This could lead to potential security issues, since the .htaccess file is not created, the folder is not protected and these files are available to download if included inside the docroot.

As a "temporary fix" I'd suggest to call it out on the module's page for people to be warned.

I'm not sure when these .htaccess files should be created. It feels like it is not a bug of this module, but if there is a way to fix it, I think it would be really nice.

Comments

nbouhid created an issue. See original summary.

jan.stoeckler’s picture

jan.stoeckler
he/his
Primary language German
CreditAttribution: jan.stoeckler as a volunteer commented
Assigned: Unassigned » jan.stoeckler

Thanks for reporting! I followed your suggestion and put a notice on the module's page. We will investigate & try to fix the issue.