myron/epictravelexpeditions
1
0
Fork 0
mirror of https://github.com/myronblair/epictravelexpeditions synced 2026-07-28 08:52:26 -05:00
Code Issues Packages Projects Releases Wiki Activity

Harden .git/db block: use REQUEST_URI matching, direct RewriteRule patterns not reliably honored

Browse Source
This commit is contained in:
Myron Blair
2026-07-04 15:56:59 -05:00
parent 0dfcfa2f7e
commit 982a5dc5ff
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.htaccess
+5 -2
View File
@@ -16,8 +16,11 @@ RewriteBase /
# Block access to version control metadata and the raw DB schema dump.
# These were previously reachable directly over HTTP (e.g. /.git/config,
# /db/schema.sql) and leaked repo/DB internals - deny them outright.
RewriteRule ^\.git(/|$) - [F,L]
RewriteRule ^db/ - [F,L]
# Note: a direct RewriteRule pattern (no leading slash) was found NOT to be
# honored consistently on this LiteSpeed setup for root-level paths; matching
# on REQUEST_URI via RewriteCond is what's confirmed to work.
RewriteCond %{REQUEST_URI} ^/(\.git|db/)
RewriteRule .* - [F,L]
# API Routes - Direct to PHP backend
RewriteCond %{REQUEST_URI} ^/api/