationalising - #453 )

[tablatronix]

This does not fix the .htaccess files in repo, only the tmp ones. Need to come up with a way to replace them all, or have install move these files for us, and keep them and dir structure out of the repo. But this will probably give us hell with permissions of user base.

Not sure the best way to proceed.

[tablatronix]

#770
just going to replace them all in core, and hope they are correct.
Il probably mass edit them

[tablatronix]

removed backups/other .htaccess
redundant

[tablatronix]

for some reason the inc folder has no htaccess and files that are allowed to be hit with a browser, which makes no sense for an include folder.

everything not an include needs to be removed from this and it protected with htaccess

• ajax.php
• thumb.php

#395

[tablatronix]

FYI you cannot mix old syntax with new syntax.

If you have mod_access_compat, and use order deny then you can only override it with order allow, require granted will not work

So this breaks all plugins that have htaccess files.
I need to add conditionals for apache compat AND 2.4

[tablatronix]

new solution

• If <2.3 uses old order by
• if >2.3 and has access_compat use old order by ( supports plugins htaccess )
• else use require

#
# GetSimple CMS htaccess DENY file
#

# prevent breaking plugin htaccess, prefer compat,  since require is not overridable by order

# apache < 2.3
<IfModule !mod_authz_core.c>
    Deny from all
</IfModule>

# apache > 2.3 with mod_access_compat
<IfModule mod_access_compat.c>
    Deny from all
</IfModule>

# apache > 2.3 without mod_access_compat
<IfModule mod_authz_core.c>

    <IfModule !mod_access_compat.c>
        Require all denied
    </IfModule>

</IfModule> 

Needs testing on 2.2 and 2.4 in the wild.

[tablatronix]

Removed deny htaccess from innovation and anonymous /langs