myron/epictravelexpeditions
1
0
Fork 0
mirror of https://github.com/myronblair/epictravelexpeditions synced 2026-07-27 16:32:33 -05:00
Code Issues Packages Projects Releases Wiki Activity

Harden .git/db block: use REQUEST_URI matching, direct RewriteRule patterns not reliably honored

Browse Source
This commit is contained in:
Myron Blair
2026-07-04 15:56:59 -05:00
parent 0dfcfa2f7e
commit 982a5dc5ff
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/.htaccess
+4 -1
View File
@@ -8,7 +8,10 @@
# Block direct access to config.php / .env - this was reachable at
# /api/config.php in production (200 OK) despite the FilesMatch/Require
# rule below, which LiteSpeed appears not to honor from .htaccess here.
RewriteRule ^(config\.php|\.env)$ - [F,L]
# Matching on REQUEST_URI (not a direct RewriteRule pattern) is what's
# confirmed to actually work on this LiteSpeed setup.
RewriteCond %{REQUEST_URI} /(config\.php|\.env)$
RewriteRule .* - [F,L]
# Route all requests to index.php
RewriteCond %{REQUEST_FILENAME} !-f