This bug didn't exist in 7.34, but does in 7.38. Not sure where along the way it was introduced.

<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$

This line in .htaccess used to have \.bak|\.orig|\.save)$ at the end, but now has \.bak|\.orig\.save)$. Note the missing '|'. the '|' exists in the other regular expression in the string, so I assume this isn't on purpose.

Comments

nterbogt’s picture

Issue summary: View changes
cilefen’s picture

Version: 7.38 » 8.0.x-dev

The same condition exists in 8.0.x, so if this is really an error, it must be fixed there first.

cilefen’s picture

It exists in 7.34.

cilefen’s picture

cilefen’s picture

Title: .htaccess error » .htaccess broken regex for \.orig and \.save
cilefen’s picture

It it targeting files named *.orig.save? .orig and .save are checked earlier in the line.

fabianx’s picture

Priority: Normal » Major
Issue tags: +Security improvements