F/R/E/E/4/U

We are seeking feedback from the community on the idea of re-enabling Apache.htaccess support for
ModSecurity. 

https://www.modsecurity.org/tracker/browse/MODSEC-58. 

This functionality existed in the v1 branch of ModSecurity -

http://modsecurity.org/documentation/modsecurity-apache/1.9.3/html-multipage/03-configuration.html#N1027D. 

It was removed due to valid security concerns, namely that attackers could easily  bypass the ModSecurity
protections if they could just upload a .htaccess file with – SecFilterEngine Off in it While the security concerns
are valid, we also realize that there are many, many Hosting Providers  who are using old ModSecurity v1
strictly because they need this capability to allow their customers to use  .htaccess files for adding exceptions.
Without this feature, end users are flooding the Help Desk/Support  forums with requests to add exceptions for
ModSecurity rules for their sites.

So, we are considering adding support for this feature back into ModSecurity v2.7.x. 
It will NOT be enabled by default and would require the user to use a new --enable-htaccess-config configure
flag and re-compiling.  Users would have to understand the tradeoffs with regards to security and allowing
distributed configurtions in a multi-user environment.  

......