From 143294c6cb7093c2f25be74ae35c2d4737ce32e7 Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Wed, 4 Nov 2026 18:08:36 +0100
Subject: [PATCH 01/11] fix(installer): make "remove the install folder" work

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Feature/InstallerRemovalFlowTest.php      | 307 ++++++++++++++++++
 .../Security/ApacheConfigHardeningTest.php    |   8 +
 install/src/controllers/install.php           |   5 +-
 ng.inx                                        |   4 +-
 4 files changed, 321 insertions(+), 3 deletions(-)
 create mode 100644 core/tests/Feature/InstallerRemovalFlowTest.php

diff --git a/core/tests/Feature/InstallerRemovalFlowTest.php b/core/tests/Feature/InstallerRemovalFlowTest.php
new file mode 100644
index 0000000000..ec40a0f8e4
--- /dev/null
+++ b/core/tests/Feature/InstallerRemovalFlowTest.php
@@ -0,0 +1,307 @@
+<?php
+
+/*
+| "Remove the install folder" on the last page of the installer, driven the way a browser drives
+| it: a real site, the real forms, a real server. InstallerWebPathTest runs the processor against a
+| lock it writes itself, so it cannot tell whether the installer ever stored the token.
+*/
+
+use GuzzleHttp\Client;
+use GuzzleHttp\Cookie\CookieJar;
+use Symfony\Component\Process\Process;
+
+const INSTALLER_FLOW_ADMIN = 'admin';
+const INSTALLER_FLOW_PASSWORD = 'Passw0rd123';
+
+/** Paths of the repository a site does not need, or that would make it look installed already. */
+function installerFlowSkipped(string $path): bool
+{
+    return preg_match(
+        '~^(\.git|\.github|tmp|node_modules|core/tests|core/storage/(logs|cache|sessions)|core/\.install'
+        . '|core/config/database/connections/default\.php|core/database/[^/]+\.sqlite|install\.session\.php)(/|$)~',
+        $path
+    ) === 1;
+}
+
+function installerFlowCopy(string $from, string $to, string $relative = ''): void
+{
+    is_dir($to) || mkdir($to, 0777, true);
+    foreach (scandir($from) as $name) {
+        $path = ltrim($relative . '/' . $name, '/');
+        if ($name === '.' || $name === '..' || installerFlowSkipped($path)) {
+            continue;
+        }
+        if (is_dir("$from/$name") && !is_link("$from/$name")) {
+            installerFlowCopy("$from/$name", "$to/$name", $path);
+        } else {
+            copy("$from/$name", "$to/$name");
+        }
+    }
+}
+
+function installerFlowDelete(string $path): void
+{
+    if (is_link($path) || is_file($path)) {
+        unlink($path);
+    } elseif (is_dir($path)) {
+        foreach (array_diff(scandir($path), ['.', '..']) as $name) {
+            installerFlowDelete("$path/$name");
+        }
+        rmdir($path);
+    }
+}
+
+/**
+ * The site of this file: copied and served once, because a tree with its vendor takes seconds.
+ *
+ * @return array{root: string, url: string, server: Process}
+ */
+function installerFlowSite(bool $stop = false): ?array
+{
+    static $site = null;
+    if ($stop) {
+        if ($site !== null) {
+            $site['server']->stop(1);
+            installerFlowDelete($site['root']);
+        }
+        return $site = null;
+    }
+    if ($site !== null) {
+        return $site;
+    }
+
+    $root = str_replace('\\', '/', sys_get_temp_dir()) . '/evo-installer-flow-' . bin2hex(random_bytes(8));
+    installerFlowCopy(dirname(__DIR__, 3), $root);
+    foreach (['logs', 'cache', 'sessions'] as $folder) {
+        mkdir("$root/core/storage/$folder", 0777, true);
+    }
+
+    $socket = stream_socket_server('tcp://127.0.0.1:0');
+    $address = stream_socket_get_name($socket, false);
+    fclose($socket);
+
+    // The settings of the test run must not reach the site: DB_* would win over its own connection.
+    $environment = array_map(static fn () => false, array_filter(
+        getenv(),
+        static fn (string $name) => preg_match('/^(DB_|EVO_|APP_)/', $name) === 1,
+        ARRAY_FILTER_USE_KEY
+    ));
+    $server = new Process([PHP_BINARY, '-d', 'opcache.enable=0', '-S', $address, '-t', $root], $root, $environment, null, null);
+    $server->start();
+
+    $url = "http://$address";
+    for ($attempt = 0; $attempt < 100; $attempt++) {
+        $connection = @fsockopen('127.0.0.1', (int) substr(strrchr($address, ':'), 1), $code, $message, 0.1);
+        if ($connection !== false) {
+            fclose($connection);
+            break;
+        }
+        usleep(50000);
+    }
+
+    return $site = ['root' => $root, 'url' => $url, 'server' => $server];
+}
+
+/** Back to a tree that was never installed, with the installer of the repository. */
+function installerFlowReset(): array
+{
+    $site = installerFlowSite();
+    $root = $site['root'];
+    foreach ([
+        'core/.install', 'core/config/database/connections/default.php', 'core/database/flow.sqlite',
+        'install.session.php', 'install', 'core/storage/bootstrap', 'assets/cache/installProc.inc.php',
+    ] as $path) {
+        installerFlowDelete("$root/$path");
+    }
+    mkdir("$root/core/storage/bootstrap", 0777, true);
+    installerFlowCopy(dirname(__DIR__, 3) . '/install', "$root/install");
+
+    return $site;
+}
+
+function installerFlowBrowser(array $site): Client
+{
+    return new Client([
+        'base_uri' => $site['url'],
+        'cookies' => new CookieJar(),
+        'http_errors' => false,
+        'timeout' => 300,
+        'headers' => ['Accept-Language' => 'en', 'Referer' => $site['url'] . '/install/'],
+    ]);
+}
+
+/**
+ * The fields form#install_form submits as it stands, and where it posts them.
+ *
+ * @return array{action: string, fields: array<string, mixed>}
+ */
+function installerFlowForm(string $html): array
+{
+    $document = new DOMDocument();
+    @$document->loadHTML($html);
+    $form = $document->getElementById('install_form');
+    expect($form)->toBeInstanceOf(DOMElement::class, 'no installer form in: ' . substr(strip_tags($html), 0, 500));
+
+    $fields = [];
+    foreach ((new DOMXPath($document))->query('.//input|.//select|.//textarea', $form) as $field) {
+        $name = $field->getAttribute('name');
+        $type = strtolower($field->getAttribute('type'));
+        if ($name === '' || $field->hasAttribute('disabled')
+            || (in_array($type, ['checkbox', 'radio'], true) && !$field->hasAttribute('checked'))) {
+            continue;
+        }
+        if ($field->nodeName === 'select') {
+            $value = '';
+            foreach ($field->getElementsByTagName('option') as $index => $option) {
+                if ($index === 0 || $option->hasAttribute('selected')) {
+                    $value = $option->getAttribute('value');
+                }
+            }
+        } else {
+            $value = $field->nodeName === 'textarea' ? $field->textContent : $field->getAttribute('value');
+        }
+        if (str_ends_with($name, '[]')) {
+            $fields[substr($name, 0, -2)][] = $value;
+        } else {
+            $fields[$name] = $value;
+        }
+    }
+
+    return ['action' => $form->getAttribute('action'), 'fields' => $fields];
+}
+
+function installerFlowPost(Client $browser, string $path, array $fields): string
+{
+    $response = $browser->post($path, ['form_params' => $fields]);
+    expect($response->getStatusCode())->toBe(200, "$path answered " . $response->getStatusCode());
+
+    return (string) $response->getBody();
+}
+
+/** Submits the forms from $page on, each with $choices, up to the page of results. */
+function installerFlowFinish(Client $browser, string $page, array $choices): string
+{
+    for ($step = 0; $step < 8 && !str_contains($page, 'remove_installer.processor.php'); $step++) {
+        $form = installerFlowForm($page);
+        $page = installerFlowPost(
+            $browser,
+            '/install/' . $form['action'],
+            array_replace($form['fields'], $choices)
+        );
+    }
+    expect($page)->toContain('remove_installer.processor.php')->not->toContain('class="notok"');
+
+    return $page;
+}
+
+/** @return string the page of results */
+function installerFlowInstall(Client $browser): string
+{
+    $page = (string) $browser->get('/install/index.php')->getBody();
+    $form = installerFlowForm($page);
+    $page = installerFlowPost($browser, '/install/' . $form['action'], ['language' => 'en'] + $form['fields']);
+    $form = installerFlowForm($page);
+    $page = installerFlowPost($browser, '/install/' . $form['action'], ['installmode' => '0'] + $form['fields']);
+
+    $connection = [
+        'database_type' => 'sqlite', 'method' => 'sqlite', 'host' => '', 'uid' => '', 'pwd' => '',
+        'database_name' => 'flow', 'tableprefix' => 'evo_', 'installMode' => '0',
+    ];
+    $collations = installerFlowPost($browser, '/install/index.php?s=1&action=connection/collation', $connection);
+    preg_match('/<option value="([^"]+)"/', $collations, $collation);
+
+    return installerFlowFinish($browser, $page, [
+        'database_type' => 'sqlite', 'databasehost' => '', 'databaseloginname' => '', 'databaseloginpassword' => '',
+        'database_name' => 'flow', 'tableprefix' => 'evo_', 'database_collation' => $collation[1] ?? '',
+        'cmsadmin' => INSTALLER_FLOW_ADMIN, 'cmsadminemail' => 'admin@example.com',
+        'cmspassword' => INSTALLER_FLOW_PASSWORD, 'cmspasswordconfirm' => INSTALLER_FLOW_PASSWORD,
+        'managerlanguage' => 'en', 'language' => 'en', 'installmode' => '0', 'chkagree' => '1', 'installdata' => '0',
+    ]);
+}
+
+/**
+ * An update of an installed site that still has its install folder, by an administrator's browser.
+ *
+ * @return array{0: Client, 1: string} the browser and the page of results
+ */
+function installerFlowUpdate(array $site): array
+{
+    installerFlowInstall(installerFlowBrowser($site));
+    // The session that installed the site is over, as it is by the time anyone updates it.
+    installerFlowDelete($site['root'] . '/install.session.php');
+
+    $browser = installerFlowBrowser($site);
+    $browser->get('/manager/');
+    $browser->post('/manager/index.php?a=0', [
+        'form_params' => ['username' => INSTALLER_FLOW_ADMIN, 'password' => INSTALLER_FLOW_PASSWORD],
+        'headers' => ['Referer' => $site['url'] . '/manager/'],
+    ]);
+    $browser->get('/manager/index.php?a=2');
+    expect($browser->getConfig('cookies')->getCookieByName('evo_installer_grant'))->not->toBeNull();
+
+    $page = (string) $browser->get('/install/index.php?action=mode')->getBody();
+
+    return [$browser, installerFlowFinish($browser, $page, [
+        'installmode' => '1', 'chkagree' => '1', 'installdata' => '0', 'language' => 'en',
+    ])];
+}
+
+/** What the last page posts: its token, and the box if it is ticked. */
+function installerFlowClose(Client $browser, string $page, bool $ticked): string
+{
+    $form = installerFlowForm($page);
+    expect($form['action'])->toEndWith('/processors/remove_installer.processor.php');
+    $fields = $form['fields'];
+    expect($fields['rminstaller'] ?? null)->toBe('1', 'the box must start ticked');
+    if (!$ticked) {
+        unset($fields['rminstaller']);
+    }
+
+    return (string) $browser->post('/install/' . $form['action'], ['form_params' => $fields])->getBody();
+}
+
+afterAll(function () {
+    installerFlowSite(true);
+});
+
+$scenarios = [
+    'a new site' => [static fn (array $site) => [$browser = installerFlowBrowser($site), installerFlowInstall($browser)]],
+    'an update' => [static fn (array $site) => installerFlowUpdate($site)],
+];
+
+test('the ticked box removes the install folder', function (Closure $scenario) {
+    $site = installerFlowReset();
+    [$browser, $page] = $scenario($site);
+
+    expect(file_get_contents($site['root'] . '/install.session.php'))->toContain('$install_token');
+
+    expect(installerFlowClose($browser, $page, true))->toContain("window.location='../#?a=2'")
+        ->and(is_dir($site['root'] . '/install'))->toBeFalse()
+        ->and(is_file($site['root'] . '/install.session.php'))->toBeFalse()
+        ->and((string) installerFlowBrowser($site)->get('/install/index.php')->getBody())->not->toContain('install_form');
+})->with($scenarios);
+
+test('the box left unticked keeps the folder, shut to everyone else', function (Closure $scenario) {
+    $site = installerFlowReset();
+    [$browser, $page] = $scenario($site);
+
+    expect(installerFlowClose($browser, $page, false))->toContain("window.location='../#?a=2'")
+        ->and(is_file($site['root'] . '/install/index.php'))->toBeTrue()
+        ->and(is_file($site['root'] . '/install.session.php'))->toBeTrue()
+        ->and(installerFlowBrowser($site)->get('/install/index.php')->getStatusCode())->toBe(404);
+})->with($scenarios);
+
+test('the token works once and not for another browser', function () {
+    $site = installerFlowReset();
+    $browser = installerFlowBrowser($site);
+    $page = installerFlowInstall($browser);
+
+    $form = installerFlowForm($page);
+    $forged = ['installer_token' => str_repeat('a', 64), 'rminstaller' => '1'];
+    expect((string) installerFlowBrowser($site)->post('/install/' . $form['action'], ['form_params' => $forged])->getBody())
+        ->toContain('Not found.')
+        ->and(is_dir($site['root'] . '/install'))->toBeTrue();
+
+    installerFlowClose($browser, $page, true);
+    expect(is_dir($site['root'] . '/install'))->toBeFalse();
+});
diff --git a/core/tests/Unit/Security/ApacheConfigHardeningTest.php b/core/tests/Unit/Security/ApacheConfigHardeningTest.php
index 502a4702a4..9792edd7a3 100644
--- a/core/tests/Unit/Security/ApacheConfigHardeningTest.php
+++ b/core/tests/Unit/Security/ApacheConfigHardeningTest.php
@@ -170,6 +170,14 @@ static function (SplFileInfo $item) use ($relative, $skipNames, $skipPaths) {
         ->and($source)->not->toContain("env('SESSION_SECURE_COOKIE', false)");
 });
 
+it('lets nginx reach the entry point of "remove the install folder"', function () {
+    preg_match('#location ~ (\^/manager/\(index.*\$) \{#', evoFile('ng.inx'), $location);
+
+    expect($location)->toHaveKey(1)
+        ->and(preg_match('~' . $location[1] . '~', '/manager/processors/remove_installer.processor.php'))->toBe(1)
+        ->and(preg_match('~' . $location[1] . '~', '/manager/processors/save_user.processor.php'))->toBe(0);
+});
+
 it('pins SERVER_NAME to the configured name in every nginx php block', function () {
     $nginx = evoFile('ng.inx');
 
diff --git a/install/src/controllers/install.php b/install/src/controllers/install.php
index 6e5e9433b2..6b920bfba8 100644
--- a/install/src/controllers/install.php
+++ b/install/src/controllers/install.php
@@ -807,9 +807,10 @@
         // removal processor. A generic lock created on the first installer visit is not enough.
         require_once EVO_CORE_PATH . 'src/Support/InstallerCompletion.php';
         $installerRemovalToken = bin2hex(random_bytes(32));
-        if (file_exists($base_path . 'install.session.php')) {
+        // Not $base_path: core/includes/define.inc.php, required above, unsets it.
+        if (file_exists(EVO_BASE_PATH . 'install.session.php')) {
             InstallerCompletion::writeLock(
-                $base_path . 'install.session.php',
+                EVO_BASE_PATH . 'install.session.php',
                 session_id(),
                 (string) ($_SERVER['REMOTE_ADDR'] ?? ''),
                 time(),
diff --git a/ng.inx b/ng.inx
index fe249cfe2a..c52e513cf1 100644
--- a/ng.inx
+++ b/ng.inx
@@ -232,6 +232,8 @@ server {
     #
     #   index.php                        manager front controller
     #   captcha.php                      login captcha image
+    #   processors/remove_installer.processor.php
+    #                                    "remove the install folder" of the installer
     #   includes/session_keepalive.php   manager session ping
     #   media/style/<theme>/ajax.php     manager ajax endpoint
     #   media/browser/<browser>/...      file browser: browse, browser, css,
@@ -241,7 +243,7 @@ server {
     # hence [A-Za-z0-9_-]+ rather than a hard-coded `default` / `mcpuk`.
     # Uploads go through browse.php, not a separate connector. An extra that
     # needs its own HTTP-callable PHP file has to be added to this list.
-    location ~ ^/manager/(index\.php|captcha\.php|includes/session_keepalive\.php|media/style/[A-Za-z0-9_-]+/ajax\.php|media/browser/[A-Za-z0-9_-]+/(browse|browser|css|js_localize)\.php|media/browser/[A-Za-z0-9_-]+/js/browser/joiner\.php)$ {
+    location ~ ^/manager/(index\.php|captcha\.php|processors/remove_installer\.processor\.php|includes/session_keepalive\.php|media/style/[A-Za-z0-9_-]+/ajax\.php|media/browser/[A-Za-z0-9_-]+/(browse|browser|css|js_localize)\.php|media/browser/[A-Za-z0-9_-]+/js/browser/joiner\.php)$ {
         if ($manager_allowed = 0) { return 404; }
 
         try_files $uri @rewrite;

From 66da6cbce229742134a5d473ce0c4b95c247e44d Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Wed, 4 Nov 2026 19:22:51 +0100
Subject: [PATCH 02/11] fix(tests): keep the installer flow test off any real
 database

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Feature/InstallerRemovalFlowTest.php      | 218 ++++++++++++++++--
 1 file changed, 193 insertions(+), 25 deletions(-)

diff --git a/core/tests/Feature/InstallerRemovalFlowTest.php b/core/tests/Feature/InstallerRemovalFlowTest.php
index ec40a0f8e4..242fa98089 100644
--- a/core/tests/Feature/InstallerRemovalFlowTest.php
+++ b/core/tests/Feature/InstallerRemovalFlowTest.php
@@ -4,6 +4,12 @@
 | "Remove the install folder" on the last page of the installer, driven the way a browser drives
 | it: a real site, the real forms, a real server. InstallerWebPathTest runs the processor against a
 | lock it writes itself, so it cannot tell whether the installer ever stored the token.
+|
+| These flows run real migrations, and DB_* wins over the connection of a site, so nothing of the
+| installation the tests run from may reach them. The copy leaves out its configuration, the site
+| gets one of its own, and every test asks the site what it sees before the first write. All of it
+| runs next to deliberately conflicting settings that lead to a database of their own, which must
+| stay as it was.
 */
 
 use GuzzleHttp\Client;
@@ -13,14 +19,20 @@
 const INSTALLER_FLOW_ADMIN = 'admin';
 const INSTALLER_FLOW_PASSWORD = 'Passw0rd123';
 
-/** Paths of the repository a site does not need, or that would make it look installed already. */
-function installerFlowSkipped(string $path): bool
+/** Paths of the tree a site must not get: local configuration, or what would make it look installed. */
+function installerFlowSkipped(string $path, bool $folder): bool
 {
-    return preg_match(
-        '~^(\.git|\.github|tmp|node_modules|core/tests|core/storage/(logs|cache|sessions)|core/\.install'
-        . '|core/config/database/connections/default\.php|core/database/[^/]+\.sqlite|install\.session\.php)(/|$)~',
-        $path
-    ) === 1;
+    if ($folder) {
+        return preg_match('~^(\.git|\.github|tmp|node_modules|core/tests|core/storage/[^/]+|assets/cache)$~', $path) === 1;
+    }
+
+    return preg_match('~(^|/)\.env(\.|$)~', $path) === 1
+        || preg_match('~^core/custom/.*(?<!\.example)(?<!\.sample)$~', $path) === 1
+        || preg_match(
+            '~^(core/\.install|core/config/database/connections/.*|core/database/[^/]+\.sqlite.*'
+            . '|manager/includes/config\.inc\.php|install\.session\.php)$~',
+            $path
+        ) === 1;
 }
 
 function installerFlowCopy(string $from, string $to, string $relative = ''): void
@@ -28,10 +40,11 @@ function installerFlowCopy(string $from, string $to, string $relative = ''): voi
     is_dir($to) || mkdir($to, 0777, true);
     foreach (scandir($from) as $name) {
         $path = ltrim($relative . '/' . $name, '/');
-        if ($name === '.' || $name === '..' || installerFlowSkipped($path)) {
+        $folder = is_dir("$from/$name") && !is_link("$from/$name");
+        if ($name === '.' || $name === '..' || installerFlowSkipped($path, $folder)) {
             continue;
         }
-        if (is_dir("$from/$name") && !is_link("$from/$name")) {
+        if ($folder) {
             installerFlowCopy("$from/$name", "$to/$name", $path);
         } else {
             copy("$from/$name", "$to/$name");
@@ -51,10 +64,45 @@ function installerFlowDelete(string $path): void
     }
 }
 
