.htaccess file created at root

info:
Drupal ver.: 7.38
php ver: 5.3.29
OS: QNAP - BusyBox?

Hi,

Excuse me if this has already been solved but I'm new to Drupal (today!) and while installing I ran into several issues. I wont get into details about all of them but I managed to finally install Drupal and was hoping someone could give me some pointers for next time.

The issue: After what appears to be a successful install, I get a:

Forbidden

You don't have permission to access /drupal/ on this server.

I narrowed it down to Drupal consistently creating a .htaccess file on my root web folder. This files contains:

******************************************************
Deny from all

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

# Override the handler again if we're run later in the evaluation list.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

# If we know how to do it safely, disable the PHP engine entirely.

php_flag engine off

******************************************************

Even if I delete it (which then brings up the site), Drupal recreates it.

The Solution:
I narrowed it down to Drupal assuming my root directory is a temporary file directory. To stop this behavior, I had to navigate to: http://mywebserver/drupal/admin/config/media/file-system

From there I changed the "Temporary directory" path to something like /share/Qweb/drupal/files/tmp
Now the .htaccess file is created in that directory instead of the root and everything appears to function normally.

Additional stuff:
The function that searches for a temporary directory is located here: includes\file.inc
function name: file_directory_temp()

somehow, this function fails to find/create the Drupal temp file directory and uses my root directory instead (in my environment).

I hope this helps someone stuck in a similar situation. I spent several hours now just trying to get this to work. If this functionality is not by design (I hope not), then perhaps someone could fix the issue so no one else has to experience this as well. Thank you.