From 84eb635d2c5b6c7578c366bc6ec9d19645d2fce3 Mon Sep 17 00:00:00 2001
From: Marc Alexander <admin@m-a-styles.de>
Date: Sun, 7 Jul 2024 15:24:34 +0200
Subject: [PATCH] [ticket/16213] Add .htaccess to vendor-ext as well

PHPBB-16213
---
 build/build.xml            |  2 +-
 phpBB/vendor-ext/.htaccess | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 phpBB/vendor-ext/.htaccess

diff --git a/build/build.xml b/build/build.xml
index d1eae7bd98..cf294e547e 100644
--- a/build/build.xml
+++ b/build/build.xml
@@ -181,7 +181,7 @@
 
 		<!-- create an empty config.php file (not for diffs) -->
 		<touch file="build/new_version/phpBB3/config.php" />
-		<copy file="build/new_version/phpBB3/phpbb/.htaccess" tofile="build/new_version/phpBB3/vendor/.htaccess" />
+		<copy file="build/new_version/phpBB3/vendor-ext/.htaccess" tofile="build/new_version/phpBB3/vendor/.htaccess" />
 
 	</target>
 
diff --git a/phpBB/vendor-ext/.htaccess b/phpBB/vendor-ext/.htaccess
new file mode 100644
index 0000000000..92e78ba1a7
--- /dev/null
+++ b/phpBB/vendor-ext/.htaccess
@@ -0,0 +1,25 @@
+# With Apache 2.4 the "Order, Deny" syntax has been deprecated and moved from
+# module mod_authz_host to a new module called mod_access_compat (which may be
+# disabled) and a new "Require" syntax has been introduced to mod_authz_core.
+# We could just conditionally provide both versions, but unfortunately Apache
+# does not explicitly tell us its version if the module mod_version is not
+# available. In this case, we check for the availability of module
+# mod_authz_core (which should be on 2.4 or higher only) as a best guess.
+<IfModule mod_version.c>
+	<IfVersion < 2.4>
+		Order Allow,Deny
+		Deny from All
+	</IfVersion>
+	<IfVersion >= 2.4>
+		Require all denied
+	</IfVersion>
+</IfModule>
+<IfModule !mod_version.c>
+	<IfModule !mod_authz_core.c>
+		Order Allow,Deny
+		Deny from All
+	</IfModule>
+	<IfModule mod_authz_core.c>
+		Require all denied
+	</IfModule>
+</IfModule>