+/** A configured installation in miniature: every way a site takes settings, all leading to one database. */
+function installerFlowLocalConfiguration(string $root, string $database): void
+{
+    $connection = "<?php return ['driver' => 'sqlite', 'database' => " . var_export($database, true) . ", 'prefix' => 'evo_'];\n";
+    $environment = "DB_TYPE=sqlite\nDB_DATABASE=$database\nDB_PREFIX=evo_\n";
+    foreach ([
+        '.env' => $environment,
+        '.env.local' => $environment,
+        'core/custom/.env' => $environment,
+        'core/custom/define.php' => "<?php putenv('DB_DATABASE=$database');\n",
+        'core/custom/config/database/connections/default.php' => $connection,
+        'core/config/database/connections/default.php' => $connection,
+        'core/config/database/connections/local.php' => $connection,
+        'core/storage/cache/env.php' => "<?php return ['DB_DATABASE' => " . var_export($database, true) . "];\n",
+        'manager/includes/config.inc.php' => "<?php\n",
+    ] as $path => $content) {
+        is_dir(dirname("$root/$path")) || mkdir(dirname("$root/$path"), 0777, true);
+        file_put_contents("$root/$path", $content);
+    }
+}
+
+/** Only what a process needs to run: the settings of the test run stay out of the site. */
+function installerFlowEnvironment(): array
+{
+    $kept = ['PATH', 'HOME', 'TMP', 'TEMP', 'TMPDIR', 'SYSTEMROOT', 'COMPOSER_HOME'];
+    $environment = [];
+    foreach (array_keys($_ENV + getenv()) as $name) {
+        if (!in_array(strtoupper($name), $kept, true)) {
+            $environment[$name] = false;
+        }
+    }
+
+    return $environment;
+}
+
 /**
  * The site of this file: copied and served once, because a tree with its vendor takes seconds.
  *
- * @return array{root: string, url: string, server: Process}
+ * @return array{root: string, url: string, server: Process, original: string, originalHash: string}
  */
 function installerFlowSite(bool $stop = false): ?array
 {
@@ -62,7 +110,8 @@ function installerFlowSite(bool $stop = false): ?array
     if ($stop) {
         if ($site !== null) {
             $site['server']->stop(1);
-            installerFlowDelete($site['root']);
+            installerFlowDelete(dirname($site['root']));
+            installerFlowDelete(dirname($site['original']));
         }
         return $site = null;
     }
@@ -70,26 +119,64 @@ function installerFlowSite(bool $stop = false): ?array
         return $site;
     }
 
-    $root = str_replace('\\', '/', sys_get_temp_dir()) . '/evo-installer-flow-' . bin2hex(random_bytes(8));
+    $unique = str_replace('\\', '/', sys_get_temp_dir()) . '/evo-installer-flow-' . bin2hex(random_bytes(8));
+    $root = "$unique/site";
+
+    $original = "$unique-original/original.sqlite";
+    mkdir(dirname($original), 0777, true);
+    (new PDO("sqlite:$original"))->exec('CREATE TABLE evo_site_content (id INTEGER PRIMARY KEY, pagetitle TEXT)');
+    $local = dirname($original) . '/tree';
+    installerFlowLocalConfiguration($local, $original);
+
     installerFlowCopy(dirname(__DIR__, 3), $root);
-    foreach (['logs', 'cache', 'sessions'] as $folder) {
-        mkdir("$root/core/storage/$folder", 0777, true);
+    installerFlowCopy($local, $root);
+    foreach (['logs', 'cache', 'sessions', 'bootstrap', 'blade'] as $folder) {
+        is_dir("$root/core/storage/$folder") || mkdir("$root/core/storage/$folder", 0777, true);
     }
+    is_dir("$root/assets/cache") || mkdir("$root/assets/cache", 0777, true);
+
+    file_put_contents("$root/core/custom/.env", "DB_TYPE=sqlite\nDB_DATABASE=$root/core/database/flow.sqlite\nDB_PREFIX=evo_\n");
+    file_put_contents("$root/flow-probe.php", <<<'PHP'
+<?php
+// What this site resolves its connection from, with the loader the site and the installer share.
+require __DIR__ . '/core/functions/laravel.php';
+require __DIR__ . '/core/vendor/autoload.php';
+require __DIR__ . '/core/includes/custom-define.inc.php';
+$values = [];
+foreach (['DB_CONNECTION', 'DB_TYPE', 'DB_HOST', 'DB_DATABASE', 'DB_USERNAME', 'DB_SOCKET'] as $name) {
+    $values[$name] = env($name);
+}
+$files = glob(__DIR__ . '/core/custom/define.php') ?: [];
+foreach (['core/custom/config', 'core/config/database/connections'] as $folder) {
+    if (is_dir(__DIR__ . "/$folder")) {
+        $entries = new RecursiveDirectoryIterator(__DIR__ . "/$folder", FilesystemIterator::SKIP_DOTS);
+        foreach (new RecursiveIteratorIterator($entries) as $entry) {
+            if ($entry->getExtension() === 'php') {
+                $files[] = $entry->getPathname();
+            }
+        }
+    }
+}
+header('Content-Type: application/json');
+echo json_encode(['env' => $values, 'files' => $files]);
+PHP);
 
     $socket = stream_socket_server('tcp://127.0.0.1:0');
     $address = stream_socket_get_name($socket, false);
     fclose($socket);
 
-    // The settings of the test run must not reach the site: DB_* would win over its own connection.
-    $environment = array_map(static fn () => false, array_filter(
-        getenv(),
-        static fn (string $name) => preg_match('/^(DB_|EVO_|APP_)/', $name) === 1,
-        ARRAY_FILTER_USE_KEY
-    ));
-    $server = new Process([PHP_BINARY, '-d', 'opcache.enable=0', '-S', $address, '-t', $root], $root, $environment, null, null);
+    // A conflict in the environment too: it has to go the way of the rest.
+    $_ENV['DB_DATABASE'] = $original;
+    $server = new Process(
+        [PHP_BINARY, '-d', 'opcache.enable=0', '-S', $address, '-t', $root],
+        $root,
+        installerFlowEnvironment(),
+        null,
+        null
+    );
     $server->start();
+    unset($_ENV['DB_DATABASE']);
 
-    $url = "http://$address";
     for ($attempt = 0; $attempt < 100; $attempt++) {
         $connection = @fsockopen('127.0.0.1', (int) substr(strrchr($address, ':'), 1), $code, $message, 0.1);
         if ($connection !== false) {
@@ -99,7 +186,35 @@ function installerFlowSite(bool $stop = false): ?array
         usleep(50000);
     }
 
-    return $site = ['root' => $root, 'url' => $url, 'server' => $server];
+    return $site = [
+        'root' => $root,
+        'url' => "http://$address",
+        'server' => $server,
+        'original' => $original,
+        'originalHash' => hash_file('sha256', $original),
+    ];
+}
+
+/**
+ * Stops a test before its first write unless the site sees only the database of the fixture.
+ * The connection file the installer writes is the one file allowed to appear.
+ */
+function installerFlowAssertIsolated(array $site): void
+{
+    $root = $site['root'];
+    $seen = json_decode((string) file_get_contents($site['url'] . '/flow-probe.php'), true);
+    $expected = [
+        'DB_CONNECTION' => null, 'DB_TYPE' => 'sqlite', 'DB_HOST' => null,
+        'DB_DATABASE' => "$root/core/database/flow.sqlite", 'DB_USERNAME' => null, 'DB_SOCKET' => null,
+    ];
+    if (!is_array($seen) || $seen['env'] !== $expected) {
+        throw new RuntimeException('The site sees another connection: ' . json_encode($seen));
+    }
+    $written = "$root/core/config/database/connections/default.php";
+    $foreign = array_values(array_filter($seen['files'], static fn (string $file) => str_replace('\\', '/', $file) !== $written));
+    if ($foreign !== []) {
+        throw new RuntimeException('Local configuration reached the site: ' . json_encode($foreign));
+    }
 }
 
 /** Back to a tree that was never installed, with the installer of the repository. */
@@ -109,12 +224,14 @@ function installerFlowReset(): array
     $root = $site['root'];
     foreach ([
         'core/.install', 'core/config/database/connections/default.php', 'core/database/flow.sqlite',
-        'install.session.php', 'install', 'core/storage/bootstrap', 'assets/cache/installProc.inc.php',
+        'install.session.php', 'install', 'core/storage/bootstrap', 'core/storage/cache/env.php',
+        'assets/cache/installProc.inc.php',
     ] as $path) {
         installerFlowDelete("$root/$path");
     }
     mkdir("$root/core/storage/bootstrap", 0777, true);
-    installerFlowCopy(dirname(__DIR__, 3) . '/install', "$root/install");
+    installerFlowCopy(dirname(__DIR__, 3) . '/install', "$root/install", 'install');
+    installerFlowAssertIsolated($site);
 
     return $site;
 }
@@ -260,6 +377,20 @@ function installerFlowClose(Client $browser, string $page, bool $ticked): string
     return (string) $browser->post('/install/' . $form['action'], ['form_params' => $fields])->getBody();
 }
 
+/** The fixture took the writes, and the database of the conflicting settings took none. */
+function installerFlowExpectOwnDatabase(array $site): void
+{
+    installerFlowAssertIsolated($site);
+    $database = new PDO('sqlite:' . $site['root'] . '/core/database/flow.sqlite');
+    expect((int) $database->query('SELECT COUNT(*) FROM evo_site_content')->fetchColumn())->toBeGreaterThan(0)
+        ->and(hash_file('sha256', $site['original']))->toBe($site['originalHash']);
+}
+
+afterEach(function () {
+    $site = installerFlowSite();
+    expect(hash_file('sha256', $site['original']))->toBe($site['originalHash']);
+});
+
 afterAll(function () {
     installerFlowSite(true);
 });
@@ -273,6 +404,7 @@ function installerFlowClose(Client $browser, string $page, bool $ticked): string
     $site = installerFlowReset();
     [$browser, $page] = $scenario($site);
 
+    installerFlowExpectOwnDatabase($site);
     expect(file_get_contents($site['root'] . '/install.session.php'))->toContain('$install_token');
 
     expect(installerFlowClose($browser, $page, true))->toContain("window.location='../#?a=2'")
@@ -285,6 +417,7 @@ function installerFlowClose(Client $browser, string $page, bool $ticked): string
     $site = installerFlowReset();
     [$browser, $page] = $scenario($site);
 
+    installerFlowExpectOwnDatabase($site);
     expect(installerFlowClose($browser, $page, false))->toContain("window.location='../#?a=2'")
         ->and(is_file($site['root'] . '/install/index.php'))->toBeTrue()
         ->and(is_file($site['root'] . '/install.session.php'))->toBeTrue()
@@ -305,3 +438,38 @@ function installerFlowClose(Client $browser, string $page, bool $ticked): string
     installerFlowClose($browser, $page, true);
     expect(is_dir($site['root'] . '/install'))->toBeFalse();
 });
+
+test('local configuration stays out of the copy', function () {
+    $root = installerFlowSite()['root'];
+
+    expect(is_file("$root/.env"))->toBeFalse()
+        ->and(is_file("$root/.env.local"))->toBeFalse()
+        ->and(is_file("$root/core/custom/define.php"))->toBeFalse()
+        ->and(is_file("$root/core/custom/config/database/connections/default.php"))->toBeFalse()
+        ->and(is_file("$root/core/config/database/connections/local.php"))->toBeFalse()
+        ->and(is_file("$root/manager/includes/config.inc.php"))->toBeFalse()
+        ->and(file_get_contents("$root/core/custom/.env"))->toContain("$root/core/database/flow.sqlite");
+});
+
+test('a setting that reaches the site stops the test before it writes', function (string $path, string $content) {
+    $site = installerFlowReset();
+    $file = $site['root'] . '/' . $path;
+    $kept = is_file($file) ? file_get_contents($file) : null;
+    is_dir(dirname($file)) || mkdir(dirname($file), 0777, true);
+    file_put_contents($file, str_replace('ORIGINAL', $site['original'], $content));
+    installerFlowDelete($site['root'] . '/core/storage/cache/env.php');
+
+    try {
+        expect(fn () => installerFlowAssertIsolated($site))->toThrow(RuntimeException::class);
+    } finally {
+        $kept === null ? unlink($file) : file_put_contents($file, $kept);
+        installerFlowDelete($site['root'] . '/core/storage/cache/env.php');
+    }
+    installerFlowAssertIsolated($site);
+})->with([
+    'the .env of the site' => ['core/custom/.env', "DB_TYPE=sqlite\nDB_DATABASE=ORIGINAL\n"],
+    'a server in .env' => ['core/custom/.env', "DB_TYPE=mysql\nDB_HOST=db.example\n"],
+    'custom/define.php' => ['core/custom/define.php', "<?php\n"],
+    'custom/config' => ['core/custom/config/database/connections/default.php', "<?php return [];\n"],
+    'a connection file' => ['core/config/database/connections/local.php', "<?php return [];\n"],
+]);

From 0737592c102b4e9ada826e313ca278aa30236199 Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Thu, 5 Nov 2026 04:16:48 +0100
Subject: [PATCH 03/11] fix(nginx): let the classic updater run update.php

The update widget writes update.php to the site root and opens it, and the
catch-all of ng.inx answered 404, so the update could not start on nginx.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Unit/Security/ApacheConfigHardeningTest.php    | 10 ++++++++++
 ng.inx                                             | 14 ++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/core/tests/Unit/Security/ApacheConfigHardeningTest.php b/core/tests/Unit/Security/ApacheConfigHardeningTest.php
index 9792edd7a3..f2c3091002 100644
--- a/core/tests/Unit/Security/ApacheConfigHardeningTest.php
+++ b/core/tests/Unit/Security/ApacheConfigHardeningTest.php
@@ -178,6 +178,16 @@ static function (SplFileInfo $item) use ($relative, $skipNames, $skipPaths) {
         ->and(preg_match('~' . $location[1] . '~', '/manager/processors/save_user.processor.php'))->toBe(0);
 });
 
+it('lets nginx run the update.php the update widget opens, behind the manager allowlist', function () {
+    expect(evoFile('assets/plugins/updater/plugin.updater.php'))->toContain("EVO_SITE_URL . 'update.php");
+
+    preg_match('~location = /update\.php \{(.*?)\n    \}~s', evoFile('ng.inx'), $location);
+
+    expect($location)->toHaveKey(1)
+        ->and($location[1])->toContain('if ($manager_allowed = 0) { return 404; }')
+        ->and($location[1])->toContain('fastcgi_pass {php_backend};');
+});
+
 it('pins SERVER_NAME to the configured name in every nginx php block', function () {
     $nginx = evoFile('ng.inx');
 
diff --git a/ng.inx b/ng.inx
index c52e513cf1..507159abdf 100644
--- a/ng.inx
+++ b/ng.inx
@@ -294,6 +294,20 @@ server {
         fastcgi_pass {php_backend};
     }
 
+    # Written by the update widget, opened once, and deleted by itself.
+    location = /update.php {
+        if ($manager_allowed = 0) { return 404; }
+
+        try_files $uri @rewrite;
+
+        include /etc/nginx/fastcgi_params;
+        fastcgi_param SERVER_NAME $server_name;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param HTTPS on;
+        fastcgi_hide_header X-Powered-By;
+        fastcgi_pass {php_backend};
+    }
+
     # =====================================================================
     # Fall-through, both sections
     # =====================================================================

From 2572a29acc82c200179306bf60452235876251c6 Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Thu, 5 Nov 2026 04:16:49 +0100
Subject: [PATCH 04/11] fix(packages): stop treating a branch as changed when
 only one side names its commit

The lock gives "dev-main 18f1a03" and Composer prints "dev-main", so every
update of a site with a package on a branch stopped and asked for consent.
Two different references still count as a change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/src/Services/CustomComposerPackages.php        | 11 ++++++++++-
 .../Unit/Install/CliInstallCustomPackagesTest.php   | 13 +++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/core/src/Services/CustomComposerPackages.php b/core/src/Services/CustomComposerPackages.php
index 61a3ece40e..9ecf84e1db 100644
--- a/core/src/Services/CustomComposerPackages.php
+++ b/core/src/Services/CustomComposerPackages.php
@@ -686,7 +686,16 @@ public static function operations(string $output, bool $lockOnly = false): array
     public static function unexpectedChanges(array $operations, array $pins, array $packages): array
     {
         $custom = array_fill_keys(array_map('strtolower', $packages), true);
-        $sameVersion = static fn (string $a, string $b): bool => strtolower(ltrim($a, 'vV')) === strtolower(ltrim($b, 'vV'));
+        $sameVersion = static function (string $a, string $b): bool {
+            // A branch is "dev-main 18f1a03" in one source and "dev-main" in another: a reference
+            // on one side only says nothing, two different ones mean the branch moved.
+            [$versionA, $referenceA] = array_pad(explode(' ', strtolower(ltrim(trim($a), 'vV')), 2), 2, '');
+            [$versionB, $referenceB] = array_pad(explode(' ', strtolower(ltrim(trim($b), 'vV')), 2), 2, '');
+
+            return $versionA === $versionB
+                && ($referenceA === '' || $referenceB === ''
+                    || str_starts_with($referenceA, $referenceB) || str_starts_with($referenceB, $referenceA));
+        };
 
         $changes = [];
         foreach ($operations as $name => $operation) {
diff --git a/core/tests/Unit/Install/CliInstallCustomPackagesTest.php b/core/tests/Unit/Install/CliInstallCustomPackagesTest.php
index a4eff550f6..e959b16ff8 100644
--- a/core/tests/Unit/Install/CliInstallCustomPackagesTest.php
+++ b/core/tests/Unit/Install/CliInstallCustomPackagesTest.php
@@ -503,6 +503,19 @@ function removeCustomPackagesCore(string $core): void
         ]);
 });
 
+test('a branch counts as changed only when its reference moved', function (string $pinned, string $to, array $changes) {
+    $operations = ['acme/widget' => ['op' => 'install', 'from' => '', 'to' => $to]];
+
+    expect(CustomComposerPackages::unexpectedChanges($operations, ['acme/widget' => $pinned], ['acme/widget']))->toBe($changes);
+})->with([
+    'the lock knows the reference, Composer prints none' => ['dev-main 18f1a03', 'dev-main', []],
+    'Composer prints it, the lock does not' => ['dev-main', 'dev-main 18f1a03', []],
+    'short and long spelling of one commit' => ['dev-main 18f1a03', 'dev-main 18f1a03c9d2e', []],
+    'the branch moved' => ['dev-main 18f1a03', 'dev-main 77aa012', ['acme/widget dev-main 18f1a03 => dev-main 77aa012']],
+    'another branch' => ['dev-main 18f1a03', 'dev-next 18f1a03', ['acme/widget dev-main 18f1a03 => dev-next 18f1a03']],
+    'another release' => ['1.2.0', '1.3.0', ['acme/widget 1.2.0 => 1.3.0']],
+]);
+
 test('changes are judged on the lock, not on the vendor drift an update package ships', function () {
     // Composer 2.10 against the unpacked 3.5.8 archive, whose vendor is newer than its own lock.
     $output = "Loading composer repositories with package information\n"

From d55f4ace3d3b9913cf59dcaf4929347f2fee288b Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Thu, 5 Nov 2026 04:17:09 +0100
Subject: [PATCH 05/11] fix(installer): accept database hosts with underscores

Docker Swarm names services project_service, and the hostname filter refused
them, so the installer could not reach a database in such a stack.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../InstallerIdentifierValidationTest.php     | 24 +++++++++++++++++++
 install/src/functions.php                     |  4 +++-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/core/tests/Unit/Security/InstallerIdentifierValidationTest.php b/core/tests/Unit/Security/InstallerIdentifierValidationTest.php
index 363005f331..89938310d1 100644
--- a/core/tests/Unit/Security/InstallerIdentifierValidationTest.php
+++ b/core/tests/Unit/Security/InstallerIdentifierValidationTest.php
@@ -48,6 +48,30 @@ function installerRoot(string $path): string
     });
 });
 
