Merging Magento Community Edition 1.7.0.0.

.htaccess

@@ -32,7 +32,7 @@
 ## adjust memory limit
 
 #    php_value memory_limit 64M
-    php_value memory_limit 128M
+    php_value memory_limit 256M
     php_value max_execution_time 18000
 
 ############################################
@@ -122,12 +122,35 @@
 
     #RewriteBase /magento/
 
+############################################
+## uncomment next line to enable light API calls processing
+
+#    RewriteRule ^api/([a-z][0-9a-z_]+)/?$ api.php?type=$1 [QSA,L]
+
+############################################
+## rewrite API2 calls to api.php (by now it is REST only)
+
+    RewriteRule ^api/rest api.php?type=rest [QSA,L]
+
 ############################################
 ## workaround for HTTP authorization
 ## in CGI environment
 
     RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
 
+############################################
+## TRACE and TRACK HTTP methods disabled to prevent XSS attacks
+
+    RewriteCond %{REQUEST_METHOD} ^TRAC[EK]
+    RewriteRule .* - [L,R=405]
+
+############################################
+## redirect for mobile user agents
+
+    #RewriteCond %{REQUEST_URI} !^/mobiledirectoryhere/.*$
+    #RewriteCond %{HTTP_USER_AGENT} "android|blackberry|ipad|iphone|ipod|iemobile|opera mobile|palmos|webos|googlebot-mobile" [NC]
+    #RewriteRule ^(.*)$ /mobiledirectoryhere/ [L,R=302]
+
 ############################################
 ## always send 404 on missing files in these folders
 
@@ -171,9 +194,16 @@
     Order allow,deny
     Allow from all
 
+###########################################
+## Deny access to release notes to prevent disclosure of the installed Magento version
+
+    <Files RELEASE_NOTES.txt>
+        order allow,deny
+        deny from all
+    </Files>
+
 ############################################
 ## If running in cluster environment, uncomment this
 ## http://developer.yahoo.com/performance/rules.html#etags
 
     #FileETag none
-

api.php

@@ -0,0 +1,88 @@
+<?php
+/**
+ * Magento
+ *
+ * NOTICE OF LICENSE
+ *
+ * This source file is subject to the Open Software License (OSL 3.0)
+ * that is bundled with this package in the file LICENSE.txt.
+ * It is also available through the world-wide-web at this URL:
+ * http://opensource.org/licenses/osl-3.0.php
+ * If you did not receive a copy of the license and are unable to
+ * obtain it through the world-wide-web, please send an email
+ * to license@magentocommerce.com so we can send you a copy immediately.
+ *
+ * DISCLAIMER
+ *
+ * Do not edit or add to this file if you wish to upgrade Magento to newer
+ * versions in the future. If you wish to customize Magento for your
+ * needs please refer to http://www.magentocommerce.com for more information.
+ *
+ * @category    Mage
+ * @package     Mage_Api2
+ * @copyright   Copyright (c) 2011 Magento Inc. (http://www.magentocommerce.com)
+ * @license     http://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+ */
+
+if (version_compare(phpversion(), '5.2.0', '<')) {
+    echo 'It looks like you have an invalid PHP version. Magento supports PHP 5.2.0 or newer';
+    exit;
+}
+error_reporting(E_ALL | E_STRICT);
+
+$mageFilename = getcwd() . '/app/Mage.php';
+
+if (!file_exists($mageFilename)) {
+    echo 'Mage file not found';
+    exit;
+}
+require $mageFilename;
+
+if (!Mage::isInstalled()) {
+    echo 'Application is not installed yet, please complete install wizard first.';
+    exit;
+}
+
+if (isset($_SERVER['MAGE_IS_DEVELOPER_MODE'])) {
+    Mage::setIsDeveloperMode(true);
+}
+
+#ini_set('display_errors', 1);
+
+// emulate index.php entry point for correct URLs generation in API
+Mage::register('custom_entry_point', true);
+Mage::$headersSentThrowsException = false;
+Mage::init('admin');
+Mage::app()->loadAreaPart(Mage_Core_Model_App_Area::AREA_GLOBAL, Mage_Core_Model_App_Area::PART_EVENTS);
+Mage::app()->loadAreaPart(Mage_Core_Model_App_Area::AREA_ADMINHTML, Mage_Core_Model_App_Area::PART_EVENTS);
+
+// query parameter "type" is set by .htaccess rewrite rule
+$apiAlias = Mage::app()->getRequest()->getParam('type');
+
+// check request could be processed by API2
+if (in_array($apiAlias, Mage_Api2_Model_Server::getApiTypes())) {
+    /** @var $server Mage_Api2_Model_Server */
+    $server = Mage::getSingleton('api2/server');
+
+    $server->run();
+} else {
+    /* @var $server Mage_Api_Model_Server */
+    $server = Mage::getSingleton('api/server');
+    $adapterCode = $server->getAdapterCodeByAlias($apiAlias);
+
+    // if no adapters found in aliases - find it by default, by code
+    if (null === $adapterCode) {
+        $adapterCode = $apiAlias;
+    }
+    try {
+        $server->initialize($adapterCode);
+        $server->run();
+
+        Mage::app()->getResponse()->sendResponse();
+    } catch (Exception $e) {
+        Mage::logException($e);
+
+        echo $e->getMessage();
+        exit;
+    }
+}