New and upgraded sites will be given a default .htaccess file in their

dataroot directory SC#64

lib/db/mysql.php

@@ -1092,6 +1092,17 @@ function main_upgrade($oldversion=0) {
         modify_database('', "INSERT INTO prefix_log_display VALUES ('message', 'block contact', 'user', 'CONCAT(firstname,\" \",lastname)'); ");
         modify_database('', "INSERT INTO prefix_log_display VALUES ('message', 'unblock contact', 'user', 'CONCAT(firstname,\" \",lastname)'); ");
     }
+
+    if ($oldversion < 2005011000) {     // Create a .htaccess file in dataroot, just in case
+        if (!file_exists($CFG->dataroot.'/.htaccess')) {
+            if ($handle = fopen($CFG->dataroot.'/.htaccess', 'w')) {   // For safety
+                @fwrite($handle, "deny from all\r\n");
+                @fclose($handle); 
+                notify("Created a default .htaccess file in $CFG->dataroot");
+            }
+        }
+    }
+
     return $result;
 
 }

lib/db/postgres7.php

@@ -868,6 +868,16 @@ function main_upgrade($oldversion=0) {
                             ");
     }
 
+    if ($oldversion < 2005011000) {     // Create a .htaccess file in dataroot, just in case
+        if (!file_exists($CFG->dataroot.'/.htaccess')) {
+            if ($handle = fopen($CFG->dataroot.'/.htaccess', 'w')) {   // For safety
+                @fwrite($handle, "deny from all\r\n");
+                @fclose($handle); 
+                notify("Created a default .htaccess file in $CFG->dataroot");
+            }
+        }
+    }
+
     return $result;
 }
 

lib/moodlelib.php

@@ -2567,6 +2567,10 @@ function make_upload_directory($directory, $shownotices=true) {
             }
             return false;
         }
+        if ($handle = fopen($currdir.'/.htaccess', 'w')) {   // For safety
+            @fwrite($handle, "deny from all\r\n");
+            @fclose($handle); 
+        }
     }
 
     $dirarray = explode('/', $directory);

version.php

@@ -6,7 +6,7 @@
 // This is compared against the values stored in the database to determine 
 // whether upgrades should be performed (see lib/db/*.php)
 
-   $version = 2005010100;  // YYYYMMDD = date of first major branch release 1.4
+   $version = 2005011000;  // YYYYMMDD = date of first major branch release 1.4
                            //       XY = increments within a single day
 
    $release = '1.5 UNSTABLE DEVELOPMENT';    // Human-friendly version name