+describe('validateDbHost()', function () {
+
+    test('accepts addresses, hostnames and Docker service names', function (string $host) {
+        expect(validateDbHost($host, 'mysql'))->toBe($host);
+    })->with([
+        'hostname' => ['db.example.com'],
+        'hostname with a port' => ['db.example.com:3307'],
+        'address' => ['10.0.0.5'],
+        'service name' => ['project_service-db'],
+        'service name with a port' => ['project_service-db:3306'],
+    ]);
+
+    test('rejects what is no host', function (string $host) {
+        expect(fn () => validateDbHost($host, 'mysql'))->toThrow(InvalidArgumentException::class);
+    })->with([
+        'space' => ['db host'],
+        'quote' => ["db'host"],
+        'slash' => ['db/host'],
+        'dollar' => ['db$host'],
+        'label ending in a dash' => ['db-.example.com'],
+        'label ending in an underscore' => ['db_.example.com'],
+    ]);
+});
+
 describe('validateDbCollation()', function () {
 
     test('accepts MySQL, PostgreSQL and SQLite collations', function (string $collation) {
diff --git a/install/src/functions.php b/install/src/functions.php
index 2057b98efd..1b382b8ad9 100644
--- a/install/src/functions.php
+++ b/install/src/functions.php
@@ -312,7 +312,9 @@ function validateDbHost($host, $type)
     }
     $parts = databaseHostParts($host);
     if (!$ip = filter_var($parts['host'], FILTER_VALIDATE_IP)) {
-        if (!$parts['host'] = filter_var($parts['host'], FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME)) {
+        // Docker service names carry underscores, which the hostname filter refuses.
+        $hostname = str_replace('_', '-', $parts['host']);
+        if (filter_var($hostname, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) === false) {
             throw new InvalidArgumentException("Database host should be valid IP or hostname");
         }
     } else {

From 5946acac0b5971b5e4f41f5edae1c607c1e18ef8 Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Thu, 5 Nov 2026 04:17:36 +0100
Subject: [PATCH 06/11] fix(installer): let a SQLite database sit in a folder
 below core/database

The name check refused "/", so a database on a mounted folder could not be
chosen in the browser. It stays a SQLite thing, and dots stay refused, so the
name cannot leave core/database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../InstallerIdentifierValidationTest.php     | 31 +++++++++++++++++++
 install/src/controllers/connection.php        |  2 +-
 .../src/controllers/connection/collation.php  |  2 +-
 .../controllers/connection/databasetest.php   |  2 +-
 install/src/controllers/install.php           |  2 +-
 install/src/controllers/options.php           |  2 +-
 install/src/controllers/summary.php           |  2 +-
 install/src/functions.php                     |  6 +++-
 8 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/core/tests/Unit/Security/InstallerIdentifierValidationTest.php b/core/tests/Unit/Security/InstallerIdentifierValidationTest.php
index 89938310d1..1d9651e821 100644
--- a/core/tests/Unit/Security/InstallerIdentifierValidationTest.php
+++ b/core/tests/Unit/Security/InstallerIdentifierValidationTest.php
@@ -46,6 +46,25 @@ function installerRoot(string $path): string
     test('rejects names of 64 characters or more', function () {
         expect(fn () => validateDbName(str_repeat('a', 64)))->toThrow(InvalidArgumentException::class);
     });
+
+    test('lets a SQLite file sit in a folder below core/database', function () {
+        expect(validateDbName('sqlite/evolution', 'sqlite'))->toBe('sqlite/evolution')
+            ->and(validateDbName('a/b/evolution', 'sqlite'))->toBe('a/b/evolution')
+            ->and(validateDbName('evolution', 'sqlite'))->toBe('evolution');
+    });
+
+    test('a folder stays a SQLite thing and never climbs out of core/database', function (string $name, string $type) {
+        expect(fn () => validateDbName($name, $type))->toThrow(InvalidArgumentException::class);
+    })->with([
+        'mysql' => ['sqlite/evolution', 'mysql'],
+        'pgsql' => ['sqlite/evolution', 'pgsql'],
+        'no type' => ['sqlite/evolution', ''],
+        'parent' => ['../evolution', 'sqlite'],
+        'parent inside' => ['a/../../evolution', 'sqlite'],
+        'absolute' => ['/etc/evolution', 'sqlite'],
+        'trailing slash' => ['evolution/', 'sqlite'],
+        'backslash' => ['a\\evolution', 'sqlite'],
+    ]);
 });
 
 describe('validateDbHost()', function () {
@@ -113,6 +132,18 @@ function installerRoot(string $path): string
 
 describe('call sites', function () {
 
+    test('every controller tells validateDbName() the database type', function (string $file) {
+        expect(installerRoot($file))
+            ->toMatch('/validateDbName\(\$_POST\[\'database_name\'\], \$(driver|database_type)\)/');
+    })->with([
+        'install/src/controllers/connection.php',
+        'install/src/controllers/connection/collation.php',
+        'install/src/controllers/connection/databasetest.php',
+        'install/src/controllers/install.php',
+        'install/src/controllers/options.php',
+        'install/src/controllers/summary.php',
+    ]);
+
     test('the database test validates the collation before it reaches CREATE DATABASE', function () {
         expect(installerRoot('install/src/controllers/connection/databasetest.php'))
             ->toContain("\$database_collation = validateDbCollation(\$_POST['database_collation'] ?? '');")
diff --git a/install/src/controllers/connection.php b/install/src/controllers/connection.php
index b4ba2ee826..f2047ba58a 100644
--- a/install/src/controllers/connection.php
+++ b/install/src/controllers/connection.php
@@ -7,7 +7,7 @@
 if ($installMode === 0) {
     $database_type = isset($_POST['database_type']) ? validateDbType($_POST['database_type']) :
         (isset($_SESSION['databasetype']) ? $_SESSION['databasetype'] : array_key_first($dbTypes));
-    $database_name = isset($_POST['database_name']) ? validateDbName($_POST['database_name']) : '';
+    $database_name = isset($_POST['database_name']) ? validateDbName($_POST['database_name'], $database_type) : '';
     $database_host = isset($_POST['databasehost']) ? validateDbHost($_POST['databasehost'], $database_type) : 'localhost';
     $databaseloginname = isset($_SESSION['databaseloginname']) ? $_SESSION['databaseloginname'] : '';
     $databaseloginpassword = isset($_SESSION['databaseloginpassword']) ? $_SESSION['databaseloginpassword'] : '';
diff --git a/install/src/controllers/connection/collation.php b/install/src/controllers/connection/collation.php
index 313795691d..86aa0ba849 100644
--- a/install/src/controllers/connection/collation.php
+++ b/install/src/controllers/connection/collation.php
@@ -5,7 +5,7 @@
     $uid = validateDbUser($_POST['uid'], $driver);
     $pwd = validateDbPassword($_POST['pwd'], $driver);
     $database_name = isset($_POST['database_name']) && $_POST['database_name'] !== ''
-        ? validateDbName($_POST['database_name']) : '';
+        ? validateDbName($_POST['database_name'], $driver) : '';
 } catch (Throwable $e) {
     echo '<span id="database_fail">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
 }
diff --git a/install/src/controllers/connection/databasetest.php b/install/src/controllers/connection/databasetest.php
index 1b831be7d4..8a1215712a 100644
--- a/install/src/controllers/connection/databasetest.php
+++ b/install/src/controllers/connection/databasetest.php
@@ -6,7 +6,7 @@
     $uid = validateDbUser($_POST['uid'], $driver);
     $pwd = validateDbPassword($_POST['pwd'], $driver);
     $tableprefix = validateTablePrefix($_POST['tableprefix']);
-    $database_name = validateDbName($_POST['database_name']);
+    $database_name = validateDbName($_POST['database_name'], $driver);
     $database_collation = validateDbCollation($_POST['database_collation'] ?? '');
 } catch (InvalidArgumentException $e) {
     exit($output . '<span id="database_fail">' . $_lang['status_failed'] . ' '
diff --git a/install/src/controllers/install.php b/install/src/controllers/install.php
index 6b920bfba8..1a01b0ec25 100644
--- a/install/src/controllers/install.php
+++ b/install/src/controllers/install.php
@@ -42,7 +42,7 @@
 $database_password = $_SESSION['databaseloginpassword'] ?? '';
 $database_collation = validateDbCollation($_POST['database_collation']);
 $database_connection_charset = validateDbCollation($_POST['database_connection_charset']);
-$database_name = validateDbName($_POST['database_name']);
+$database_name = validateDbName($_POST['database_name'], $database_type);
 if ($installMode !== 1) {
     $adminname = validateAdminUsername($_POST['cmsadmin']);
     $adminemail = validateAdminEmail($_POST['cmsadminemail']);
diff --git a/install/src/controllers/options.php b/install/src/controllers/options.php
index 3d24c1dd45..b9f1fade90 100644
--- a/install/src/controllers/options.php
+++ b/install/src/controllers/options.php
@@ -6,7 +6,7 @@
 // Early validation for new or advanced install modes
 if ($installMode === 0 || $installMode === 2) {
     $database_type = validateDbType($_POST['database_type']);
-    $database_name = validateDbName($_POST['database_name']);
+    $database_name = validateDbName($_POST['database_name'], $database_type);
     $databasehost = validateDbHost($_POST['databasehost'], $database_type);
     $databaseloginname = isset($_POST['databaseloginname']) ? validateDbUser($_POST['databaseloginname'], $database_type) : $_SESSION['databaseloginname'];
     $databaseloginpassword = isset($_POST['databaseloginpassword']) ? validateDbPassword($_POST['databaseloginpassword'], $database_type) : $_SESSION['databaseloginpassword'];
diff --git a/install/src/controllers/summary.php b/install/src/controllers/summary.php
index b3856abc61..fab261d341 100644
--- a/install/src/controllers/summary.php
+++ b/install/src/controllers/summary.php
@@ -207,7 +207,7 @@ function f_owc($path, $data, $mode = null): bool
     $database_password = $_SESSION['databaseloginpassword'];
     $database_collation = validateDbCollation($_POST['database_collation']);
     $database_connection_charset = validateDbCollation($_POST['database_connection_charset']);
-    $database_name = validateDbName($_POST['database_name']);
+    $database_name = validateDbName($_POST['database_name'], $database_type);
     $table_prefix = validateTablePrefix($_POST['tableprefix']);
 }
 echo '<p>' . $_lang['creating_database_connection'];
diff --git a/install/src/functions.php b/install/src/functions.php
index 1b382b8ad9..569d367558 100644
--- a/install/src/functions.php
+++ b/install/src/functions.php
@@ -249,7 +249,7 @@ function validateDbType($type)
 }
 
 
-function validateDbName($name)
+function validateDbName($name, $type = '')
 {
     $name = trim($name ?? '', ' `');
     if (strlen($name) === 0) {
@@ -260,6 +260,10 @@ function validateDbName($name)
     }
     // The name is spliced into CREATE DATABASE and the config file. preg_match() returns 0, not
     // false, for a mismatch, so the old "=== false" test let everything through.
+    // SQLite names a file below core/database, which may sit in a folder of its own (a mounted volume).
+    if ($type === 'sqlite' && preg_match('~^[A-Za-z0-9_$-]+(?:/[A-Za-z0-9_$-]+)*$~', $name) === 1) {
+        return $name;
+    }
     if (preg_match('/^[A-Za-z0-9_$-]+$/', $name) !== 1) {
         throw new InvalidArgumentException("Database name should contain only letters, numbers, dashes,"
             . " dollar signs and underscores");

From 7d73c568371e4dcf59cb079f72d023d74095885f Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Thu, 5 Nov 2026 04:18:11 +0100
Subject: [PATCH 07/11] fix(installer): tell visitors behind a proxy apart in
 the installer lock

REMOTE_ADDR behind a proxy is the proxy, so the address check of the lock
compared one value for everyone, and on the same host that value is loopback,
which may take over a lock: a stranger could take a running install. The lock
now keeps the forwarded client next to REMOTE_ADDR. Without a proxy nothing
changes, and the header cannot be used to pass for another address.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/src/Middleware/Manager.php               |  2 +-
 core/src/Support/InstallerCompletion.php      | 24 +++++++
 .../Unit/Security/InstallerCompletionTest.php | 64 +++++++++++++++++++
 install/index.php                             |  2 +-
 install/src/controllers/install.php           |  2 +-
 .../processors/remove_installer.processor.php |  2 +-
 6 files changed, 92 insertions(+), 4 deletions(-)

diff --git a/core/src/Middleware/Manager.php b/core/src/Middleware/Manager.php
index a8dabfc172..d3a97fbd9d 100644
--- a/core/src/Middleware/Manager.php
+++ b/core/src/Middleware/Manager.php
@@ -82,7 +82,7 @@ protected function grantInstaller(bool $secure): void
         $held = is_string($held) ? $held : null;
         $secret = InstallerCompletion::grantToAdministrator(
             EVO_BASE_PATH . 'install.session.php',
-            (string) ($_SERVER['REMOTE_ADDR'] ?? ''),
+            InstallerCompletion::clientAddress($_SERVER),
             $held,
             time(),
             (int) ini_get('session.gc_maxlifetime')
diff --git a/core/src/Support/InstallerCompletion.php b/core/src/Support/InstallerCompletion.php
index 72c719544f..04e5a22686 100644
--- a/core/src/Support/InstallerCompletion.php
+++ b/core/src/Support/InstallerCompletion.php
@@ -20,6 +20,30 @@ final class InstallerCompletion
     /** The installer refuses the request. */
     public const DENY = 'deny';
 
+    /**
+     * The address an installer lock is tied to.
+     *
+     * Behind a proxy REMOTE_ADDR is the proxy, the same for every visitor, and on the same host it is
+     * loopback, which may take over a lock. So a forwarded client is kept next to it. The headers can
+     * be forged, but only to tell a request apart: REMOTE_ADDR stays part of the value, and a request
+     * that sends one is never loopback.
+     *
+     * @param array<string, mixed> $server A `$_SERVER`-shaped array.
+     */
+    public static function clientAddress(array $server): string
+    {
+        $remote = is_string($server['REMOTE_ADDR'] ?? null) ? $server['REMOTE_ADDR'] : '';
+
+        foreach (['HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP'] as $header) {
+            $value = is_string($server[$header] ?? null) ? trim(explode(',', $server[$header], 2)[0]) : '';
+            if (filter_var($value, FILTER_VALIDATE_IP) !== false) {
+                return $value . '@' . $remote;
+            }
+        }
+
+        return $remote;
+    }
+
     /**
      * Record a successful installation: the one-time token that authorizes removing the installer.
      * An administrator's grant held by the lock is kept.
diff --git a/core/tests/Unit/Security/InstallerCompletionTest.php b/core/tests/Unit/Security/InstallerCompletionTest.php
index aee89fd0bd..a21a2b93c8 100644
--- a/core/tests/Unit/Security/InstallerCompletionTest.php
+++ b/core/tests/Unit/Security/InstallerCompletionTest.php
@@ -20,6 +20,70 @@
         ->and(InstallerCompletion::matches($lock, $token, '203.0.113.10', $now + 1441, 1440))->toBeFalse();
 });
 
+test('the lock address is REMOTE_ADDR, with the forwarded client next to it', function (array $server, string $address) {
+    expect(InstallerCompletion::clientAddress($server))->toBe($address);
+})->with([
+    'no proxy' => [['REMOTE_ADDR' => '203.0.113.10'], '203.0.113.10'],
+    'a proxy' => [['REMOTE_ADDR' => '10.11.0.6', 'HTTP_X_FORWARDED_FOR' => '203.0.113.10'], '203.0.113.10@10.11.0.6'],
+    'a chain of proxies' => [['REMOTE_ADDR' => '10.11.0.6', 'HTTP_X_FORWARDED_FOR' => '203.0.113.10, 10.0.0.1'], '203.0.113.10@10.11.0.6'],
+    'X-Real-IP only' => [['REMOTE_ADDR' => '127.0.0.1', 'HTTP_X_REAL_IP' => '203.0.113.10'], '203.0.113.10@127.0.0.1'],
+    'a header that is no address' => [['REMOTE_ADDR' => '203.0.113.10', 'HTTP_X_FORWARDED_FOR' => '<script>'], '203.0.113.10'],
+    'nothing known' => [[], ''],
+]);
+
+test('visitors behind one proxy are told apart, and the address still counts without a proxy', function () {
+    $now = 1_800_000_000;
+    $lock = [
+        'session' => 'owner',
+        'ip' => InstallerCompletion::clientAddress(['REMOTE_ADDR' => '10.11.0.6', 'HTTP_X_FORWARDED_FOR' => '203.0.113.10']),
+        'timestamp' => $now,
+        'token' => null,
+        'grant' => null,
+    ];
+    $stranger = InstallerCompletion::clientAddress(['REMOTE_ADDR' => '10.11.0.6', 'HTTP_X_FORWARDED_FOR' => '198.51.100.7']);
+    $direct = ['ip' => '203.0.113.10'] + $lock;
+
+    expect(InstallerCompletion::decide($lock, false, 'owner', $lock['ip'], null, $now, 1440))->toBe(InstallerCompletion::PROCEED)
+        ->and(InstallerCompletion::decide($lock, false, 'owner', $stranger, null, $now, 1440))->toBe(InstallerCompletion::DENY)
+        ->and(InstallerCompletion::decide($direct, false, 'owner', '203.0.113.10', null, $now, 1440))->toBe(InstallerCompletion::PROCEED)
+        ->and(InstallerCompletion::decide($direct, false, 'owner', '198.51.100.7', null, $now, 1440))->toBe(InstallerCompletion::DENY);
+});
+
+test('a proxy on the same host does not let a stranger take over a running install', function () {
+    $now = 1_800_000_000;
+    $server = ['REMOTE_ADDR' => '127.0.0.1'];
+    $lock = [
+        'session' => 'owner',
+        'ip' => InstallerCompletion::clientAddress($server + ['HTTP_X_FORWARDED_FOR' => '203.0.113.10']),
+        'timestamp' => $now,
+        'token' => null,
+        'grant' => null,
+    ];
+    $stranger = InstallerCompletion::clientAddress($server + ['HTTP_X_FORWARDED_FOR' => '198.51.100.7']);
+    $local = ['ip' => '127.0.0.1'] + $lock;
+
+    expect(InstallerCompletion::decide($lock, false, 'stranger', $stranger, null, $now, 1440))->toBe(InstallerCompletion::DENY)
+        // A forged header cannot reach the takeover either, and a real local browser keeps it.
+        ->and(InstallerCompletion::decide($local, false, 'stranger', $stranger, null, $now, 1440))->toBe(InstallerCompletion::DENY)
+        ->and(InstallerCompletion::decide($local, false, 'browser', '127.0.0.1', null, $now, 1440))->toBe(InstallerCompletion::CLAIM);
+});
+
+test('every step of the installer ties its lock to the same address', function () {
+    $root = dirname(__DIR__, 4);
+
+    foreach ([
+        'install/index.php',
+        'install/src/controllers/install.php',
+        'manager/processors/remove_installer.processor.php',
+        'core/src/Middleware/Manager.php',
+    ] as $file) {
+        $source = (string) file_get_contents($root . '/' . $file);
+
+        expect($source)->toContain('InstallerCompletion::clientAddress($_SERVER)')
+            ->and($source)->not->toContain("\$_SERVER['REMOTE_ADDR']");
+    }
+});
+
 test('a generic installer lock is not a removal capability', function () {
     $lockFile = tempnam(sys_get_temp_dir(), 'evo-install-lock-');
     file_put_contents(
diff --git a/install/index.php b/install/index.php
index 3444e616b3..1c4b3b2acd 100644
--- a/install/index.php
+++ b/install/index.php
@@ -45,7 +45,7 @@
 session_start();
 
 // Get current IP, session ID, and current time
-$ip = $_SERVER['REMOTE_ADDR'];
+$ip = InstallerCompletion::clientAddress($_SERVER);
 $sid = session_id();
 $current_time = time();
 
diff --git a/install/src/controllers/install.php b/install/src/controllers/install.php
index 1a01b0ec25..89dad430a5 100644
--- a/install/src/controllers/install.php
+++ b/install/src/controllers/install.php
@@ -812,7 +812,7 @@
             InstallerCompletion::writeLock(
                 EVO_BASE_PATH . 'install.session.php',
                 session_id(),
-                (string) ($_SERVER['REMOTE_ADDR'] ?? ''),
+                InstallerCompletion::clientAddress($_SERVER),
                 time(),
                 $installerRemovalToken
             );
diff --git a/manager/processors/remove_installer.processor.php b/manager/processors/remove_installer.processor.php
index 6fb423466e..2039b7a827 100755
--- a/manager/processors/remove_installer.processor.php
+++ b/manager/processors/remove_installer.processor.php
@@ -60,7 +60,7 @@ function rmdirRecursive($path, $followLinks = false)
     || !InstallerCompletion::matches(
         $lock,
         $requestToken,
-        (string) ($_SERVER['REMOTE_ADDR'] ?? ''),
+        InstallerCompletion::clientAddress($_SERVER),
         time(),
         $maxLifetime
     )

