Issue #2406681 by tstoeckler, hussainweb, alexpott, ParisLiakos, almaudoh, tadityar: Add an autoload.php in the repo root to control the autoloader of front controllers

Issue #462950 by pwolanin: Mitigate the security risks that come from IE and other browsers trying to sniff the mime type

Issue #1956698 by Gábor Hojtsy, xjm, alexpott, damiankloip, mgifford: Prevent access to YAML files using .htaccess and web.config.

Issue #1587270 by klausi, greggles, sun: Forbid execution of PHP files in subfolders by default (except those needed by core).

Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel.

Revert "Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel."

This reverts commit cda051c4.

Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel.

Issue #1599774 by longwave, kristofferwiklund, BTMash, marcingy | Letharion: .htaccess protections do not work on Apache 2.4 without mod_access_compat.

Issue #1587270 by klausi: Added comment in .htaccess describing how to forbid execution of PHP files in subfolders.

Issue #1962780 by David_Rothstein, petyovsky: Fixed 500 Internal server error on Apache 1.x servers after updating to Drupal 7.22.

Issue #670454 by pwolanin, cburschka, effulgentsia: Fixed Support HTTP Authorization in CGI environment.

Issue #1907704 by ultimateboy, totten, acrollet, greggles: Restrict temporary files created by text editors.

Issue #1733476 by greggles, BMDan: Fixed Make default htaccess rules protocol sensitive to avoid man-in-the-middle-attacks if users don't fully customize the rule.

Removed sig from global htaccess, create a new one in the config directory at install time which simply does a DenyFromAll, just like private files

Nate Lampton authored Oct 30, 2011 and catch committed Nov 01, 2011

Issue #22336 by quicksketch, scor, boombatower, and rfay. Move all core Drupal files under a core subdirectory.

- Patch #1116416 by Kars-T, Coornail: use 'Header set' instead of 'Header append' in .htaccess to avoid double encoding.

- Patch #76824 by geerlingguy, xjm, droplet, kbahey: Drupal should not handle 404 for certain files. Oh yeah.

- Patch #1110810 by JohnAlbin, TR: CVS $ tag lurks in .htaccess file (and other dank corners of Drupal).