What code should .htaccess of files directory hold in drupal 7.25?

Question

The module Security Review gives the report my .htaccess in files directory is a security risk because says it has insufficient code to protect the site from anyone wanting to make php edits. However, have checked it with drupal org docs and I can see the .htaccess in files directory matches up with correct security script to keep out any such attempts.

Anyway I am trying to ascertain correct code input for .htaccess in the files directory. I remember there was a bug with this so maybe the security module is picking it up, I don't know.

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
# Override the handler again if we're run later in the evaluation list.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
php_flag engine off
</IfModule>

Answer 1

The .htaccess you show is correct - it is actually the default .htaccess that Drupal versions above 7.24 (including the current 7.28) will generate for the files directory if the .htaccess file is missing.

In other words, the warning you get from Security Review is a false postive. There is no malicious alteration.

Your issue is a known bug with Security Review that has already been raised in the module's issue queue at Drupal.org. There is a also a patch that is supposed to fix this issue in the module's issue queue.

You may help the community by applying and reviewing this patch.