From a73bbfdfbfa7bcf4fbbe735e24d89cfdf0c4b44d Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Thu, 5 Nov 2026 04:18:14 +0100
Subject: [PATCH 08/11] upd(installer): say on the connection form which
 settings the environment overrides

The connection config asks env('DB_*') first, so what the form said about
those settings was dropped without a word.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../InstallerIdentifierValidationTest.php     | 29 +++++++++++++++++++
 install/src/controllers/connection.php        |  5 ++++
 install/src/functions.php                     | 21 ++++++++++++++
 install/src/lang/en.inc.php                   |  1 +
 install/src/template/actions/connection.tpl   |  1 +
 5 files changed, 57 insertions(+)

diff --git a/core/tests/Unit/Security/InstallerIdentifierValidationTest.php b/core/tests/Unit/Security/InstallerIdentifierValidationTest.php
index 1d9651e821..1f726a151b 100644
--- a/core/tests/Unit/Security/InstallerIdentifierValidationTest.php
+++ b/core/tests/Unit/Security/InstallerIdentifierValidationTest.php
@@ -91,6 +91,35 @@ function installerRoot(string $path): string
     ]);
 });
 
+describe('databaseEnvOverrides()', function () {
+
+    afterEach(function () {
+        putenv('DB_HOST');
+    });
+
+    test('names the settings of the environment and of the .env files', function () {
+        $file = tempnam(sys_get_temp_dir(), 'evo-env-');
+        file_put_contents($file, "# DB_PORT=1\nDB_DATABASE=evo\n  export DB_PREFIX=evo_\nAPP_DB_USERNAME=x\n");
+        putenv('DB_HOST=database');
+
+        expect(databaseEnvOverrides([$file, $file . '.missing']))->toBe(['DB_HOST', 'DB_DATABASE', 'DB_PREFIX']);
+
+        unlink($file);
+    });
+
+    test('the connection form shows them, and the connection config really asks for them', function () {
+        $config = installerRoot('install/stubs/files/config/database/connections/default.tpl');
+
+        expect(installerRoot('install/src/template/actions/connection.tpl'))->toContain('[+env_notice+]')
+            ->and(installerRoot('install/src/controllers/connection.php'))->toContain('databaseEnvOverrides()')
+            ->and(installerRoot('install/src/lang/en.inc.php'))->toContain("'connection_screen_env_notice'");
+
+        foreach (['DB_TYPE', 'DB_HOST', 'DB_PORT', 'DB_DATABASE', 'DB_USERNAME', 'DB_PASSWORD', 'DB_CHARSET', 'DB_COLLATION', 'DB_PREFIX'] as $name) {
+            expect($config)->toContain("env('$name'");
+        }
+    });
+});
+
 describe('validateDbCollation()', function () {
 
     test('accepts MySQL, PostgreSQL and SQLite collations', function (string $collation) {
diff --git a/install/src/controllers/connection.php b/install/src/controllers/connection.php
index f2047ba58a..bda9dba0c3 100644
--- a/install/src/controllers/connection.php
+++ b/install/src/controllers/connection.php
@@ -159,6 +159,11 @@
 $ph['databaseloginname'] = escapeHtmlAttribute(isset($_SESSION['databaseloginname']) ? $_SESSION['databaseloginname'] : '');
 $ph['databaseloginpassword'] = escapeHtmlAttribute(isset($_SESSION['databaseloginpassword']) ? $_SESSION['databaseloginpassword'] : '');
 $ph['MGR_DIR'] = escapeHtmlAttribute(MGR_DIR);
+$envOverrides = databaseEnvOverrides();
+$ph['env_notice'] = $envOverrides === [] ? '' : '<p><strong>' . sprintf(
+    escapeHtmlAttribute($_lang['connection_screen_env_notice']),
+    escapeHtmlAttribute(implode(', ', $envOverrides))
+) . '</strong></p>';
 
 $content = file_get_contents(dirname(__DIR__) . '/template/actions/connection.tpl');
 $content = parse($content, $_lang, '[%', '%]');
diff --git a/install/src/functions.php b/install/src/functions.php
index 569d367558..dd62fc167e 100644
--- a/install/src/functions.php
+++ b/install/src/functions.php
@@ -153,6 +153,27 @@ function databaseHostParts(string $host): array
     return ['host' => $host, 'port' => $port];
 }
 
+/**
+ * The database settings fixed outside the installer: the connection config asks the environment
+ * first, so these win over whatever the form says.
+ *
+ * @param list<string>|null $envFiles
+ * @return list<string>
+ */
+function databaseEnvOverrides(?array $envFiles = null): array
+{
+    $content = '';
+    foreach ($envFiles ?? [EVO_CORE_PATH . 'custom/.env', dirname(EVO_CORE_PATH) . '/.env'] as $file) {
+        $content .= is_file($file) ? file_get_contents($file) . "\n" : '';
+    }
+
+    return array_values(array_filter(
+        ['DB_TYPE', 'DB_HOST', 'DB_PORT', 'DB_DATABASE', 'DB_USERNAME', 'DB_PASSWORD', 'DB_CHARSET', 'DB_COLLATION', 'DB_PREFIX'],
+        static fn (string $name): bool => getenv($name) !== false
+            || preg_match('/^\s*(?:export\s+)?' . $name . '\s*=/m', $content) === 1
+    ));
+}
+
 function databaseDsn(string $driver, string $host, ?string $database = null): string
 {
     $parts = databaseHostParts($host);
diff --git a/install/src/lang/en.inc.php b/install/src/lang/en.inc.php
index 83e560219a..4c81c38601 100644
--- a/install/src/lang/en.inc.php
+++ b/install/src/lang/en.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Database Information',
   'connection_screen_database_login' => 'Database login name:',
   'connection_screen_database_name' => 'Database name:',
+  'connection_screen_env_notice' => 'These settings are set in the environment and override this form: %s.',
   'connection_screen_database_pass' => 'Database password:',
   'connection_screen_database_test_connection' => 'Create or test selection of your database.',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/template/actions/connection.tpl b/install/src/template/actions/connection.tpl
index d154aac752..a3bcc540d5 100644
--- a/install/src/template/actions/connection.tpl
+++ b/install/src/template/actions/connection.tpl
@@ -13,6 +13,7 @@
     <input type="hidden" value="1" name="chkagree" [+checkedChkagree+] />
     <input type="hidden" value="[+installMode+]" name="installmode" />
     <h2>[%connection_screen_database_info%]</h2>
+    [+env_notice+]
     <h3>[%connection_screen_server_connection_information%]</h3>
     <p>[%connection_screen_server_connection_note%]</p>
     <p class="labelHolder">

From cb4c73fa056e9c5e6c735dbd249b6cc5f40ed355 Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Thu, 5 Nov 2026 04:24:03 +0100
Subject: [PATCH 09/11] add(manager): warn when the .htaccess of a site lacks
 the rules of its release

An update keeps the site's .htaccess, so a site installed before a rule was
added stays without it: on 3.5.8 updated to 3.5.9 dumps under assets could be
read and PHP under assets ran. The file stays the operator's: make:site and
the dashboard name what is missing, and the warning can be hidden.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/lang/en/global.php                       |  2 +
 core/src/Console/SiteUpdateCommand.php        | 25 ++++++++++++
 core/src/Support/HtaccessRules.php            | 35 +++++++++++++++++
 .../tests/Unit/Security/HtaccessRulesTest.php | 39 +++++++++++++++++++
 manager/includes/config_check.inc.php         | 14 +++++++
 5 files changed, 115 insertions(+)
 create mode 100644 core/src/Support/HtaccessRules.php
 create mode 100644 core/tests/Unit/Security/HtaccessRulesTest.php

diff --git a/core/lang/en/global.php b/core/lang/en/global.php
index 8edd5933d5..934844e250 100644
--- a/core/lang/en/global.php
+++ b/core/lang/en/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'This means that your Unauthorized page is not accessible to normal web surfers or does not exist. This can lead to a recursive looping condition and many errors in your site logs. Make sure there are no Webuser Groups assigned to the page.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'The Unauthorized page defined in the site configuration settings is not published.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'This means that your Unauthorized page is inaccessible to the general public. Publish the page or make sure it is assigned to an existing Resource in your Site Tree in the Tools &gt; Configuration menu.';
+$_lang["configcheck_htaccess_rules"] = 'Security Warning: .htaccess is out of date';
+$_lang["configcheck_htaccess_rules_msg"] = 'The <strong>.htaccess</strong> file of this site lacks security rules of the current release, and updates never change this file. Private files, backups or PHP files under assets may be reachable. Compare it with <strong>ht.access</strong> of this release and add the missing rules.';
 $_lang["configcheck_validate_referer"] = 'Security Warning: HTTP Header Validation';
 $_lang["configcheck_validate_referer_msg"] = 'The configuration setting <strong>Validate HTTP_REFERER headers?</strong> is Off. We recommend turning it On. <a href="index.php?a=17">Go to Configuration options</a>';
 $_lang["configcheck_warning"] = 'Configuration warning: ';
diff --git a/core/src/Console/SiteUpdateCommand.php b/core/src/Console/SiteUpdateCommand.php
index 13efd7402c..be31928f45 100644
--- a/core/src/Console/SiteUpdateCommand.php
+++ b/core/src/Console/SiteUpdateCommand.php
@@ -7,6 +7,7 @@
 use EvolutionCMS\Services\ComposerVersionSynchronizer;
 use EvolutionCMS\Services\CustomComposerPackages;
 use EvolutionCMS\Services\Store\RemoteTransportService;
+use EvolutionCMS\Support\HtaccessRules;
 use EvolutionCMS\Traits\RunsComposerShell;
 use Illuminate\Console\Command;
 
@@ -322,6 +323,7 @@ public function startUpdate()
                 }
             }
             $this->cleanupUpdatePlaceholderFiles();
+            $this->warnAboutHtaccess();
             $this->synchronizeComposerVersion();
             $this->installComposerDependencies($customPackageUpdate, $customPackageNames);
             $this->runCoreMigrations();
@@ -629,6 +631,29 @@ protected function cleanupUpdatePlaceholderFiles(): void
         }
     }
 
+    /**
+     * The update keeps the site's .htaccess: say so when that leaves it without the rules of this release.
+     *
+     * @since 3.5.10
+     * @return void
+     */
+    protected function warnAboutHtaccess(): void
+    {
+        $file = EVO_BASE_PATH . '.htaccess';
+        if (!is_file($file)) {
+            return;
+        }
+
+        $missing = HtaccessRules::missing((string) file_get_contents($file));
+        if ($missing !== []) {
+            $this->warn('.htaccess was kept and lacks ' . count($missing) . ' security rules of this release.'
+                . ' On Apache, add them from ht.access of this release:');
+            foreach ($missing as $rule) {
+                $this->warn('  ' . $rule);
+            }
+        }
+    }
+
     /**
      * Placeholder files shipped by the core archive and their local replacements.
      *
diff --git a/core/src/Support/HtaccessRules.php b/core/src/Support/HtaccessRules.php
new file mode 100644
index 0000000000..03d0f502b0
--- /dev/null
+++ b/core/src/Support/HtaccessRules.php
@@ -0,0 +1,35 @@
+<?php declare(strict_types=1);
+
+namespace EvolutionCMS\Support;
+
+/**
+ * The rules of ht.access that keep private files private.
+ *
+ * A site's .htaccess belongs to its operator and no update touches it, so a file laid by an older
+ * release keeps working without the rules added since. They are only compared and reported.
+ *
+ * @since 3.5.10
+ */
+final class HtaccessRules
+{
+    public const REQUIRED = [
+        'RewriteRule ^(core|views|vendor|tmp)(/|$) - [F,L]',
+        'RewriteRule ^assets/(cache|backup|export|import)(/|$) - [F,L]',
+        'RewriteRule ^(composer\.(json|lock)|phpstan\.neon|publiccode\.yml|AGENTS\.md|README\.md|ht\.access|ng\.inx|config\.php(\.example)?)$ - [F,L]',
+        'RewriteRule \.(sql|sqlite|db|log|bak|old|orig|save|swp|swo|tpl|inc|ini|env|dist|example|yml|yaml|lock|tar)(\.(gz|bz2|xz|zip|tgz))?$ - [F,L,NC]',
+        'RewriteRule ^assets/.*\.php$ - [F,L,NC]',
+    ];
+
+    /**
+     * @return list<string> The required rules a .htaccess does not have, commented out ones included.
+     */
+    public static function missing(string $htaccess): array
+    {
+        $lines = array_map(
+            static fn (string $line): string => (string) preg_replace('/\s+/', ' ', trim($line)),
+            preg_split('/\R/', $htaccess) ?: []
+        );
+
+        return array_values(array_diff(self::REQUIRED, $lines));
+    }
+}
diff --git a/core/tests/Unit/Security/HtaccessRulesTest.php b/core/tests/Unit/Security/HtaccessRulesTest.php
new file mode 100644
index 0000000000..052c97d5dd
--- /dev/null
+++ b/core/tests/Unit/Security/HtaccessRulesTest.php
@@ -0,0 +1,39 @@
+<?php
+
+use EvolutionCMS\Support\HtaccessRules;
+
+require_once dirname(__DIR__, 3) . '/src/Support/HtaccessRules.php';
+
+function htaccessRulesFile(string $path): string
+{
+    return (string) file_get_contents(dirname(__DIR__, 4) . '/' . $path);
+}
+
+test('the rules it asks for are the rules ht.access ships', function () {
+    expect(HtaccessRules::missing(htaccessRulesFile('ht.access')))->toBe([]);
+});
+
+test('it names what a .htaccess of an older release lacks', function () {
+    $older = implode("\n", array_slice(HtaccessRules::REQUIRED, 0, 2));
+
+    expect(HtaccessRules::missing($older))->toBe(array_slice(HtaccessRules::REQUIRED, 2));
+});
+
+test('a commented out rule is a missing rule, and spacing does not matter', function () {
+    $file = "\t" . str_replace(' ', "  ", HtaccessRules::REQUIRED[0]) . "\r\n# " . HtaccessRules::REQUIRED[1] . "\r\n";
+
+    expect(HtaccessRules::missing($file))->toBe(array_slice(HtaccessRules::REQUIRED, 1));
+});
+
+test('the dashboard and make:site report it', function () {
+    expect(htaccessRulesFile('manager/includes/config_check.inc.php'))
+        ->toContain('HtaccessRules::missing(')
+        ->toContain("_hide_configcheck_htaccess_rules")
+        ->toContain("\$_lang['configcheck_htaccess_rules_msg']")
+        ->and(htaccessRulesFile('core/lang/en/global.php'))
+        ->toContain('$_lang["configcheck_htaccess_rules"]')
+        ->toContain('$_lang["configcheck_htaccess_rules_msg"]')
+        ->and(htaccessRulesFile('core/src/Console/SiteUpdateCommand.php'))
+        ->toContain('$this->warnAboutHtaccess();')
+        ->toContain('HtaccessRules::missing(');
+});
diff --git a/manager/includes/config_check.inc.php b/manager/includes/config_check.inc.php
index 61d23f2dff..1a660d64ff 100755
--- a/manager/includes/config_check.inc.php
+++ b/manager/includes/config_check.inc.php
@@ -30,6 +30,15 @@
     $warnings[] = [$_lang['configcheck_php_gdzip']];
 }
 
+if (
+    (EvolutionCMS()->config['_hide_configcheck_htaccess_rules'] ?? '') !== '1'
+    && stripos((string) ($_SERVER['SERVER_SOFTWARE'] ?? ''), 'apache') !== false
+    && is_file(EVO_BASE_PATH . '.htaccess')
+    && \EvolutionCMS\Support\HtaccessRules::missing((string) file_get_contents(EVO_BASE_PATH . '.htaccess')) !== []
+) {
+    $warnings[] = [$_lang['configcheck_htaccess_rules']];
+}
+
 if(!isset(EvolutionCMS()->config['_hide_configcheck_validate_referer']) || EvolutionCMS()->config['_hide_configcheck_validate_referer'] !== '1') {
     if(isset($_SESSION['mgrPermissions']['settings']) && $_SESSION['mgrPermissions']['settings'] == '1') {
         if (EvolutionCMS()->getConfig('validate_referer') == '0') {
@@ -200,6 +209,11 @@ function checkSiteCache() {
             case $_lang['configcheck_errorpage_unavailable'] :
                 $warnings[$i][1] = $_lang['configcheck_errorpage_unavailable_msg'];
                 break;
+            case $_lang['configcheck_htaccess_rules'] :
+                $msg = $_lang['configcheck_htaccess_rules_msg'];
+                $msg .= '<br />' . sprintf($_lang["configcheck_hide_warning"], 'htaccess_rules');
+                $warnings[$i][1] = "<span id=\"htaccess_rules_warning_wrapper\">{$msg}</span>\n";
+                break;
             case $_lang['configcheck_validate_referer'] :
                 $msg = $_lang['configcheck_validate_referer_msg'];
                 $msg .= '<br />' . sprintf($_lang["configcheck_hide_warning"], 'validate_referer');

From beef5daa4b4476c19d043776c772c036d4e312e2 Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Thu, 5 Nov 2026 04:29:48 +0100
Subject: [PATCH 10/11] upd(docs): point the worker example at an image that
 has worker mode

