Security warning (uploads should not be downloadable)

The 'custom' dir is mentioned in drush/verify.provision.inc where allow might have to be changed to deny.

#2155445: 403 Forbidden in Ubuntu Saucy might be relevant here, to update apache config to 2.4

Related issue that should be fixed at the same time: we should use "*" in the Directory directives, otherwise someone could access the files from a vhost from another vhost in the same platform.

Same problem, patch works for me.

I can also confirm that the commit above works well. Let's try to get a release out with this included prior to Aegir 3.7, so that it gets included.

As it's already committed I think this deserves the fixed status. I'll create a release here just before doing #2754709: [meta] 3.7 release (bugfix/patches)

indeed, thanks!