# Phase 8.0 security triage.
#
# lib/db/connection.php holds the production database host, user, password
# and schema name as plain PHP variables. Nothing under lib/ is ever meant
# to be requested over HTTP - it is included from the filesystem by PHP,
# which this rule does not affect.
#
# Without this, any condition that stops PHP executing (a broken handler
# after a version change, a stray .bak or .phps copy) serves the file as
# text and publishes the credentials.

<IfModule mod_authz_core.c>
    # Apache 2.4
    Require all denied
</IfModule>

<IfModule !mod_authz_core.c>
    # Apache 2.2
    Order allow,deny
    Deny from all
</IfModule>