The example ran 3.5.x, which has no worker implementation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/docker/WORKER.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/docker/WORKER.md b/.github/docker/WORKER.md
index 63122a474d..94eacd202f 100644
--- a/.github/docker/WORKER.md
+++ b/.github/docker/WORKER.md
@@ -7,7 +7,7 @@ image, opt in with:
 docker.exe run -d --name evo-worker -p 8080:80 \
   -e EVO_WORKER_MODE=1 \
   -e EVO_WORKER_ORIGIN=http://localhost:8080 \
-  ghcr.io/evolution-cms/evolution:3.5.x-php8.4-frankenphp
+  ghcr.io/evolution-cms/evolution:3.6.x-php8.4-frankenphp
 ```
 
 This command requires an image built with the worker implementation. The site

From acb475c8371758a4c706a8d3a128dacddebedf9a Mon Sep 17 00:00:00 2001
From: Artur Kyryliuk <mail@artur.work>
Date: Thu, 5 Nov 2026 04:34:08 +0100
Subject: [PATCH 11/11] upd(lang): translate the .htaccess warning and the form
 notice

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/lang/az/global.php     | 2 ++
 core/lang/be/global.php     | 2 ++
 core/lang/bg/global.php     | 2 ++
 core/lang/cs/global.php     | 2 ++
 core/lang/da/global.php     | 2 ++
 core/lang/de/global.php     | 2 ++
 core/lang/es/global.php     | 2 ++
 core/lang/et/global.php     | 2 ++
 core/lang/fa/global.php     | 2 ++
 core/lang/fi/global.php     | 2 ++
 core/lang/fr/global.php     | 2 ++
 core/lang/he/global.php     | 2 ++
 core/lang/hy/global.php     | 2 ++
 core/lang/it/global.php     | 2 ++
 core/lang/ja/global.php     | 2 ++
 core/lang/ka/global.php     | 2 ++
 core/lang/kk/global.php     | 2 ++
 core/lang/ky/global.php     | 2 ++
 core/lang/lt/global.php     | 2 ++
 core/lang/lv/global.php     | 2 ++
 core/lang/nl/global.php     | 2 ++
 core/lang/nn/global.php     | 2 ++
 core/lang/pl/global.php     | 2 ++
 core/lang/pt/global.php     | 2 ++
 core/lang/ro/global.php     | 2 ++
 core/lang/sk/global.php     | 2 ++
 core/lang/sv/global.php     | 2 ++
 core/lang/tg/global.php     | 2 ++
 core/lang/tk/global.php     | 2 ++
 core/lang/uk/global.php     | 2 ++
 core/lang/uz/global.php     | 2 ++
 core/lang/zh/global.php     | 2 ++
 install/src/lang/az.inc.php | 1 +
 install/src/lang/be.inc.php | 1 +
 install/src/lang/bg.inc.php | 1 +
 install/src/lang/cs.inc.php | 1 +
 install/src/lang/da.inc.php | 1 +
 install/src/lang/de.inc.php | 1 +
 install/src/lang/es.inc.php | 1 +
 install/src/lang/et.inc.php | 1 +
 install/src/lang/fa.inc.php | 1 +
 install/src/lang/fi.inc.php | 1 +
 install/src/lang/fr.inc.php | 1 +
 install/src/lang/he.inc.php | 1 +
 install/src/lang/hy.inc.php | 1 +
 install/src/lang/it.inc.php | 1 +
 install/src/lang/ja.inc.php | 1 +
 install/src/lang/ka.inc.php | 1 +
 install/src/lang/kk.inc.php | 1 +
 install/src/lang/ky.inc.php | 1 +
 install/src/lang/nl.inc.php | 1 +
 install/src/lang/nn.inc.php | 1 +
 install/src/lang/pl.inc.php | 1 +
 install/src/lang/pt.inc.php | 1 +
 install/src/lang/sk.inc.php | 1 +
 install/src/lang/sv.inc.php | 1 +
 install/src/lang/tg.inc.php | 1 +
 install/src/lang/tk.inc.php | 1 +
 install/src/lang/uk.inc.php | 1 +
 install/src/lang/zh.inc.php | 1 +
 60 files changed, 92 insertions(+)

diff --git a/core/lang/az/global.php b/core/lang/az/global.php
index 93f174219a..b578033e64 100644
--- a/core/lang/az/global.php
+++ b/core/lang/az/global.php
@@ -621,6 +621,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Bu o deməkdir ki, İcazəsiz səhifəniz adi istifadəçilər üçün əlçatan deyil və ya mövcud deyil. Bu, sonsuz dövriyyə probleminə və sayt jurnalında çoxlu xətalara səbəb ola bilər. Səhifəyə heç bir Vebistifadəçi Qrupu təyin edilmədiyinə əmin olun.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Sayt konfiqurasiya ayarlarında təyin olunmuş İcazəsiz səhifə dərc olunmayıb.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Bu o deməkdir ki, İcazəsiz səhifəniz ümumi istifadəçilər üçün əlçatan deyil. Səhifəni dərc edin və ya Alətlər &gt; Konfiqurasiya menyusunda mövcud bir resursa təyin olunduğuna əmin olun.';
+$_lang["configcheck_htaccess_rules"] = 'Təhlükəsizlik xəbərdarlığı: .htaccess köhnəlib';
+$_lang["configcheck_htaccess_rules_msg"] = 'Bu saytın <strong>.htaccess</strong> faylında cari buraxılışın təhlükəsizlik qaydaları çatışmır və yeniləmələr bu faylı heç vaxt dəyişmir. Şəxsi fayllar, ehtiyat nüsxələr və ya assets altındakı PHP faylları əlçatan ola bilər. Onu bu buraxılışın <strong>ht.access</strong> faylı ilə müqayisə edin və çatışmayan qaydaları əlavə edin.';
 $_lang["configcheck_validate_referer"] = 'Təhlükəsizlik xəbərdarlığı: HTTP Başlıq Doğrulaması';
 $_lang["configcheck_validate_referer_msg"] = 'Konfiqurasiya ayarı <strong>HTTP_REFERER başlıqlarını yoxlayın?</strong> Söndürülüb. Onu aktiv etməyi tövsiyə edirik. <a href="index.php?a=17">Konfiqurasiya seçimlərinə keçin</a>';
 $_lang["configcheck_warning"] = 'Konfiqurasiya xəbərdarlığı:';
diff --git a/core/lang/be/global.php b/core/lang/be/global.php
index 8c7479d8c4..c6860b1884 100644
--- a/core/lang/be/global.php
+++ b/core/lang/be/global.php
@@ -610,6 +610,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Гэта азначае, што ваша несанкцыянаваная старонка недаступная звычайным вэб-серферам або не існуе. Гэта можа прывесці да стану рэкурсіўнага цыклу і шматлікіх памылак у часопісах вашага сайта. Пераканайцеся, што да старонкі не прызначаныя групы вэб-карыстальнікаў.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Старонка «Несанкцыянаваная», вызначаная ў параметрах канфігурацыі сайта, не публікуецца.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Гэта азначае, што ваша несанкцыянаваная старонка недаступная для шырокай грамадскасці. Апублікуйце старонку або пераканайцеся, што яна прызначана існуючаму рэсурсу ў вашым дрэве сайта ў меню Інструменты > Канфігурацыя.';
+$_lang["configcheck_htaccess_rules"] = 'Папярэджанне бяспекі: файл .htaccess састарэў';
+$_lang["configcheck_htaccess_rules_msg"] = 'У файле <strong>.htaccess</strong> гэтага сайта няма правіл бяспекі бягучага выпуску, а абнаўленні ніколі не змяняюць гэты файл. Прыватныя файлы, рэзервовыя копіі або PHP-файлы ў assets могуць быць даступныя. Параўнайце яго з <strong>ht.access</strong> гэтага выпуску і дадайце правілы, якіх не хапае.';
 $_lang["configcheck_validate_referer"] = 'Папярэджанне бяспекі: праверка загалоўка HTTP';
 $_lang["configcheck_validate_referer_msg"] = 'Параметр канфігурацыі <strong>Праверыць загалоўкі HTTP_REFERER выключана?</strong> Мы рэкамендуем уключыць яго. <a href="index.php?a=17">Перайдзіце да параметраў канфігурацыі</a>';
 $_lang["configcheck_warning"] = 'Папярэджанне канфігурацыі:';
diff --git a/core/lang/bg/global.php b/core/lang/bg/global.php
index 4572913b1f..318597ae69 100644
--- a/core/lang/bg/global.php
+++ b/core/lang/bg/global.php
@@ -158,6 +158,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Това означава, че страницата с Неоторизиран достъп не е достъпна за нормалните уеб потребители или не съществува. Това може да доведе до състояние на зацикляне и много грешки в логовете на сайта. Уверете се, че няма никакви Групи на уеб потребители, прикачени към страницата.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Страницата с Неоторизиран достъп, указана в конфигурацията на Вашия сайт не е публикувана или не съществува.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Това означава, че страницата с грешката не е публично достъпна. Публикувайте страницата и се уверете, че тя е прикачена към съществуващ документ в дървото на сайта като отидете на Инструменти Tools &gt; в менюто Конфигурация.';
+$_lang["configcheck_htaccess_rules"] = 'Предупреждение за сигурността: .htaccess е остарял';
+$_lang["configcheck_htaccess_rules_msg"] = 'Във файла <strong>.htaccess</strong> на този сайт липсват правила за сигурност от текущата версия, а актуализациите никога не променят този файл. Лични файлове, архиви или PHP файлове в assets може да са достъпни. Сравнете го с <strong>ht.access</strong> от тази версия и добавете липсващите правила.';
 $_lang["configcheck_validate_referer"] = 'Security Warning: HTTP Header Validation';
 $_lang["configcheck_validate_referer_msg"] = 'The configuration setting <strong>Validate HTTP_REFERER headers?</strong> is Off. We recommend turning it On. <a href="index.php?a=17">Go to Configuration options</a>';
 $_lang["configcheck_warning"] = 'Грешки в конфигурацията:';
diff --git a/core/lang/cs/global.php b/core/lang/cs/global.php
index 0e6902d2da..6b0eda2a89 100644
--- a/core/lang/cs/global.php
+++ b/core/lang/cs/global.php
@@ -158,6 +158,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'To znamená, že Stránka o neautorizovaném přístupu není dostupná normálním internetovým uživatelům nebo neexistuje. To může vést k mnoha chybovým zápisům do logů. Ujistěte se zda žádná ze skupin návštěvníků nemá přístup k této stránce.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Stránka o neautorizovaném přístupu definovaná v nastavení webu není publikována.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'To znamená, že vaše Stránka o neautorizovaném přístupu je nedostupná širolé veřejnosti. Publikujte stránku nebo se přesvědčte, že stránka existuje a je umístěna ve stromu dokumentů v Nástrojích &gt; Konfigurační menu.';
+$_lang["configcheck_htaccess_rules"] = 'Bezpečnostní upozornění: .htaccess je zastaralý';
+$_lang["configcheck_htaccess_rules_msg"] = 'V souboru <strong>.htaccess</strong> tohoto webu chybí bezpečnostní pravidla aktuálního vydání a aktualizace tento soubor nikdy nemění. Soukromé soubory, zálohy nebo soubory PHP ve složce assets mohou být dostupné. Porovnejte jej se souborem <strong>ht.access</strong> tohoto vydání a doplňte chybějící pravidla.';
 $_lang["configcheck_validate_referer"] = 'Bezpečnostní upozornění: Validace HTTP hlaviček';
 $_lang["configcheck_validate_referer_msg"] = 'Nastavení <strong>Ověřit hlavičky HTTP_REFERER</strong> v konfiguraci systému je vypnuté. Doporučujeme jej zapnout. <a href="index.php?a=17">Přejít na konfiguraci systému</a><br /><a href="javascript:hideHeaderVerificationWarning();"><em>Nezobrazovat to znovu.</em></a>';
 $_lang["configcheck_warning"] = 'Výstraha konfigurace:';
diff --git a/core/lang/da/global.php b/core/lang/da/global.php
index 3880b2d142..6856677327 100644
--- a/core/lang/da/global.php
+++ b/core/lang/da/global.php
@@ -159,6 +159,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Det betyder, at den "ikke autoriseret" side ikke kan tilgås af almindelige besøgende eller ikke eksisterer. Det kan medføre, at systemet omstiller uden at stoppe, og vil samtidigt resultere i, at websitets logfiler til sidst vil fylde for meget. Kontroller også at der ikke er tildelt nogle web bruger grupper til siden.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Den "ikke autoriseret" side, som er defineret i konfigurationsindstillingerne er ikke publiceret.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Det betyder at den "ikke autoriseret" side ikke kan tilgås af normale besøgende. Publicer siden eller tildel den til en eksisterende ressource under Værktøjer &gt; Konfiguration.';
+$_lang["configcheck_htaccess_rules"] = 'Sikkerhedsadvarsel: .htaccess er forældet';
+$_lang["configcheck_htaccess_rules_msg"] = 'Filen <strong>.htaccess</strong> på dette websted mangler sikkerhedsregler fra den aktuelle version, og opdateringer ændrer aldrig denne fil. Private filer, backups eller PHP-filer under assets kan være tilgængelige. Sammenlign den med <strong>ht.access</strong> fra denne version, og tilføj de manglende regler.';
 $_lang["configcheck_validate_referer"] = 'Sikkerhedsadvarsel: HTTP Header validering';
 $_lang["configcheck_validate_referer_msg"] = 'Konfigurationsindstillingen for <strong>Valider HTTP_REFERER headers?</strong> er slået fra. Det anbefales at slå den til. <a href="index.php?a=17">Gå til konfigurationsindstillingerne</a>';
 $_lang["configcheck_warning"] = 'Konfigurationsadvarsel:';
diff --git a/core/lang/de/global.php b/core/lang/de/global.php
index 1679972ccd..16352f0921 100644
--- a/core/lang/de/global.php
+++ b/core/lang/de/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Die Seite für unautorisierte Zugriffe ist für normale Besucher nicht abrufbar oder existiert nicht. Dies kann zu einer Endlosschleife und vielen Fehlermeldungen in Ihren Webserver-Statistiken führen. Stellen Sie sicher, dass der Seite keine Benutzergruppen zugeordnet sind.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Die Seite für unautorisierte Zugriffe aus den Einstellungen Ihrer Konfiguration ist nicht veröffentlicht.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Die Seite unautorisierte Zugriffe ist der Allgemeinheit nicht zugänglich. Veröffentlichen Sie die Seite oder stellen Sie sicher, dass in der Konfiguration eine vorhandene Seite aus dem Ressourcen-Baum ausgewählt ist.';
+$_lang["configcheck_htaccess_rules"] = 'Sicherheitshinweis: .htaccess ist veraltet';
+$_lang["configcheck_htaccess_rules_msg"] = 'In der Datei <strong>.htaccess</strong> dieser Website fehlen Sicherheitsregeln der aktuellen Version, und Updates ändern diese Datei nie. Private Dateien, Backups oder PHP-Dateien unter assets könnten erreichbar sein. Vergleichen Sie sie mit <strong>ht.access</strong> dieser Version und ergänzen Sie die fehlenden Regeln.';
 $_lang["configcheck_validate_referer"] = 'Sicherheitshinweis: HTTP Header Validierung';
 $_lang["configcheck_validate_referer_msg"] = 'Die Konfigurationseinstellung <strong>HTTP_REFERER Header validieren?</strong> ist AUSGESCHALTET. Wir empfehlen, diese anzuschalten. <a href="index.php?a=17">Zu den Einstellungen</a>';
 $_lang["configcheck_warning"] = 'Konfigurationswarnung:';
diff --git a/core/lang/es/global.php b/core/lang/es/global.php
index 0149eea5a6..986cb7d1a5 100644
--- a/core/lang/es/global.php
+++ b/core/lang/es/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Esto significa que tu página de acceso no autorizado no es accesible para navegantes normales de internet o que no existe.  Esto puede provocar un estado de círculo cerrado y varios errores en la bitácora de tu sitio.  Asegúrate de que no haya grupos de usuarios web asignados a la página.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'La página de acceso no autorizado definida en la configuración del sitio no está publicada.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Esto significa que tu página de acceso no autorizado no es accesible para el público en general. Publica la página o asegúrate de que esté asignada a un documento existente en el árbol de tu sitio en en menu Herramientas &gt; Configuración.';
+$_lang["configcheck_htaccess_rules"] = 'Advertencia de seguridad: .htaccess está desactualizado';
+$_lang["configcheck_htaccess_rules_msg"] = 'Al archivo <strong>.htaccess</strong> de este sitio le faltan reglas de seguridad de la versión actual, y las actualizaciones nunca modifican este archivo. Los archivos privados, los respaldos o los archivos PHP dentro de assets podrían ser accesibles. Compáralo con <strong>ht.access</strong> de esta versión y añade las reglas que faltan.';
 $_lang["configcheck_validate_referer"] = 'Security Warning: HTTP Header Validation';
 $_lang["configcheck_validate_referer_msg"] = 'The configuration setting <strong>Validate HTTP_REFERER headers?</strong> is Off. We recommend turning it On. <a href="index.php?a=17">Go to Configuration options</a>';
 $_lang["configcheck_warning"] = 'Advertencia de configuración:';
diff --git a/core/lang/et/global.php b/core/lang/et/global.php
index 53aeaf0953..f94425e2a2 100644
--- a/core/lang/et/global.php
+++ b/core/lang/et/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'See tähendab, et juurdepääsu keelamise leht ei ole tavalistele veebikülastajatele kättesaadav või seda pole olemas. See võib põhjustada lõputu tsükli ja palju vigu saidi logides. Veendu, et lehele pole määratud veebikasutajate rühmi.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Saidi seadistuses määratud juurdepääsu keelamise leht ei ole avaldatud.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'See tähendab, et juurdepääsu keelamise leht ei ole avalikkusele kättesaadav. Avalda leht või veendu menüüs Tööriistad &gt; Seadistus, et sellele on määratud saidipuus olemasolev ressurss.';
+$_lang["configcheck_htaccess_rules"] = 'Turvahoiatus: .htaccess on aegunud';
+$_lang["configcheck_htaccess_rules_msg"] = 'Selle saidi failist <strong>.htaccess</strong> puuduvad praeguse väljalaske turvareeglid ja uuendused seda faili kunagi ei muuda. Privaatsed failid, varukoopiad või PHP-failid kaustas assets võivad olla ligipääsetavad. Võrrelge seda selle väljalaske failiga <strong>ht.access</strong> ja lisage puuduvad reeglid.';
 $_lang["configcheck_validate_referer"] = 'Turvahoiatus: HTTP-päise kontroll';
 $_lang["configcheck_validate_referer_msg"] = 'Seadistus <strong>Kas kontrollida HTTP_REFERER päiseid?</strong> on välja lülitatud. Soovitame selle sisse lülitada. <a href="index.php?a=17">Ava seadistusvalikud</a>';
 $_lang["configcheck_warning"] = 'Seadistuse hoiatus: ';
diff --git a/core/lang/fa/global.php b/core/lang/fa/global.php
index 332144dcbf..ee203983a9 100644
--- a/core/lang/fa/global.php
+++ b/core/lang/fa/global.php
@@ -159,6 +159,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'ایند به این معناست که صفحه ی خارج از دسترس شما قابل دسترسی برای بازدیدکنندگان عادی نمی باشد و یا و جود ندارد. این امکان دارد باعث ایجاد خطالهای پی در پی در وبگاه شود. از این موضوع اطمینان حاصل کنید که هیچ گروه از کاربر وب برای این صفحه تعیین نشده باشد.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'صفحه ی خارج از دسترس تعیین شده در تنظیمات مربوط به وبگاه همچنان منتشر نشده است.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'این بدان معناست که صفحه ی خارج از دسترسی قابل دسترس عمومی نمی باشد. صفحه را منتشر کنید و یا مطمئن شوید که چنین صفحه منتهی به پرونده ای می شود که در درختی وبگاه در قسمت فهرست یا منوی ابزار و تنظیمات وجود دارد.';
+$_lang["configcheck_htaccess_rules"] = 'هشدار امنیتی: .htaccess قدیمی است';
+$_lang["configcheck_htaccess_rules_msg"] = 'فایل <strong>.htaccess</strong> این وبگاه قوانین امنیتی نسخه فعلی را ندارد و به‌روزرسانی‌ها هرگز این فایل را تغییر نمی‌دهند. فایل‌های خصوصی، نسخه‌های پشتیبان یا فایل‌های PHP در assets ممکن است در دسترس باشند. آن را با <strong>ht.access</strong> این نسخه مقایسه کنید و قوانین جاافتاده را اضافه کنید.';
 $_lang["configcheck_validate_referer"] = 'Security Warning: HTTP Header Validation';
 $_lang["configcheck_validate_referer_msg"] = 'The configuration setting <strong>Validate HTTP_REFERER headers?</strong> is Off. We recommend turning it On. <a href="index.php?a=17">Go to Configuration options</a>';
 $_lang["configcheck_warning"] = 'خطای تنظیمات:';
diff --git a/core/lang/fi/global.php b/core/lang/fi/global.php
index 53155a561c..3eb88300a9 100644
--- a/core/lang/fi/global.php
+++ b/core/lang/fi/global.php
@@ -158,6 +158,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = '"Pääsy kielletty" -sivulle ei joko päästä tai sitä ei ole olemassa. Tämä voi johtaa ongelmiin sivustollasi. Varmista, ettei sivulle ole määritetty web-käyttäjäryhmää.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = '"Pääsy kielletty" -sivua ei ole julkaistu.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = '"Pääsy kielletty" -sivu ei ole julkinen. Varmista, että sivu on julkaistu ja sivun ID-tunnus on oikein.';
