Merge branch '3.3.x'

Author: marc1706

phpBB/.htaccess

@@ -60,6 +60,14 @@ RewriteRule ^(.*)$ app.php [QSA,L]
 			Order Allow,Deny
 			Deny from All
 		</Files>
+		<Files "composer.json">
+			Order Allow,Deny
+			Deny from All
+		</Files>
+		<Files "composer.lock">
+			Order Allow,Deny
+			Deny from All
+		</Files>
 	</IfVersion>
 	<IfVersion >= 2.4>
 		<Files "config.php">
@@ -68,6 +76,12 @@ RewriteRule ^(.*)$ app.php [QSA,L]
 		<Files "common.php">
 			Require all denied
 		</Files>
+		<Files "composer.json">
+			Require all denied
+		</Files>
+		<Files "composer.lock">
+			Require all denied
+		</Files>
 	</IfVersion>
 </IfModule>
 <IfModule !mod_version.c>
@@ -80,6 +94,14 @@ RewriteRule ^(.*)$ app.php [QSA,L]
 			Order Allow,Deny
 			Deny from All
 		</Files>
+		<Files "composer.json">
+			Order Allow,Deny
+			Deny from All
+		</Files>
+		<Files "composer.lock">
+			Order Allow,Deny
+			Deny from All
+		</Files>
 	</IfModule>
 	<IfModule mod_authz_core.c>
 		<Files "config.php">
@@ -88,5 +110,11 @@ RewriteRule ^(.*)$ app.php [QSA,L]
 		<Files "common.php">
 			Require all denied
 		</Files>
+		<Files "composer.json">
+			Require all denied
+		</Files>
+		<Files "composer.lock">
+			Require all denied
+		</Files>
 	</IfModule>
 </IfModule>

phpBB/docs/lighttpd.sample.conf

@@ -32,6 +32,11 @@ $HTTP["host"] == "www.myforums.com" {
 		url.access-deny = ( "" )
 	}
 
+	# Deny access to composer files.
+	$HTTP["url"] =~ "^/composer\.(json|lock)$" {
+		url.access-deny = ( "" )
+	}
+
 	# Deny access to version control system directories.
 	$HTTP["url"] =~ "/\.svn|/\.git" {
 		url.access-deny = ( "" )

phpBB/docs/nginx.sample.conf

@@ -55,7 +55,7 @@ server {
 		}
 
 		# Deny access to internal phpbb files.
-		location ~ /(config|common\.php|cache|files|images/avatars/upload|includes|(?<!ext/)phpbb(?!\w+)|store|vendor|vendor-ext) {
+		location ~ /(config|common\.php|composer\.(json|lock)|cache|files|images/avatars/upload|includes|(?<!ext/)phpbb(?!\w+)|store|vendor|vendor-ext) {
 			deny all;
 			# deny was ignored before 0.8.40 for connections over IPv6.
 			# Use internal directive to prohibit access on older versions.