From 0009cfba157957217034b2f5a6779c43c8f38f39 Mon Sep 17 00:00:00 2001
From: "Stefan - ByteSide.io" <sr@byteside.io>
Date: Wed, 2 Sep 2026 11:59:45 +0200
Subject: [PATCH] fix(htaccess): serve .json and .ftl files statically instead
 of routing them to the front controller

The bundled pdf.js of files_pdfviewer loads its localization from
apps/files_pdfviewer/js/pdfjs/web/locale/locale.json and
apps/files_pdfviewer/js/pdfjs/web/locale/<lang>/viewer.ftl.

With pretty URLs enabled, both extensions are missing from the static file
exclusion of the generated front controller rule, so Apache passes the
requests to index.php, which answers 404. pdf.js then fails to initialize
and shows the alt text dialog instead of the document.

Our nginx reference configuration serves both through try_files, and so does
an Apache instance without pretty URLs, so this only brings the pretty URL
case in line with the other two.

To not widen what is reachable in the process, the package manager metadata
that the nginx configuration explicitly returns 404 for is now denied in
.htaccess as well.

Resolves: #63512
Signed-off-by: Stefan - ByteSide.io <sr@byteside.io>
---
 .htaccess             | 10 ++++++++++
 lib/private/Setup.php |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/.htaccess b/.htaccess
index 32060738ab193..dc8a04aee1343 100644
--- a/.htaccess
+++ b/.htaccess
@@ -140,6 +140,16 @@
 
     RewriteRule ^(?:build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]
 
+##
+## Rule: Prevent access to package manager metadata and our shipped app list
+##
+## Context:
+##    - Mirrors the equivalent `return 404` of our nginx reference configuration
+##    - Required because `.json` is excluded from the front controller rule
+##      generated by `lib/private/Setup.php`, so these would otherwise be served
+##
+    RewriteRule ^(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ - [R=404,L]
+
 ##
 ## Rule: Maps most RFC 8615 compliant well-known URIs to our main frontend controller (/index.php) by default
 ##
diff --git a/lib/private/Setup.php b/lib/private/Setup.php
index 8033bd520998b..e5823fe780c9b 100644
--- a/lib/private/Setup.php
+++ b/lib/private/Setup.php
@@ -614,7 +614,7 @@ public static function updateHtaccess(): bool {
 			$content .= "\n  Options -MultiViews";
 			$content .= "\n  RewriteRule ^core/js/oc.js$ index.php [PT,E=PATH_INFO:$1]";
 			$content .= "\n  RewriteRule ^core/preview.png$ index.php [PT,E=PATH_INFO:$1]";
-			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !\\.(css|js|mjs|svg|gif|ico|jpg|jpeg|png|webp|html|otf|ttf|woff2?|map|webm|mp4|mp3|ogg|wav|flac|wasm|tflite)$";
+			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !\\.(css|js|mjs|json|ftl|svg|gif|ico|jpg|jpeg|png|webp|html|otf|ttf|woff2?|map|webm|mp4|mp3|ogg|wav|flac|wasm|tflite)$";
 			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !/core/ajax/update\\.php";
 			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !/core/img/(favicon\\.ico|manifest\\.json)$";
 			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !/(cron|public|remote|status)\\.php";