+$_lang["configcheck_htaccess_rules"] = 'Tietoturvavaroitus: .htaccess on vanhentunut';
+$_lang["configcheck_htaccess_rules_msg"] = 'Tämän sivuston <strong>.htaccess</strong>-tiedostosta puuttuu nykyisen julkaisun tietoturvasääntöjä, eivätkä päivitykset koskaan muuta tätä tiedostoa. Yksityiset tiedostot, varmuuskopiot tai assets-kansion PHP-tiedostot voivat olla saavutettavissa. Vertaa sitä tämän julkaisun <strong>ht.access</strong>-tiedostoon ja lisää puuttuvat säännöt.';
 $_lang["configcheck_validate_referer"] = 'Tietoturvavaroitus: HTTP Header Validation';
 $_lang["configcheck_validate_referer_msg"] = 'Järjestelmän asetus <strong>Tarkasta HTTP_REFERER tunnisteet?</strong> on poissa päältä. On suositeltavaa ottaa asetus käyttöön. <a href="index.php?a=17">Järjestelmän asetukset</a><br /><a href="javascript:hideHeaderVerificationWarning();"><em>Älä näytä tätä ilmoitusta uudelleen.</em></a>';
 $_lang["configcheck_warning"] = 'Varoitus:';
diff --git a/core/lang/fr/global.php b/core/lang/fr/global.php
index 44c31fa32f..cf8ac7ba23 100644
--- a/core/lang/fr/global.php
+++ b/core/lang/fr/global.php
@@ -161,6 +161,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Cela signifie que la page "Accès non autorisé" n\'est pas accessible à vos visiteurs ou n\'existe pas. Cela peut provoquer une boucle infinie, générer des erreurs dans vos logs. Assurez-vous qu\'aucun Groupe d\'Utilisateurs Web n\'est associé à cette page.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'La page "Accès non autorisé" définie dans la configuration du site n\'est pas publiée.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Cela signifie que la page "Accès non autorisé" n\'est pas accessible au public. Publiez cette page ou assurez-vous qu\'elle est associée à une Ressource existante dans votre Arbre de Site dans le menu Outils &gt; Configuration.';
+$_lang["configcheck_htaccess_rules"] = 'Avertissement de sécurité: .htaccess est obsolète';
+$_lang["configcheck_htaccess_rules_msg"] = 'Le fichier <strong>.htaccess</strong> de ce site ne contient pas certaines règles de sécurité de la version actuelle, et les mises à jour ne modifient jamais ce fichier. Des fichiers privés, des sauvegardes ou des fichiers PHP situés dans assets peuvent être accessibles. Comparez-le avec le fichier <strong>ht.access</strong> de cette version et ajoutez les règles manquantes.';
 $_lang["configcheck_validate_referer"] = 'Avertissement de sécurité: validation des en-têtes HTTP';
 $_lang["configcheck_validate_referer_msg"] = 'Le paramètre de configuration <strong>Valider les en-têtes HTTP_REFERER?</strong> est désactivé. Nous vous recommandons de l\'activer. <a href="index.php?a=17">Aller aux options de configuration</a><br /><a href="javascript:hideHeaderVerificationWarning();"><em>Ne plus afficher ce message.</em></a>';
 $_lang["configcheck_warning"] = 'Avertissement de configuration:';
diff --git a/core/lang/he/global.php b/core/lang/he/global.php
index b5a23d75c9..ef4d010f12 100644
--- a/core/lang/he/global.php
+++ b/core/lang/he/global.php
@@ -159,6 +159,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'This means that your Unauthorized page is not accessible to normal web surfers or does not exist. This can lead to a recursive looping condition and many errors in your site logs. Make sure there are no webuser groups assigned to the page.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'The Unauthorized page defined in the site configuration settings is not published.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'This means that your Unauthorized page is inaccessible to the general public. Publish the page or make sure it is assigned to an existing document in your site tree in the Tools &gt; Configuration menu.';
+$_lang["configcheck_htaccess_rules"] = 'אזהרת אבטחה: .htaccess אינו מעודכן';
+$_lang["configcheck_htaccess_rules_msg"] = 'בקובץ <strong>.htaccess</strong> של אתר זה חסרים כללי אבטחה של הגרסה הנוכחית, ועדכונים לעולם אינם משנים קובץ זה. קבצים פרטיים, גיבויים או קובצי PHP תחת assets עלולים להיות נגישים. יש להשוות אותו אל <strong>ht.access</strong> של גרסה זו ולהוסיף את הכללים החסרים.';
 $_lang["configcheck_validate_referer"] = 'Security Warning: HTTP Header Validation';
 $_lang["configcheck_validate_referer_msg"] = 'The configuration setting <strong>Validate HTTP_REFERER headers?</strong> is Off. We recommend turning it On. <a href="index.php?a=17">Go to Configuration options</a>';
 $_lang["configcheck_warning"] = 'Configuration warning:';
diff --git a/core/lang/hy/global.php b/core/lang/hy/global.php
index 8f1fb9f7f8..5bb4a3ae97 100644
--- a/core/lang/hy/global.php
+++ b/core/lang/hy/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Սա նշանակում է, որ չարտոնված մուտքի էջը հասանելի չէ սովորական այցելուներին կամ գոյություն չունի։ Դա կարող է առաջացնել անվերջ կրկնվող ցիկլ և բազմաթիվ սխալներ կայքի մատյաններում։ Համոզվեք, որ էջին վեբ օգտատերերի խմբեր կցված չեն։';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Կայքի կազմաձևման կարգավորումներում սահմանված չարտոնված մուտքի էջը հրապարակված չէ։';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Սա նշանակում է, որ չարտոնված մուտքի էջը հանրությանը հասանելի չէ։ Հրապարակեք էջը կամ Գործիքներ &gt; Կազմաձևում ընտրացանկում համոզվեք, որ այն նշանակված է կայքի ծառում գոյություն ունեցող ռեսուրսի։';
+$_lang["configcheck_htaccess_rules"] = 'Անվտանգության նախազգուշացում․ .htaccess-ը հնացած է';
+$_lang["configcheck_htaccess_rules_msg"] = 'Այս կայքի <strong>.htaccess</strong> ֆայլում բացակայում են ընթացիկ թողարկման անվտանգության կանոնները, իսկ թարմացումները երբեք չեն փոխում այս ֆայլը։ Անձնական ֆայլերը, պահուստային պատճենները կամ assets-ի PHP ֆայլերը կարող են հասանելի լինել։ Համեմատեք այն այս թողարկման <strong>ht.access</strong> ֆայլի հետ և ավելացրեք բացակայող կանոնները։';
 $_lang["configcheck_validate_referer"] = 'Անվտանգության նախազգուշացում․ HTTP վերնագրի վավերացում';
 $_lang["configcheck_validate_referer_msg"] = '<strong>Վավերացնե՞լ HTTP_REFERER վերնագրերը</strong> կարգավորումն անջատված է։ Խորհուրդ ենք տալիս միացնել այն։ <a href="index.php?a=17">Անցնել կազմաձևման կարգավորումներին</a>';
 $_lang["configcheck_warning"] = 'Կազմաձևման նախազգուշացում․ ';
diff --git a/core/lang/it/global.php b/core/lang/it/global.php
index c12a8cf392..a01fdf454e 100644
--- a/core/lang/it/global.php
+++ b/core/lang/it/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Ciò significa che la pagina di Non Autorizzato non esiste o non è accessibile da parte dei normali visitatori web. Questo fatto generare un loop ricorsivo e scrivere numerosi errori nel log del vostro sito. Verificate che non ci siano Gruppi di Utenti Web assegnati a questa pagina.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'La pagina Non Autorizzato del vostro sito non è stata pubblicata.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Ciò significa che la pagina di Non Autorizzato non è accessibile ai visitatori. Pubblicate la pagina o selezionate una Risorsa esistente nella struttura ad albero del vostro sito dal menu Strumenti -> Configurazione.';
+$_lang["configcheck_htaccess_rules"] = 'Avviso di Sicurezza: .htaccess non è aggiornato';
+$_lang["configcheck_htaccess_rules_msg"] = 'Nel file <strong>.htaccess</strong> di questo sito mancano regole di sicurezza della versione corrente e gli aggiornamenti non modificano mai questo file. File privati, backup o file PHP in assets potrebbero essere raggiungibili. Confrontalo con <strong>ht.access</strong> di questa versione e aggiungi le regole mancanti.';
 $_lang["configcheck_validate_referer"] = 'Avviso di Sicurezza: Validazione headers HTTP';
 $_lang["configcheck_validate_referer_msg"] = 'L\'opzione di <strong>Validazione degli headers HTTP_REFERER?</strong> non è attivata. Raccomandiamo di attivarla. <a href="index.php?a=17">Vai alle Opzioni di Configurazione</a>';
 $_lang["configcheck_warning"] = 'Avviso di configurazione:';
diff --git a/core/lang/ja/global.php b/core/lang/ja/global.php
index 8d4633ab14..4e07801ae1 100644
--- a/core/lang/ja/global.php
+++ b/core/lang/ja/global.php
@@ -170,6 +170,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = '設定した「権限外告知のページ」が一般的なエンドユーザーからアクセスできないページ（private）かあるいは存在しないことを意味しています。システムがループ状態に陥り、多数のエラーをエラーログに蓄積します。権限フリーの公開ページを「権限外告知のページ」に指定してください。';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'グローバル設定で設定された権限外告知のページは公開されていません。';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = '設定した権限外告知のページが誰でも見られるようにはなっていないことを意味します。権限外告知ページは全ての人「Public」に公開するようにしてください。';
+$_lang["configcheck_htaccess_rules"] = 'セキュリティ警告: .htaccess が古くなっています';
+$_lang["configcheck_htaccess_rules_msg"] = 'このサイトの <strong>.htaccess</strong> には現在のリリースのセキュリティルールが不足しており、アップデートではこのファイルは変更されません。非公開ファイル、バックアップ、または assets 配下の PHP ファイルにアクセスできる可能性があります。このリリースの <strong>ht.access</strong> と比較し、不足しているルールを追加してください。';
 $_lang["configcheck_validate_referer"] = 'セキュリティ警告: 参照元チェックの設定';
 $_lang["configcheck_validate_referer_msg"] = '<a href="index.php?a=17">グローバル設定</a>の<strong>「管理画面のリファラチェック」</strong>がオフになっています。セキュリティ強化のためオンにすることをおすすめします。<br /><a href="javascript:hideHeaderVerificationWarning();"><em>今後この警告を表示しない</em></a>';
 $_lang["configcheck_warning"] = '警告';
diff --git a/core/lang/ka/global.php b/core/lang/ka/global.php
index bcaa432175..f3fab9c0fa 100644
--- a/core/lang/ka/global.php
+++ b/core/lang/ka/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'ეს ნიშნავს, რომ წვდომის აკრძალვის გვერდი ჩვეულებრივი ვიზიტორებისთვის მიუწვდომელია ან არ არსებობს. ამან შეიძლება გამოიწვიოს განმეორებადი ციკლი და მრავალი შეცდომა საიტის ჟურნალებში. დარწმუნდით, რომ გვერდს ვებმომხმარებელთა ჯგუფები არ აქვს მინიჭებული.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'საიტის კონფიგურაციაში მითითებული წვდომის აკრძალვის გვერდი გამოუქვეყნებელია.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'ეს ნიშნავს, რომ წვდომის აკრძალვის გვერდი ყველასთვის მიუწვდომელია. გამოაქვეყნეთ გვერდი ან მენიუში ხელსაწყოები &gt; კონფიგურაცია დარწმუნდით, რომ მას საიტის ხეში არსებული რესურსი აქვს მინიჭებული.';
+$_lang["configcheck_htaccess_rules"] = 'უსაფრთხოების გაფრთხილება: .htaccess მოძველებულია';
+$_lang["configcheck_htaccess_rules_msg"] = 'ამ საიტის <strong>.htaccess</strong> ფაილს აკლია მიმდინარე გამოშვების უსაფრთხოების წესები, განახლებები კი ამ ფაილს არასდროს ცვლის. პირადი ფაილები, სარეზერვო ასლები ან assets-ში არსებული PHP ფაილები შესაძლოა ხელმისაწვდომი იყოს. შეადარეთ იგი ამ გამოშვების <strong>ht.access</strong> ფაილს და დაამატეთ გამოტოვებული წესები.';
 $_lang["configcheck_validate_referer"] = 'უსაფრთხოების გაფრთხილება: HTTP სათაურების შემოწმება';
 $_lang["configcheck_validate_referer_msg"] = 'კონფიგურაციის პარამეტრი <strong>შემოწმდეს HTTP_REFERER სათაურები?</strong> გამორთულია. გირჩევთ, ჩართოთ. <a href="index.php?a=17">კონფიგურაციის პარამეტრებზე გადასვლა</a>';
 $_lang["configcheck_warning"] = 'კონფიგურაციის გაფრთხილება: ';
diff --git a/core/lang/kk/global.php b/core/lang/kk/global.php
index f49e93b680..0682db8411 100644
--- a/core/lang/kk/global.php
+++ b/core/lang/kk/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Рұқсатсыз қатынау беті қарапайым келушілерге қолжетімсіз немесе жоқ. Бұл қайталанатын циклге және журналда көптеген қателерге әкелуі мүмкін. Бетке веб-пайдаланушы топтары тағайындалмағанын тексеріңіз.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Сайт баптауларындағы рұқсатсыз қатынау беті жарияланбаған.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Рұқсатсыз қатынау беті жалпыға қолжетімсіз. Бетті жариялаңыз немесе Құралдар &gt; Баптаулар мәзірінде оның сайт ағашындағы бар ресурсқа тағайындалғанын тексеріңіз.';
+$_lang["configcheck_htaccess_rules"] = 'Қауіпсіздік ескертуі: .htaccess ескірген';
+$_lang["configcheck_htaccess_rules_msg"] = 'Осы сайттың <strong>.htaccess</strong> файлында ағымдағы шығарылымның қауіпсіздік ережелері жетіспейді, ал жаңартулар бұл файлды ешқашан өзгертпейді. Жеке файлдар, сақтық көшірмелер немесе assets ішіндегі PHP файлдары қолжетімді болуы мүмкін. Оны осы шығарылымның <strong>ht.access</strong> файлымен салыстырып, жетіспейтін ережелерді қосыңыз.';
 $_lang["configcheck_validate_referer"] = 'Қауіпсіздік ескертуі: HTTP тақырыптарын тексеру';
 $_lang["configcheck_validate_referer_msg"] = '<strong>HTTP_REFERER тақырыптарын тексеру керек пе?</strong> баптауы өшірілген. Оны қосуды ұсынамыз. <a href="index.php?a=17">Баптауларға өту</a>';
 $_lang["configcheck_warning"] = 'Баптау ескертуі: ';
diff --git a/core/lang/ky/global.php b/core/lang/ky/global.php
index e9df6d7080..0e464b791a 100644
--- a/core/lang/ky/global.php
+++ b/core/lang/ky/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Кирүүгө тыюу салуу барагы кадимки конокторго жеткиликсиз же жок. Бул чексиз багыттоого жана журналда көптөгөн каталарга алып келиши мүмкүн. Баракка веб-колдонуучу топтору дайындалбаганын текшериңиз.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Сайттын жөндөөлөрүндөгү кирүүгө тыюу салуу барагы жарыяланган эмес.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Бул барак жалпыга жеткиликсиз. Аны жарыялаңыз же Куралдар &gt; Жөндөөлөр менюсунда сайт дарагындагы ресурс туура дайындалганын текшериңиз.';
+$_lang["configcheck_htaccess_rules"] = 'Коопсуздук эскертүүсү: .htaccess эскирген';
+$_lang["configcheck_htaccess_rules_msg"] = 'Бул сайттын <strong>.htaccess</strong> файлында учурдагы чыгарылыштын коопсуздук эрежелери жетишпейт, ал эми жаңыртуулар бул файлды эч качан өзгөртпөйт. Жеке файлдар, камдык көчүрмөлөр же assets ичиндеги PHP файлдары жеткиликтүү болушу мүмкүн. Аны ушул чыгарылыштын <strong>ht.access</strong> файлы менен салыштырып, жетишпеген эрежелерди кошуңуз.';
 $_lang["configcheck_validate_referer"] = 'Коопсуздук эскертүүсү: HTTP баштарын текшерүү';
 $_lang["configcheck_validate_referer_msg"] = '<strong>HTTP_REFERER баштарын текшерүүбү?</strong> жөндөөсү өчүрүлгөн. Аны иштетүүнү сунуштайбыз. <a href="index.php?a=17">Жөндөөлөргө өтүү</a>';
 $_lang["configcheck_warning"] = 'Жөндөөлөр боюнча эскертүү: ';
diff --git a/core/lang/lt/global.php b/core/lang/lt/global.php
index e130719a5a..0b43124765 100644
--- a/core/lang/lt/global.php
+++ b/core/lang/lt/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Tai reiškia, kad neleistinos prieigos puslapis nepasiekiamas įprastiems lankytojams arba jo nėra. Dėl to gali susidaryti rekursinė kilpa ir svetainės žurnaluose atsirasti daug klaidų. Įsitikinkite, kad puslapiui nepriskirta jokių žiniatinklio naudotojų grupių.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Svetainės konfigūracijoje nustatytas neleistinos prieigos puslapis nepaskelbtas.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Tai reiškia, kad neleistinos prieigos puslapis nepasiekiamas visiems lankytojams. Paskelbkite puslapį arba meniu Įrankiai &gt; Konfigūracija įsitikinkite, kad jam priskirtas esamas išteklius svetainės medyje.';
+$_lang["configcheck_htaccess_rules"] = 'Saugumo įspėjimas: .htaccess yra pasenęs';
+$_lang["configcheck_htaccess_rules_msg"] = 'Šios svetainės <strong>.htaccess</strong> faile trūksta dabartinės laidos saugumo taisyklių, o atnaujinimai šio failo niekada nekeičia. Privatūs failai, atsarginės kopijos arba PHP failai kataloge assets gali būti pasiekiami. Palyginkite jį su šios laidos failu <strong>ht.access</strong> ir pridėkite trūkstamas taisykles.';
 $_lang["configcheck_validate_referer"] = 'Saugumo įspėjimas: HTTP antraščių tikrinimas';
 $_lang["configcheck_validate_referer_msg"] = 'Konfigūracijos nuostata <strong>Tikrinti HTTP_REFERER antraštes?</strong> išjungta. Rekomenduojame ją įjungti. <a href="index.php?a=17">Atverti konfigūracijos parinktis</a>';
 $_lang["configcheck_warning"] = 'Konfigūracijos įspėjimas: ';
diff --git a/core/lang/lv/global.php b/core/lang/lv/global.php
index 6c302c6392..2e3657c64f 100644
--- a/core/lang/lv/global.php
+++ b/core/lang/lv/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Tas nozīmē, ka nesankcionētas piekļuves lapa nav pieejama parastajiem apmeklētājiem vai nepastāv. Tas var izraisīt rekursīvu ciklu un daudz kļūdu vietnes žurnālos. Pārliecinieties, ka lapai nav piešķirtas tīmekļa lietotāju grupas.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Vietnes konfigurācijā norādītā nesankcionētas piekļuves lapa nav publicēta.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Tas nozīmē, ka nesankcionētas piekļuves lapa nav publiski pieejama. Publicējiet lapu vai izvēlnē Rīki &gt; Konfigurācija pārliecinieties, ka tai ir piešķirts esošs resurss vietnes kokā.';
+$_lang["configcheck_htaccess_rules"] = 'Drošības brīdinājums: .htaccess ir novecojis';
+$_lang["configcheck_htaccess_rules_msg"] = 'Šīs vietnes failā <strong>.htaccess</strong> trūkst pašreizējā laidiena drošības noteikumu, un atjauninājumi šo failu nekad nemaina. Privāti faili, rezerves kopijas vai PHP faili mapē assets var būt pieejami. Salīdziniet to ar šī laidiena failu <strong>ht.access</strong> un pievienojiet trūkstošos noteikumus.';
 $_lang["configcheck_validate_referer"] = 'Drošības brīdinājums: HTTP galveņu pārbaude';
 $_lang["configcheck_validate_referer_msg"] = 'Konfigurācijas iestatījums <strong>Pārbaudīt HTTP_REFERER galvenes?</strong> ir izslēgts. Iesakām to ieslēgt. <a href="index.php?a=17">Atvērt konfigurācijas opcijas</a>';
 $_lang["configcheck_warning"] = 'Konfigurācijas brīdinājums: ';
diff --git a/core/lang/nl/global.php b/core/lang/nl/global.php
index 2d1bb30bfb..df39b9c683 100644
--- a/core/lang/nl/global.php
+++ b/core/lang/nl/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Dit houdt in dat uw \'Niet Gemachtigd\'-pagina niet toegankelijk is voor normale Webgebruikers of niet bestaat. Dit kan leiden tot een oneindige lus en veel foutmeldingen in uw logbestand. Zorg ervoor dat de Pagina niet aan een Webgebruikersgroep is toegewezen.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'De \'Niet Gemachtigd\'-pagina die in de configuratie instellingen is aangegeven is niet gepubliceerd.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Dit houdt in dat uw \'Niet Gemachtigd\'-pagina niet toegankelijk is voor bezoekers. Publiceer de Pagina of zorg ervoor dat het is toegewezen aan een bestaande Pagina in de inhoudsopgave van uw website met het Beheer &gt; Configuratie menu.';
+$_lang["configcheck_htaccess_rules"] = 'Beveiliging Waarschuwing: .htaccess is verouderd';
+$_lang["configcheck_htaccess_rules_msg"] = 'Het bestand <strong>.htaccess</strong> van deze site mist beveiligingsregels van de huidige release, en updates wijzigen dit bestand nooit. Privébestanden, backups of PHP-bestanden onder assets kunnen bereikbaar zijn. Vergelijk het met <strong>ht.access</strong> van deze release en voeg de ontbrekende regels toe.';
 $_lang["configcheck_validate_referer"] = 'Beveiliging Waarschuwing: HTTP Header Validatie';
 $_lang["configcheck_validate_referer_msg"] = 'De configuratie instelling <strong>Validate HTTP_REFERER headers?</strong> staat UIT. We raden aan deze AAN te zetten. <a href="index.php?a=17">Ga naar de Configuratie opties</a>';
 $_lang["configcheck_warning"] = 'Configuratie waarschuwing:';
