Access to vcs directories should be denied by default to avoid leaking
information to the outsite that might have been accidentally committed
to a repository.
This does not effect the core as the version information is public by
license, but any repository containing configuration or third party
extensions.

Resolves: #68626
Releases: master,6.2
Change-Id: I4f3cb88e577f56ac71d882c8b11341da46a8b757
Reviewed-on: http://review.typo3.org/42100


Reviewed-by: Wouter Wolters <typo3@wouterwolters.nl>
Tested-by: Wouter Wolters <typo3@wouterwolters.nl>
Reviewed-by: Markus Klein <markus.klein@typo3.org>
Tested-by: Markus Klein <markus.klein@typo3.org>

The configuration now works independently of RewriteBase,
hence we must not define one.

Resolves: #67922
Releases: master, 6.2
Change-Id: Ib1e14f808fbf2e7abd08a4e85d2a3d4e8509060a
Reviewed-on: http://review.typo3.org/40929


Reviewed-by: Frederic Gaus <frederic.gaus@flagbit.de>
Tested-by: Frederic Gaus <frederic.gaus@flagbit.de>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>

Fix invalid syntax for mod_filter on apache 2.4 and mismatching comment
endings.

Resolves: #66235
Releases: master
Change-Id: Id4a67dab8f2fbf4d4bf9e2da4ac1c83d06b93388
Reviewed-on: http://review.typo3.org/40793


Reviewed-by: Stephan Großberndt <stephan@grossberndt.de>
Tested-by: Stephan Großberndt <stephan@grossberndt.de>
Reviewed-by: Markus Klein <markus.klein@typo3.org>
Tested-by: Markus Klein <markus.klein@typo3.org>

Improve the example .htaccess file by adding rules for caching,
MIME types and CORS. Also, the rewrite rules are extended to block
access to certain files and folders.

Additionally all rules are made compatible for Apache 2.4 as well.

Resolves: #23078
Resolves: #66235
Releases: master, 6.2
Change-Id: I629f524b5a209769601f04a74bb7434736058ab8
Reviewed-on: http://review.typo3.org/39254


Reviewed-by: Stephan Großberndt <stephan@grossberndt.de>
Tested-by: Stephan Großberndt <stephan@grossberndt.de>
Reviewed-by: Markus Klein <markus.klein@typo3.org>
Tested-by: Markus Klein <markus.klein@typo3.org>

Similar to protecting the private resources, the configuration
of an extension should be protected as well.

Change-Id: Ib68cb77ea21e8ec192927d1c9c62a30c1bb7103f
Releases: master, 6.2
Resolves: #66573
Reviewed-on: http://review.typo3.org/38921


Reviewed-by: Markus Klein <klein.t3@reelworx.at>
Reviewed-by: Stefan Froemken <froemken@gmail.com>
Tested-by: Stefan Froemken <froemken@gmail.com>
Reviewed-by: Jan Kiesewetter <jan@t3easy.de>
Tested-by: Jan Kiesewetter <jan@t3easy.de>
Reviewed-by: Andreas Fernandez <andreas.fernandez@aspedia.de>
Tested-by: Markus Klein <klein.t3@reelworx.at>

The affected rules are those for TYPO3_CONTEXT.
These rules should just set the ENV variable,
but should not touch the URL.
According to apache httpd docs this has to be
indicated by using a dash.

Also unnecessary grouping in the regexp has been
removed.

Resolves: #59037
Releases: 6.3, 6.2
Change-Id: I56cadcfb3cfae0a0ee679c6886cda9f5498fc47c
Reviewed-on: https://review.typo3.org/30328
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Armin Ruediger Vieweg
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel

Since removing the t3lib folder in TYPO3 6.2, there is
no more reason to keep reference to this folder in the
example .htaccess file.

Resolves: #55265
Releases: 6.2
Change-Id: Ic7f2cff96186551b2aa08c9e785f42c4f8612fce
Reviewed-on: https://review.typo3.org/27017
Reviewed-by: Henrik Ziegenhain
Reviewed-by: Oliver Klee
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer

Flow has the notion of ApplicationContext which provides a unique
API for handling contexts.

This API allow us to provide default configuration sets for
particular contexts. For example having decent logging in
production context vs. full reports in development context.

