It is extremely common for the .htaccess
file to be modified by either the webhost or the site operator for protecting Magento admin, excluding access to various files/folders, rewrite bare domain to www. subdomain, etc.
This causes a sync issue with patch
when it tries to find the appropriate area in the file to make the changes. Quite a few people who applied SUPEE-6788 probably had the patch fail only on .htaccess
due to it being modified, a few others had issues also because .htaccess.sample
was also removed as it isn't needed and becomes directory littering detritus.
The proper procedure on installing SUPEE-6788 is to:
- if it's missing, upload a clean copy of
.htaccess.sample
from the installer archive
- save a copy of your modified
.htaccess
file
- upload a clean copy of
.htaccess
from the installer archive
- successfully run the patch so it makes the changes
- save a copy of the patched
.htaccess
file
- merge the changes to the patched
.htaccess
back into your original saved copy of .htaccess
and upload that to your website
The change made in .htaccess was to restrict or prevent web accessibility to Magento's cron.php
file with the following:
###########################################
## Deny access to cron.php
<Files cron.php>
############################################
## uncomment next lines to enable cron access with base HTTP authorization
## http://httpd.apache.org/docs/2.2/howto/auth.html
##
## Warning: .htpasswd file should be placed somewhere not accessible from the web.
## This is so that folks cannot download the password file.
## For example, if your documents are served out of /usr/local/apache/htdocs
## you might want to put the password file(s) in /usr/local/apache/.
#AuthName "Cron auth"
#AuthUserFile ../.htpasswd
#AuthType basic
#Require valid-user
############################################
Order allow,deny
Deny from all
</Files>