diff --git a/core/lang/nn/global.php b/core/lang/nn/global.php
index 9c90df848f..e88ca83cf5 100644
--- a/core/lang/nn/global.php
+++ b/core/lang/nn/global.php
@@ -158,6 +158,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'This means that your Unauthorized page is not accessible to normal web surfers or does not exist. This can lead to a recursive looping condition and many errors in your site logs. Make sure there are no Webuser Groups assigned to the page.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'The Unauthorized page defined in the site configuration settings is not published.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'This means that your Unauthorized page is inaccessible to the general public. Publish the page or make sure it is assigned to an existing Resource in your Site Tree in the Tools &gt; Configuration menu.';
+$_lang["configcheck_htaccess_rules"] = 'Sikkerhetsadvarsel: .htaccess er utdatert';
+$_lang["configcheck_htaccess_rules_msg"] = 'Filen <strong>.htaccess</strong> på denne webplassen mangler sikkerhetsregler fra gjeldende versjon, og oppdateringer endrer aldri denne filen. Private filer, sikkerhetskopier eller PHP-filer under assets kan være tilgjengelige. Sammenlign den med <strong>ht.access</strong> fra denne versjonen og legg til reglene som mangler.';
 $_lang["configcheck_validate_referer"] = 'Security Warning: HTTP Header Validation';
 $_lang["configcheck_validate_referer_msg"] = 'The configuration setting <strong>Validate HTTP_REFERER headers?</strong> is Off. We recommend turning it On. <a href="index.php?a=17">Go to Configuration options</a>';
 $_lang["configcheck_warning"] = 'Konfigurasjonsadvarsel:';
diff --git a/core/lang/pl/global.php b/core/lang/pl/global.php
index 68dea2b54e..66b36f8c69 100644
--- a/core/lang/pl/global.php
+++ b/core/lang/pl/global.php
@@ -167,6 +167,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Oznacza to, że Strona Braku Autoryzacji jest niedostępna dla odwiedzających.  Może to powodować niestabilność i wiele błędnych wpisów w logach serwisu. Upewnij się, że żadna grupa użytkowników nie jest przypisana do strony.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Strona Braku Konfiguracji zdefiniowana w ustawieniach jest nieopublikowana.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Oznacza to, że Strona Braku Autoryzacji serwisu jest niedostępna dla odwiedzających. Opublikuj tą stronę albo upewnij się, że jest ona przypisana do istniejącego dokumentu w drzewie zawartości Twojej strony.';
+$_lang["configcheck_htaccess_rules"] = 'Ostrzeżenie odnośnie bezpieczeństwa: plik .htaccess jest nieaktualny';
+$_lang["configcheck_htaccess_rules_msg"] = 'W pliku <strong>.htaccess</strong> tej strony brakuje reguł bezpieczeństwa bieżącego wydania, a aktualizacje nigdy nie zmieniają tego pliku. Prywatne pliki, kopie zapasowe lub pliki PHP w assets mogą być dostępne. Porównaj go z plikiem <strong>ht.access</strong> z tego wydania i dodaj brakujące reguły.';
 $_lang["configcheck_validate_referer"] = 'Ostrzeżenie odnośnie bezpieczeństwa: Weryfikacja nagłówków HTTP_REFERER';
 $_lang["configcheck_validate_referer_msg"] = 'Ustawienie konfiguracyjne <strong>Weryfikuj nagłówki HTTP_REFERER</strong> jest wyłączone. Zalecamy aby było ono włączone. <a href="index.php?a=17">Przejdź do konfiguracji systemu</a><br /><a href="javascript:hideHeaderVerificationWarning();"><em>Nie pokazuj tego komunikatu ponownie./em></a>';
 $_lang["configcheck_warning"] = 'Ostrzeżenia konfiguracji:';
diff --git a/core/lang/pt/global.php b/core/lang/pt/global.php
index e35d96cef2..05103053bd 100644
--- a/core/lang/pt/global.php
+++ b/core/lang/pt/global.php
@@ -158,6 +158,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Isto significa que a Página de \'acesso não autorizado\' não está disponível a utilizadores normais da web ou não existe. Isto pode conduzir a um ciclo recursivo e a muitos erros nos registos do site. Certifique-se de que não existem grupos de webusers alocados a essa página.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'A página de \'acesso não autorizado\' do seu site não está publicada.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Isto significa que a sua página de \'acesso não autorizado\' não está acessível para o público geral. Publique a página ou certifique-se de que esta está afectada a um documento existente na árvore de documentos no menu <b>Ferramentas &gt; Configuração</b>.';
+$_lang["configcheck_htaccess_rules"] = 'Aviso de segurança: .htaccess está desactualizado';
+$_lang["configcheck_htaccess_rules_msg"] = 'O ficheiro <strong>.htaccess</strong> deste site não tem regras de segurança da versão actual, e as actualizações nunca alteram este ficheiro. Ficheiros privados, cópias de segurança ou ficheiros PHP em assets podem estar acessíveis. Compare-o com <strong>ht.access</strong> desta versão e adicione as regras em falta.';
 $_lang["configcheck_validate_referer"] = 'Security Warning: HTTP Header Validation';
 $_lang["configcheck_validate_referer_msg"] = 'The configuration setting <strong>Validate HTTP_REFERER headers?</strong> is Off. We recommend turning it On. <a href="index.php?a=17">Go to Configuration options</a>';
 $_lang["configcheck_warning"] = 'Avisos de configuração:';
diff --git a/core/lang/ro/global.php b/core/lang/ro/global.php
index 17236c77a8..56d3e7c113 100644
--- a/core/lang/ro/global.php
+++ b/core/lang/ro/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Aceasta înseamnă că pagina de acces neautorizat nu este accesibilă vizitatorilor obișnuiți sau nu există. Acest lucru poate provoca o buclă recursivă și multe erori în jurnalele site-ului. Asigură-te că paginii nu îi sunt atribuite grupuri de utilizatori web.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Pagina de acces neautorizat definită în configurația site-ului nu este publicată.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Aceasta înseamnă că pagina de acces neautorizat nu este accesibilă publicului. Publică pagina sau asigură-te că este atribuită unei resurse existente în arborele site-ului, din meniul Instrumente &gt; Configurare.';
+$_lang["configcheck_htaccess_rules"] = 'Avertisment de securitate: .htaccess este învechit';
+$_lang["configcheck_htaccess_rules_msg"] = 'În fișierul <strong>.htaccess</strong> al acestui site lipsesc reguli de securitate ale versiunii curente, iar actualizările nu modifică niciodată acest fișier. Fișierele private, copiile de siguranță sau fișierele PHP din assets pot fi accesibile. Comparați-l cu <strong>ht.access</strong> din această versiune și adăugați regulile lipsă.';
 $_lang["configcheck_validate_referer"] = 'Avertisment de securitate: validarea antetelor HTTP';
 $_lang["configcheck_validate_referer_msg"] = 'Setarea <strong>Validează antetele HTTP_REFERER?</strong> este dezactivată. Recomandăm activarea ei. <a href="index.php?a=17">Deschide opțiunile de configurare</a>';
 $_lang["configcheck_warning"] = 'Avertisment de configurare: ';
diff --git a/core/lang/sk/global.php b/core/lang/sk/global.php
index 859aab191b..6c2f8482cb 100644
--- a/core/lang/sk/global.php
+++ b/core/lang/sk/global.php
@@ -168,6 +168,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'To znamená, že neexistuje alebo nie je dostupná bežným návštevníkom webu. Môže to viesť k rekurzívnemu volaniu funkcie \'chybová stránka\' a veľkému počtu záznamov v protokole webu. Uistite sa, že žiadne skupiny webových používateľov nemajú túto stránku priradenú.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Stránka o obmedzenom prístupe uvedená v konfigurácii webu nie je publikovaná.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'To znamená, že nie je dostupná návštevníkom webu. Aby táto funkcia fungovala správne, je potrebné stránku o obmedzenom prístupe publikovať.';
+$_lang["configcheck_htaccess_rules"] = 'Bezpečnostné upozornenie: .htaccess je zastaraný';
+$_lang["configcheck_htaccess_rules_msg"] = 'V súbore <strong>.htaccess</strong> tohto webu chýbajú bezpečnostné pravidlá aktuálneho vydania a aktualizácie tento súbor nikdy nemenia. Súkromné súbory, zálohy alebo súbory PHP v priečinku assets môžu byť dostupné. Porovnajte ho so súborom <strong>ht.access</strong> tohto vydania a doplňte chýbajúce pravidlá.';
 $_lang["configcheck_validate_referer"] = 'Bezpečnostné upozornenie: kontrola HTTP hlavičky';
 $_lang["configcheck_validate_referer_msg"] = 'V konfigurácii je parameter <b>Overovať serverové hlavičky HTTP_REFERER?</b> vypnutý. Odporúčame ho zapnúť. <a href="index.php?a=17">Prejsť na nastavenie konfigurácie</a>';
 $_lang["configcheck_warning"] = 'Chyba konfigurácie:';
diff --git a/core/lang/sv/global.php b/core/lang/sv/global.php
index 7dbcd9b6e2..ceb2e81481 100644
--- a/core/lang/sv/global.php
+++ b/core/lang/sv/global.php
@@ -159,6 +159,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Detta betyder att din webbplats otillåten-sida inte är tillgänglig för vanliga användare eller att den inte existerar. Det här kan leda till att ett tillstånd med upprepande loopar skapas och ger upphov till att många fel rapporteras i webbplatsens loggar. Kontrollera att inga webbanvändargrupper är knutna till sidan.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Den otillåten-sida som angetts i inställningarna är inte publicerad.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Detta betyder att din otillåten-sida är oåtkomlig för allmänheten. Publicera sidan eller kontrollera under Verktyg &gt; Konfiguration att den angivna sidan är en existerande resurs i webbplatsens resursträd.';
+$_lang["configcheck_htaccess_rules"] = 'Säkerhetsvarning: .htaccess är inaktuell';
+$_lang["configcheck_htaccess_rules_msg"] = 'Filen <strong>.htaccess</strong> på den här webbplatsen saknar säkerhetsregler från den aktuella versionen, och uppdateringar ändrar aldrig den här filen. Privata filer, säkerhetskopior eller PHP-filer under assets kan vara åtkomliga. Jämför den med <strong>ht.access</strong> i den här versionen och lägg till de regler som saknas.';
 $_lang["configcheck_validate_referer"] = 'Säkerhetsvarning: validering av HTTP-header';
 $_lang["configcheck_validate_referer_msg"] = 'Konfigurationsinställningen <strong>Kontrollera HTTP_REFERER-headers?</strong> är inaktiverad. Vi rekommenderar att den aktiveras. <a href="index.php?a=17">Gå till konfigurationssidan</a>.';
 $_lang["configcheck_warning"] = 'Konfigurationsvarning: ';
diff --git a/core/lang/tg/global.php b/core/lang/tg/global.php
index 1a9eeacfd9..8fb742302f 100644
--- a/core/lang/tg/global.php
+++ b/core/lang/tg/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Ин саҳифа барои меҳмонон дастнорас аст ё мавҷуд нест. Он метавонад даври беохир ва хатоҳои зиёд дар гузоришҳо эҷод кунад. Боварӣ ҳосил кунед, ки ба саҳифа гурӯҳҳои корбарони веб таъин нашудаанд.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Саҳифаи манъи дастрасии дар танзимот муайяншуда нашр нашудааст.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Ин саҳифа барои умум дастнорас аст. Онро нашр кунед ё дар менюи Абзорҳо &gt; Танзимот захираи мавҷудаи дарахти сомонаро таъин кунед.';
+$_lang["configcheck_htaccess_rules"] = 'Огоҳии амниятӣ: .htaccess кӯҳна шудааст';
+$_lang["configcheck_htaccess_rules_msg"] = 'Дар файли <strong>.htaccess</strong>-и ин сайт қоидаҳои амниятии нашри ҷорӣ намерасанд ва навсозиҳо ҳеҷ гоҳ ин файлро тағйир намедиҳанд. Файлҳои шахсӣ, нусхаҳои эҳтиётӣ ё файлҳои PHP дар assets метавонанд дастрас бошанд. Онро бо <strong>ht.access</strong>-и ин нашр муқоиса кунед ва қоидаҳои намерасидаро илова намоед.';
 $_lang["configcheck_validate_referer"] = 'Огоҳии амниятӣ: санҷиши сарлавҳаҳои HTTP';
 $_lang["configcheck_validate_referer_msg"] = 'Танзимоти <strong>Сарлавҳаҳои HTTP_REFERER санҷида шаванд?</strong> хомӯш аст. Фаъол кардани он тавсия мешавад. <a href="index.php?a=17">Кушодани танзимот</a>';
 $_lang["configcheck_warning"] = 'Огоҳии танзимот: ';
diff --git a/core/lang/tk/global.php b/core/lang/tk/global.php
index 526a1c7d6c..f8f92a5339 100644
--- a/core/lang/tk/global.php
+++ b/core/lang/tk/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Ygtyýarsyz giriş sahypasy adaty ulanyjylara elýeterli däl ýa-da ýok. Bu aýlawlara we žurnalda köp ýalňyşlyga sebäp bolup biler. Sahypa web ulanyjy toparlarynyň bellenmändigini barlaň.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Sazlamalarda bellenen ygtyýarsyz giriş sahypasy çap edilmedik.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Sahypa köpçülige elýeterli däl. Ony çap ediň ýa-da Gurallar &gt; Sazlamalar menýusynda bar bolan resursyň bellenendigini barlaň.';
+$_lang["configcheck_htaccess_rules"] = 'Howpsuzlyk duýduryşy: .htaccess köneldi';
+$_lang["configcheck_htaccess_rules_msg"] = 'Bu saýtyň <strong>.htaccess</strong> faýlynda häzirki neşiriň howpsuzlyk düzgünleri ýetmeýär, täzelenmeler bolsa bu faýly hiç haçan üýtgetmeýär. Hususy faýllar, ätiýaçlyk nusgalar ýa-da assets içindäki PHP faýllary elýeterli bolup biler. Ony şu neşiriň <strong>ht.access</strong> faýly bilen deňeşdiriň we ýetmeýän düzgünleri goşuň.';
 $_lang["configcheck_validate_referer"] = 'Howpsuzlyk duýduryşy: HTTP sözbaşylaryny barlamak';
 $_lang["configcheck_validate_referer_msg"] = '<strong>HTTP_REFERER sözbaşylaryny barlamalymy?</strong> sazlamasy öçürilen. Ony açmagy maslahat berýäris. <a href="index.php?a=17">Sazlamalara geç</a>';
 $_lang["configcheck_warning"] = 'Sazlama duýduryşy: ';
diff --git a/core/lang/uk/global.php b/core/lang/uk/global.php
index 3063c3f087..fdd06293d6 100644
--- a/core/lang/uk/global.php
+++ b/core/lang/uk/global.php
@@ -173,6 +173,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Це означає, що вона не існує або недоступна звичайним відвідувачам сайту. Це може призвести до рекурсивного виклику функції \'повідомлення про помилку\' і великої кількості записів у журналі сайту. Переконайтеся, що немає груп веб-користувачів, яким призначена ця сторінка.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Сторінка повідомлення про обмежений доступ, зазначена в конфігурації сайту, не опублікована.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Це означає, що вона недоступна відвідувачам сайту. Необхідно опублікувати сторінку повідомлення про обмеження доступу, щоб ця функція працювала правильно.';
+$_lang["configcheck_htaccess_rules"] = 'Попередження безпеки: .htaccess застарів';
+$_lang["configcheck_htaccess_rules_msg"] = 'У файлі <strong>.htaccess</strong> цього сайту бракує правил безпеки поточного випуску, а оновлення ніколи не змінюють цей файл. Приватні файли, резервні копії або PHP-файли в assets можуть бути доступні. Порівняйте його з <strong>ht.access</strong> цього випуску та додайте відсутні правила.';
 $_lang["configcheck_validate_referer"] = 'Попередження безпеки: перевірка заголовка HTTP';
 $_lang["configcheck_validate_referer_msg"] = 'У конфігурації параметр<strong>Перевіряти серверні заголовки HTTP_REFERER?</strong> відключений. Ми рекомендуємо його ввімкнути. <a href="index.php?a=17">Перейти до налаштування конфігурації</a>';
 $_lang["configcheck_warning"] = 'Помилка конфігурації:';
diff --git a/core/lang/uz/global.php b/core/lang/uz/global.php
index 6e36a53359..eff75e6648 100644
--- a/core/lang/uz/global.php
+++ b/core/lang/uz/global.php
@@ -166,6 +166,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'Bu ruxsatsiz kirish sahifasi oddiy tashrif buyuruvchilar uchun ochiq emasligini yoki mavjud emasligini bildiradi. Bu rekursiv takrorlanishga va sayt jurnallarida ko‘plab xatolarga olib kelishi mumkin. Sahifaga veb-foydalanuvchi guruhlari biriktirilmaganini tekshiring.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'Sayt konfiguratsiyasida belgilangan ruxsatsiz kirish sahifasi chop etilmagan.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'Bu ruxsatsiz kirish sahifasi barcha tashrif buyuruvchilar uchun yopiq ekanini bildiradi. Sahifani chop eting yoki Asboblar &gt; Konfiguratsiya menyusida unga sayt daraxtidagi mavjud resurs tayinlanganini tekshiring.';
+$_lang["configcheck_htaccess_rules"] = 'Xavfsizlik ogohlantirishi: .htaccess eskirgan';
+$_lang["configcheck_htaccess_rules_msg"] = 'Ushbu saytning <strong>.htaccess</strong> faylida joriy relizning xavfsizlik qoidalari yetishmaydi, yangilanishlar esa bu faylni hech qachon o‘zgartirmaydi. Shaxsiy fayllar, zaxira nusxalar yoki assets ichidagi PHP fayllari ochiq bo‘lishi mumkin. Uni ushbu relizning <strong>ht.access</strong> fayli bilan solishtiring va yetishmayotgan qoidalarni qo‘shing.';
 $_lang["configcheck_validate_referer"] = 'Xavfsizlik ogohlantirishi: HTTP sarlavhalarini tekshirish';
 $_lang["configcheck_validate_referer_msg"] = '<strong>HTTP_REFERER sarlavhalari tekshirilsinmi?</strong> sozlamasi o‘chirilgan. Uni yoqishni tavsiya qilamiz. <a href="index.php?a=17">Konfiguratsiya sozlamalariga o‘tish</a>';
 $_lang["configcheck_warning"] = 'Konfiguratsiya ogohlantirishi: ';
diff --git a/core/lang/zh/global.php b/core/lang/zh/global.php
index 9a81529df2..74611cbbb4 100644
--- a/core/lang/zh/global.php
+++ b/core/lang/zh/global.php
@@ -159,6 +159,8 @@
 $_lang["configcheck_unauthorizedpage_unavailable_msg"] = 'This means that your Unauthorized page is not accessible to normal web surfers or does not exist. This can lead to a recursive looping condition and many errors in your site logs. Make sure there are no Webuser Groups assigned to the page.';
 $_lang["configcheck_unauthorizedpage_unpublished"] = 'The Unauthorized page defined in the site configuration settings is not published.';
 $_lang["configcheck_unauthorizedpage_unpublished_msg"] = 'This means that your Unauthorized page is inaccessible to the general public. Publish the page or make sure it is assigned to an existing Resource in your Site Tree in the Tools &gt; Configuration menu.';
+$_lang["configcheck_htaccess_rules"] = '安全警告: .htaccess 已过时';
+$_lang["configcheck_htaccess_rules_msg"] = '此站点的 <strong>.htaccess</strong> 文件缺少当前版本的安全规则，而更新绝不会更改此文件。私有文件、备份或 assets 下的 PHP 文件可能可被访问。请将其与此版本的 <strong>ht.access</strong> 进行比较，并添加缺失的规则。';
 $_lang["configcheck_validate_referer"] = 'Security Warning: HTTP Header Validation';
 $_lang["configcheck_validate_referer_msg"] = 'The configuration setting <strong>Validate HTTP_REFERER headers?</strong> is Off. We recommend turning it On. <a href="index.php?a=17">Go to Configuration options</a>';
 $_lang["configcheck_warning"] = '配置警告:';
diff --git a/install/src/lang/az.inc.php b/install/src/lang/az.inc.php
index c670a83e64..73f7d3a2af 100644
--- a/install/src/lang/az.inc.php
+++ b/install/src/lang/az.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Məlumat bazası məlumatları',
   'connection_screen_database_login' => 'Məlumat bazası giriş adı:',
   'connection_screen_database_name' => 'Məlumat bazası adı:',
+  'connection_screen_env_notice' => 'Bu parametrlər mühitdə təyin olunub və bu formanı əvəz edir: %s.',
   'connection_screen_database_pass' => 'Məlumat bazası şifrəsi:',
   'connection_screen_database_test_connection' => 'Məlumat bazasının seçimini yaratmaq və ya test etmək.',
   'connection_screen_database_type' => 'Məlumat bazası növü:',