The context is set using the TYPO3_CONTEXT environment variable.
If not set the context defaults to "Production".

The context can be queried using:
\TYPO3\CMS\Core\Core\Bootstrap::getInstance()->getContext();

Resolves: #49988
Releases: 6.2
Change-Id: Id953052f2846c740f27a83931adfb64b0d8d9169
Reviewed-on: https://review.typo3.org/22269
Reviewed-by: Thomas Maroschik
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind

The "apache-trailing-slash workaround" is not needed and can be
removed

Change-Id: Ic67cd24eb6ea6de2e78a871ec4b7831b8487be8b
Resolves: #42503
Releases: 6.0
Reviewed-on: http://review.typo3.org/16032
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel

This patch removes the old simulate_static system extension.
Since tslib_fe still contains idPartsAnalyze(), which is a relict of
simulate static methods, this method also removed.

Change-Id: I3631909fe6a77fd0861e7be5acdb6f3bf82fdb42
Resolves: #25099
Releases: 6.0
Reviewed-on: http://review.typo3.org/9132
Reviewed-by: Stefan Galinski
Tested-by: Stefan Galinski
Reviewed-by: Wouter Wolters
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn

The documentation (NEWS.txt and TypoScript completion) does not
correctly explain the feature set of config.compressJs.

Instead of the advertised minification (stripping white-spaces), it only
applies GZIP compression (which then requires compressionLevel to be
enabled in the Install Tool). This is a difference to
config.compressCss, which does such a minification.

Additionally, .htaccess lacks hints about the gzip rules, which now also
apply to the Frontend.

Change-Id: I30929ee70d0ab5fd6db74717889af6104c12e23d
Resolves: #31251
Releases: 4.6
Reviewed-on: http://review.typo3.org/6277
Reviewed-by: Xavier Perseguers
Tested-by: Xavier Perseguers
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Jigal van Hemert
Tested-by: Jigal van Hemert

Add a new security section within .htaccess to help users secure their
TYPO3 install:

- Restrict access to deleted files in Recycler directories
- Restrict access to TypoScript files in default templates directories
- Restrict access to Private extension directories

Resolves: #28368
Change-Id: I94c09f50616af55cfdd9577097251692b2111ae7
Reviewed-on: http://review.typo3.org/3462
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
Reviewed-by: Georg Ringer
Tested-by: Georg Ringer

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@10273 709f56b5-9817-0410-a4d7-c38de5d9e867

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@10206 709f56b5-9817-0410-a4d7-c38de5d9e867

Follow-up to issue #11103: Cleanup of _.htaccess and references to misc/advanced.htaccess in config_default


git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@10194 709f56b5-9817-0410-a4d7-c38de5d9e867

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@9959 709f56b5-9817-0410-a4d7-c38de5d9e867

Added feature #11103: Improve advanced_htaccess and make it more compatible (Thanks to Christopher Stelmaszyk)


git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@9445 709f56b5-9817-0410-a4d7-c38de5d9e867

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@9178 709f56b5-9817-0410-a4d7-c38de5d9e867

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@8683 709f56b5-9817-0410-a4d7-c38de5d9e867

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@7522 709f56b5-9817-0410-a4d7-c38de5d9e867

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@7520 709f56b5-9817-0410-a4d7-c38de5d9e867

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@7508 709f56b5-9817-0410-a4d7-c38de5d9e867

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@2016 709f56b5-9817-0410-a4d7-c38de5d9e867

Fixed bug #4883: mod_rewrite rules rewrite missing favicon.ico to index.php (thanks to Stefan Geith for this hint - notice that manual modification of existing .htaccess files might be neccessary)

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@2014 709f56b5-9817-0410-a4d7-c38de5d9e867

* Removed misc/mod_rewrite.htaccess and misc/php_optimized.htaccess and replaced them by misc/simple.htaccess and misc/advanced.htaccess
* Added a die() call to protect the display of phpinfo() in misc/phpcheck/incfile.php
* config.disablePrefixComment was ignored by plugins
* $TT->pull() was called without $TT->push() before in typo3/sysext/indexed_search/class.indexer.php
* Fixed bug #0001239: Install tool does not accept hyphen in database host name


git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@772 709f56b5-9817-0410-a4d7-c38de5d9e867