This bug didn't exist in 7.34, but does in 7.38. Not sure where along the way it was introduced.
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$
This line in .htaccess used to have \.bak|\.orig|\.save)$ at the end, but now has \.bak|\.orig\.save)$. Note the missing '|'. the '|' exists in the other regular expression in the string, so I assume this isn't on purpose.
Comments
Comment #1
nterbogt commentedComment #2
cilefen commentedComment #3
cilefen commentedThe same condition exists in 8.0.x, so if this is really an error, it must be fixed there first.
Comment #4
cilefen commentedIt exists in 7.34.
Comment #5
cilefen commentedIt looks like it was added in #1907704: Restrict temporary files created by text editors as-is.
Comment #6
cilefen commentedComment #7
cilefen commentedIt it targeting files named *.orig.save? .orig and .save are checked earlier in the line.
Comment #8
fabianx commentedComment #9
cilefen commented#2508666: Drupal 8 .htaccess rule to prevent php file access can be easily bypassed is taking care of this so I am marking this a duplicate.