mirror of
https://github.com/myronblair/epictravelexpeditions
synced 2026-07-28 17:02:29 -05:00
myron
0dfcfa2f7e
- mailer.php: re-enable TLS certificate verification for CyberMail API calls (was CURLOPT_SSL_VERIFYPEER => false, exposing outbound mail traffic to MITM). - .htaccess / api/.htaccess: block direct HTTP access to .git/, db/, and api/config.php via mod_rewrite [F] rules. Confirmed live that /.git/config, /.git/logs/HEAD, and /db/schema.sql were all directly downloadable (200 OK with real content) - .git exposure leaks the repo's embedded GitHub token and full history; schema.sql leaks the DB layout. Also drops the dead "/setup -> setup_password.php" rewrite, since that file was already deleted from production. - index.php: remove the 'download' route, which required a api/download.php that has never existed in this repo - confirmed live that GET /api/download returns a fatal 500. - functions.php / upload.php / testimonials.php: extract the duplicated image-upload validation/move logic (MIME check, size check, UUID rename, move_uploaded_file) into one handleImageUpload() helper used by both upload endpoints. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
58 lines
1.5 KiB
ApacheConf
58 lines
1.5 KiB
ApacheConf
# Epic Travel & Expeditions - LiteSpeed .htaccess for CyberPanel
|
|
# Optimized for LiteSpeed Web Server
|
|
|
|
<IfModule mod_rewrite.c>
|
|
RewriteEngine On
|
|
RewriteBase /api/
|
|
|
|
# Block direct access to config.php / .env - this was reachable at
|
|
# /api/config.php in production (200 OK) despite the FilesMatch/Require
|
|
# rule below, which LiteSpeed appears not to honor from .htaccess here.
|
|
RewriteRule ^(config\.php|\.env)$ - [F,L]
|
|
|
|
# Route all requests to index.php
|
|
RewriteCond %{REQUEST_FILENAME} !-f
|
|
RewriteCond %{REQUEST_FILENAME} !-d
|
|
RewriteRule ^(.*)$ index.php/$1 [L,QSA]
|
|
</IfModule>
|
|
|
|
# LiteSpeed Cache Control
|
|
<IfModule LiteSpeed>
|
|
# Disable caching for API
|
|
CacheLookup off
|
|
</IfModule>
|
|
|
|
# Security Headers
|
|
<IfModule mod_headers.c>
|
|
Header set X-Content-Type-Options "nosniff"
|
|
Header set X-Frame-Options "SAMEORIGIN"
|
|
Header set X-XSS-Protection "1; mode=block"
|
|
Header set X-Powered-By "Epic Travel API"
|
|
</IfModule>
|
|
|
|
# Protect sensitive files
|
|
<FilesMatch "^(config\.php|\.env)">
|
|
Require all denied
|
|
</FilesMatch>
|
|
|
|
# PHP Settings (LiteSpeed compatible)
|
|
<IfModule mod_php7.c>
|
|
php_value upload_max_filesize 10M
|
|
php_value post_max_size 10M
|
|
php_value max_execution_time 300
|
|
php_value max_input_time 300
|
|
php_value memory_limit 256M
|
|
</IfModule>
|
|
|
|
# Compression
|
|
<IfModule mod_deflate.c>
|
|
AddOutputFilterByType DEFLATE application/json
|
|
AddOutputFilterByType DEFLATE text/plain
|
|
AddOutputFilterByType DEFLATE text/html
|
|
</IfModule>
|
|
|
|
# Browser Caching
|
|
<IfModule mod_expires.c>
|
|
ExpiresActive Off
|
|
</IfModule>
|