.htaccess files in the drupal root as well as subfolders are currently ignored.

Comments

mikeytown2 created an issue.

mikeytown2’s picture

mikeytown2 commented

Just a heads up that because of the non-standard apache setup, the highest score one can ever get on https://developers.google.com/speed/pagespeed/insights/ is a 99/100 or 97/100 when using this service.

mikeytown2’s picture

mikeytown2 commented

If the site is still up by the time you read this you can look at the scores here
https://developers.google.com/speed/pagespeed/insights/?url=https%3A%2F%...

greg boggs’s picture

greg boggs
he/him
Primary language English
Location Portland Oregon
commented

Do you have the needed configuration changes handy?

mikeytown2’s picture

mikeytown2 commented

Depends on your configuration but here’s a quick start https://linode.com/docs/web-servers/apache/how-to-set-up-htaccess-on-apa...

greg boggs’s picture

greg boggs
he/him
Primary language English
Location Portland Oregon
commented

Oh, I meant which apache configurations... I haven't really thought through the problems we might get letting random people configure apache with htaccess. It's probably fine. What do you think?

mikeytown2’s picture

mikeytown2 commented

This set from core
https://cgit.drupalcode.org/drupal/tree/.htaccess#n72

And this from AdvAgg
https://cgit.drupalcode.org/advagg/tree/README.txt#n239

mikeytown2’s picture

mikeytown2 commented

In terms of opening up .htaccess I think the only thing they could mess with would be their own site; so after 24 hours it’ll be gone

greg boggs’s picture

greg boggs
he/him
Primary language English
Location Portland Oregon
commented

Right... and they can already run arbitrary code as the web server.

mikeytown2’s picture

mikeytown2 commented

Yeah eval and your own patches means it’s open for the most part

mikeytown2’s picture

mikeytown2 commented

This will allow for core's .htaccess files to be loaded on apache start and not change unless apache restarts
https://drupal.stackexchange.com/a/108346/314

This will still not allow for advagg .htaccess but will allow core's