diff --git a/install/src/lang/be.inc.php b/install/src/lang/be.inc.php
index 36ab2cb869..10069d5d2a 100644
--- a/install/src/lang/be.inc.php
+++ b/install/src/lang/be.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Database Information',
   'connection_screen_database_login' => 'Database login name:',
   'connection_screen_database_name' => 'Database name:',
+  'connection_screen_env_notice' => 'Гэтыя налады зададзены ў асяроддзі і перавызначаюць гэтую форму: %s.',
   'connection_screen_database_pass' => 'Database password:',
   'connection_screen_database_test_connection' => 'Create or test selection of your database.',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/bg.inc.php b/install/src/lang/bg.inc.php
index 36de6483c0..8a325770f0 100644
--- a/install/src/lang/bg.inc.php
+++ b/install/src/lang/bg.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Информация за БД',
   'connection_screen_database_login' => 'Име за връзка към БД:',
   'connection_screen_database_name' => 'Име на БД:',
+  'connection_screen_env_notice' => 'Тези настройки са зададени в средата и имат предимство пред този формуляр: %s.',
   'connection_screen_database_pass' => 'Парола за БД:',
   'connection_screen_database_test_connection' => 'Кликнете, за да създадете БД или да тествате връзката към нея',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/cs.inc.php b/install/src/lang/cs.inc.php
index 2d9e956076..c6478b21af 100644
--- a/install/src/lang/cs.inc.php
+++ b/install/src/lang/cs.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Databázové informace',
   'connection_screen_database_login' => 'Uživatelské jméno do databáze:',
   'connection_screen_database_name' => 'Název databáze:',
+  'connection_screen_env_notice' => 'Tato nastavení jsou určena v prostředí a mají přednost před tímto formulářem: %s.',
   'connection_screen_database_pass' => 'Heslo do databáze:',
   'connection_screen_database_test_connection' => 'Vytvořit nebo otestovat zvolenou databázi.',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/da.inc.php b/install/src/lang/da.inc.php
index dee26d6e58..d6597728f4 100644
--- a/install/src/lang/da.inc.php
+++ b/install/src/lang/da.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Database Information',
   'connection_screen_database_login' => 'Database brugernavn:',
   'connection_screen_database_name' => 'Database navn:',
+  'connection_screen_env_notice' => 'Disse indstillinger er angivet i miljøet og tilsidesætter denne formular: %s.',
   'connection_screen_database_pass' => 'Database kodeord:',
   'connection_screen_database_test_connection' => 'Opret eller kontroller den valgte database.',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/de.inc.php b/install/src/lang/de.inc.php
index 23c9ae5b0d..a449df6f7e 100644
--- a/install/src/lang/de.inc.php
+++ b/install/src/lang/de.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Datenbank-Information',
   'connection_screen_database_login' => 'Datenbank-Login-Name:',
   'connection_screen_database_name' => 'Datenbank-Name:',
+  'connection_screen_env_notice' => 'Diese Einstellungen sind in der Umgebung gesetzt und überschreiben dieses Formular: %s.',
   'connection_screen_database_pass' => 'Datenbank-Passwort:',
   'connection_screen_database_test_connection' => 'Klicken Sie hier, um die Datenbank zu erstellen bzw. um die Verbinding zu testen.',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/es.inc.php b/install/src/lang/es.inc.php
index 96b67e5454..7fe8d23bcc 100644
--- a/install/src/lang/es.inc.php
+++ b/install/src/lang/es.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Información de la base de datos',
   'connection_screen_database_login' => 'Nombre de usuario de la base de datos:',
   'connection_screen_database_name' => 'Nombre de la base de datos:',
+  'connection_screen_env_notice' => 'Estos ajustes están definidos en el entorno y prevalecen sobre este formulario: %s.',
   'connection_screen_database_pass' => 'Contraseña de la base de datos:',
   'connection_screen_database_test_connection' => 'Haz clic aquí para crear tu base de datos o para probar la selección de tu base de datos',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/et.inc.php b/install/src/lang/et.inc.php
index 02a10026f8..e957795e67 100644
--- a/install/src/lang/et.inc.php
+++ b/install/src/lang/et.inc.php
@@ -67,6 +67,7 @@
   'connection_screen_database_info' => 'Andmebaasi teave',
   'connection_screen_database_login' => 'Andmebaasi kasutajanimi:',
   'connection_screen_database_name' => 'Andmebaasi nimi:',
+  'connection_screen_env_notice' => 'Need seaded on määratud keskkonnas ja alistavad selle vormi: %s.',
   'connection_screen_database_pass' => 'Andmebaasi parool:',
   'connection_screen_database_test_connection' => 'Loo andmebaas või kontrolli selle valikut.',
   'connection_screen_database_type' => 'Andmebaasi tüüp:',
diff --git a/install/src/lang/fa.inc.php b/install/src/lang/fa.inc.php
index 256c779723..31c341e38f 100644
--- a/install/src/lang/fa.inc.php
+++ b/install/src/lang/fa.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'اطلاعات پایگاه داده',
   'connection_screen_database_login' => 'نام کاربری:',
   'connection_screen_database_name' => 'نام پایگاه داده:',
+  'connection_screen_env_notice' => 'این تنظیمات در محیط تعیین شده‌اند و بر این فرم اولویت دارند: %s.',
   'connection_screen_database_pass' => 'کلمه ی عبور:',
   'connection_screen_database_test_connection' => 'لطفا برای ایجاد پایگاه داده و یا بررسی کردن انتخاب شده های پایگاه داده اینجا کلیک کنید.',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/fi.inc.php b/install/src/lang/fi.inc.php
index 8b28c6b8dc..64be39536e 100644
--- a/install/src/lang/fi.inc.php
+++ b/install/src/lang/fi.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Tietokannan tiedot',
   'connection_screen_database_login' => 'Käyttäjänimi:',
   'connection_screen_database_name' => 'Tietokannan nimi:',
+  'connection_screen_env_notice' => 'Nämä asetukset on määritetty ympäristössä, ja ne ohittavat tämän lomakkeen: %s.',
   'connection_screen_database_pass' => 'Salasana:',
   'connection_screen_database_test_connection' => 'Napsauta tähän luodaksesi tietokanta tai testataksesi jo luodun tietokannan valintaa',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/fr.inc.php b/install/src/lang/fr.inc.php
index 680cde1c01..85f7301476 100644
--- a/install/src/lang/fr.inc.php
+++ b/install/src/lang/fr.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Informations de la base de données',
   'connection_screen_database_login' => 'Identifiant utilisateur de la base:',
   'connection_screen_database_name' => 'Nom de la Base:',
+  'connection_screen_env_notice' => 'Ces paramètres sont définis dans l\'environnement et remplacent ce formulaire : %s.',
   'connection_screen_database_pass' => 'Mot de passe:',
   'connection_screen_database_test_connection' => 'Cliquez ici pour créer votre base de données ou pour tester la sélection de votre base.',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/he.inc.php b/install/src/lang/he.inc.php
index c776b3e609..8fd961eb47 100644
--- a/install/src/lang/he.inc.php
+++ b/install/src/lang/he.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'מידע על מסד הנתונים',
   'connection_screen_database_login' => 'שם התחברות למסד הנתונים:',
   'connection_screen_database_name' => 'שם מסד הנתונים:',
+  'connection_screen_env_notice' => 'הגדרות אלה נקבעו בסביבה וגוברות על טופס זה: %s.',
   'connection_screen_database_pass' => 'סיסמת מסד הנתונים:',
   'connection_screen_database_test_connection' => 'לחץ כאן כדי ליצור את מסד הנתונים או כדי לבדוק את הבחירה של מסד הנתונים',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/hy.inc.php b/install/src/lang/hy.inc.php
index 5f7ec7e237..e06046825b 100644
--- a/install/src/lang/hy.inc.php
+++ b/install/src/lang/hy.inc.php
@@ -67,6 +67,7 @@
   'connection_screen_database_info' => 'Տվյալների բազայի տեղեկություններ',
   'connection_screen_database_login' => 'Տվյալների բազայի օգտանուն՝',
   'connection_screen_database_name' => 'Տվյալների բազայի անուն՝',
+  'connection_screen_env_notice' => 'Այս կարգավորումները սահմանված են միջավայրում և գերակայում են այս ձևի նկատմամբ՝ %s։',
   'connection_screen_database_pass' => 'Տվյալների բազայի գաղտնաբառ՝',
   'connection_screen_database_test_connection' => 'Ստեղծել տվյալների բազան կամ ստուգել դրա ընտրությունը։',
   'connection_screen_database_type' => 'Տվյալների բազայի տեսակ՝',
diff --git a/install/src/lang/it.inc.php b/install/src/lang/it.inc.php
index 1fc8565692..cea0bdb7c3 100644
--- a/install/src/lang/it.inc.php
+++ b/install/src/lang/it.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Informazioni sul Database',
   'connection_screen_database_login' => 'Nome utente del Database:',
   'connection_screen_database_name' => 'Nome del Database:',
+  'connection_screen_env_notice' => 'Queste impostazioni sono definite nell\'ambiente e hanno la precedenza su questo modulo: %s.',
   'connection_screen_database_pass' => 'Password del Database:',
   'connection_screen_database_test_connection' => 'Crea un Database o verifica il Database selezionato.',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/ja.inc.php b/install/src/lang/ja.inc.php
index 0fdbdbe0f0..9fbdbd322c 100644
--- a/install/src/lang/ja.inc.php
+++ b/install/src/lang/ja.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'データベース設定',
   'connection_screen_database_login' => 'データベース接続ログイン名:',
   'connection_screen_database_name' => 'データベース名:',
+  'connection_screen_env_notice' => 'これらの設定は環境で定義されており、このフォームより優先されます: %s。',
   'connection_screen_database_pass' => 'データベース接続パスワード:',
   'connection_screen_database_test_connection' => 'ここをクリックして、データベースのテストを行なってください。<br />（※権限がある場合は、この操作でデータベースを新規に作成できます）',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/ka.inc.php b/install/src/lang/ka.inc.php
index cc08ff6114..aa2a964886 100644
--- a/install/src/lang/ka.inc.php
+++ b/install/src/lang/ka.inc.php
@@ -67,6 +67,7 @@
   'connection_screen_database_info' => 'მონაცემთა ბაზის ინფორმაცია',
   'connection_screen_database_login' => 'მონაცემთა ბაზის მომხმარებლის სახელი:',
   'connection_screen_database_name' => 'მონაცემთა ბაზის სახელი:',
+  'connection_screen_env_notice' => 'ეს პარამეტრები გარემოშია განსაზღვრული და ამ ფორმას უგულებელყოფს: %s.',
   'connection_screen_database_pass' => 'მონაცემთა ბაზის პაროლი:',
   'connection_screen_database_test_connection' => 'შექმენით მონაცემთა ბაზა ან შეამოწმეთ მისი არჩევა.',
   'connection_screen_database_type' => 'მონაცემთა ბაზის ტიპი:',
diff --git a/install/src/lang/kk.inc.php b/install/src/lang/kk.inc.php
index 3b33a603a5..958b8c2b1a 100644
--- a/install/src/lang/kk.inc.php
+++ b/install/src/lang/kk.inc.php
@@ -67,6 +67,7 @@
   'connection_screen_database_info' => 'Дерекқор туралы ақпарат',
   'connection_screen_database_login' => 'Дерекқорға кіру аты:',
   'connection_screen_database_name' => 'Дерекқор атауы:',
+  'connection_screen_env_notice' => 'Бұл баптаулар ортада орнатылған және осы пішіннің мәндерін алмастырады: %s.',
   'connection_screen_database_pass' => 'Дерекқор құпиясөзі:',
   'connection_screen_database_test_connection' => 'Дерекқорды жасау немесе оны таңдауды тексеру.',
   'connection_screen_database_type' => 'Дерекқор түрі:',
diff --git a/install/src/lang/ky.inc.php b/install/src/lang/ky.inc.php
index 736eba0535..37fa401cac 100644
--- a/install/src/lang/ky.inc.php
+++ b/install/src/lang/ky.inc.php
@@ -67,6 +67,7 @@
   'connection_screen_database_info' => 'Маалымат базасы жөнүндө маалымат',
   'connection_screen_database_login' => 'Маалымат базасынын колдонуучу аты:',
   'connection_screen_database_name' => 'Маалымат базасынын аты:',
+  'connection_screen_env_notice' => 'Бул жөндөөлөр чөйрөдө коюлган жана ушул форманын маанилерин алмаштырат: %s.',
   'connection_screen_database_pass' => 'Маалымат базасынын сырсөзү:',
   'connection_screen_database_test_connection' => 'Маалымат базасын түзүү же анын тандалышын текшерүү.',
   'connection_screen_database_type' => 'Маалымат базасынын түрү:',
diff --git a/install/src/lang/nl.inc.php b/install/src/lang/nl.inc.php
index 80d9410df9..d5e1429836 100644
--- a/install/src/lang/nl.inc.php
+++ b/install/src/lang/nl.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Database Informatie',
   'connection_screen_database_login' => 'Database inlognaam:',
   'connection_screen_database_name' => 'Database naam',
+  'connection_screen_env_notice' => 'Deze instellingen zijn in de omgeving ingesteld en overschrijven dit formulier: %s.',
   'connection_screen_database_pass' => 'Database wachtwoord:',
   'connection_screen_database_test_connection' => 'Maak of test selectie van uw database.',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/nn.inc.php b/install/src/lang/nn.inc.php
index f915775276..5d5482695c 100644
--- a/install/src/lang/nn.inc.php
+++ b/install/src/lang/nn.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Databaseopplysninger',
   'connection_screen_database_login' => 'Databasens inloggingsnavn:',
   'connection_screen_database_name' => 'Databasenavn:',
+  'connection_screen_env_notice' => 'Disse innstillingene er satt i miljøet og overstyrer dette skjemaet: %s.',
   'connection_screen_database_pass' => 'Databasens passord:',
   'connection_screen_database_test_connection' => 'Klikk her for &aring; opprette din database eller for &aring; teste ditt databasevalg',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/pl.inc.php b/install/src/lang/pl.inc.php
index 3d0174d2d0..181cf1d231 100644
--- a/install/src/lang/pl.inc.php
+++ b/install/src/lang/pl.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Informacje o bazie danych',
   'connection_screen_database_login' => 'Nazwa użytkownika bazy: ',
   'connection_screen_database_name' => 'Nazwa bazy: ',
+  'connection_screen_env_notice' => 'Te ustawienia są określone w środowisku i zastępują ten formularz: %s.',
   'connection_screen_database_pass' => 'Hasło do bazy: ',
   'connection_screen_database_test_connection' => 'Tworzenie lub testowanie wybranej bazy danych.',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/pt.inc.php b/install/src/lang/pt.inc.php
index ac8f750bee..9acae41d7f 100644
--- a/install/src/lang/pt.inc.php
+++ b/install/src/lang/pt.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Informação da Base de Dados.',
   'connection_screen_database_login' => 'Login da Base de Dados:',
   'connection_screen_database_name' => 'Nome da Base de Dados:',
+  'connection_screen_env_notice' => 'Estas definições estão configuradas no ambiente e substituem este formulário: %s.',
   'connection_screen_database_pass' => 'Senha da Base de Dados:',
   'connection_screen_database_test_connection' => 'Clique aqui para criar a sua Base de Dados ou testar a conexão',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/sk.inc.php b/install/src/lang/sk.inc.php
index ef7bf5a3cf..2271fc3987 100644
--- a/install/src/lang/sk.inc.php
+++ b/install/src/lang/sk.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Informácie o databáze',
   'connection_screen_database_login' => 'Používateľské meno:',
   'connection_screen_database_name' => 'Názov databázy:',
+  'connection_screen_env_notice' => 'Tieto nastavenia sú určené v prostredí a majú prednosť pred týmto formulárom: %s.',
   'connection_screen_database_pass' => 'Heslo:',
   'connection_screen_database_test_connection' => 'Kliknite sem pre vytvorenie databázy alebo overenie, že taká databáza existuje',
   'connection_screen_database_type' => 'Typ databázy:',
diff --git a/install/src/lang/sv.inc.php b/install/src/lang/sv.inc.php
index e4ee880d4b..4b88778c0b 100644
--- a/install/src/lang/sv.inc.php
+++ b/install/src/lang/sv.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Databasinformation',
   'connection_screen_database_login' => 'Databasens inloggningsnamn:',
   'connection_screen_database_name' => 'Databasnamn:',
+  'connection_screen_env_notice' => 'Dessa inställningar är angivna i miljön och åsidosätter det här formuläret: %s.',
   'connection_screen_database_pass' => 'Databasens lösenord:',
   'connection_screen_database_test_connection' => 'Skapa databas eller testa ditt databasval',
   'connection_screen_database_type' => 'Database type:',
diff --git a/install/src/lang/tg.inc.php b/install/src/lang/tg.inc.php
index 62e5c3304d..ce8b556a9f 100644
--- a/install/src/lang/tg.inc.php
+++ b/install/src/lang/tg.inc.php
@@ -67,6 +67,7 @@
   'connection_screen_database_info' => 'Маълумоти пойгоҳи додаҳо',
   'connection_screen_database_login' => 'Номи корбари пойгоҳи додаҳо:',
   'connection_screen_database_name' => 'Номи пойгоҳи додаҳо:',
+  'connection_screen_env_notice' => 'Ин танзимот дар муҳит муқаррар шудаанд ва бар ин шакл бартарӣ доранд: %s.',
   'connection_screen_database_pass' => 'Гузарвожаи пойгоҳи додаҳо:',
   'connection_screen_database_test_connection' => 'Сохтан ё санҷиши интихоби пойгоҳи додаҳо.',
   'connection_screen_database_type' => 'Навъи пойгоҳи додаҳо:',
diff --git a/install/src/lang/tk.inc.php b/install/src/lang/tk.inc.php
index 570fcfa39b..dcef01f217 100644
--- a/install/src/lang/tk.inc.php
+++ b/install/src/lang/tk.inc.php
@@ -67,6 +67,7 @@
   'connection_screen_database_info' => 'Maglumat binýady barada maglumat',
   'connection_screen_database_login' => 'Maglumat binýadyna giriş ady:',
   'connection_screen_database_name' => 'Maglumat binýadynyň ady:',
+  'connection_screen_env_notice' => 'Bu sazlamalar gurşawda kesgitlenen we şu formanyň ýerine ulanylýar: %s.',
   'connection_screen_database_pass' => 'Maglumat binýadynyň paroly:',
   'connection_screen_database_test_connection' => 'Maglumat binýadyňyzy dörediň ýa-da onuň saýlanyşyny barlaň.',
   'connection_screen_database_type' => 'Maglumat binýadynyň görnüşi:',
diff --git a/install/src/lang/uk.inc.php b/install/src/lang/uk.inc.php
index 784f95813a..3f9ba35321 100644
--- a/install/src/lang/uk.inc.php
+++ b/install/src/lang/uk.inc.php
@@ -61,6 +61,7 @@
     'connection_screen_database_info' => 'Інформація бази даних',
     'connection_screen_database_login' => 'Ім\'я користувача:',
     'connection_screen_database_name' => 'Назва бази даних:',
+    'connection_screen_env_notice' => 'Ці налаштування задані в середовищі та перевизначають цю форму: %s.',
     'connection_screen_database_pass' => 'Пароль:',
     'connection_screen_database_test_connection' => 'Натисніть тут, щоб створити базу даних або перевірити, що така база існує',
     'connection_screen_database_type' => 'Тип бази даних:',
diff --git a/install/src/lang/zh.inc.php b/install/src/lang/zh.inc.php
index 521938b537..2c594305a6 100644
--- a/install/src/lang/zh.inc.php
+++ b/install/src/lang/zh.inc.php
@@ -61,6 +61,7 @@
   'connection_screen_database_info' => 'Database Information',
   'connection_screen_database_login' => 'Database login name:',
   'connection_screen_database_name' => 'Database name:',
+  'connection_screen_env_notice' => '这些设置已在环境中配置，并会覆盖此表单：%s。',
   'connection_screen_database_pass' => 'Database password:',
   'connection_screen_database_test_connection' => 'Create or test selection of your database.',
   'connection_screen_database_type' => 'Database type:',