From 8d51eea66f9ce9c8cc5305bba274e4d3b3f2bdef Mon Sep 17 00:00:00 2001
From: Christopher Pitt <cgpitt@gmail.com>
Date: Wed, 6 May 2015 13:35:04 +1200
Subject: [PATCH] Improve IIS security

---
 web.config | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/web.config b/web.config
index 0e3d0aad2..50e9a58dc 100644
--- a/web.config
+++ b/web.config
@@ -1,11 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
 <configuration>
-	<system.webServer>
-		<security>
-			<requestFiltering>
-				<hiddenSegments>
-					<add segment="silverstripe_version" />
-				</hiddenSegments>
-			</requestFiltering>
-		</security>
-	</system.webServer>
-</configuration>
\ No newline at end of file
+   <system.webServer>
+       <rewrite>
+           <rules>
+               <rule name="Block Scripts" stopProcessing="true">
+                   <match url="([^\\/]+)\.(php|php3|php4|php5|phtml|inc)$" />
+                   <conditions trackAllCaptures="true">
+                       <add input="{REQUEST_FILENAME}" pattern="\b(main|rpc|tiny_mce_gzip)\.php$" negate="true" />
+                   </conditions>
+                   <action type="AbortRequest" />
+               </rule>
+               <rule name="Block Version" stopProcessing="true">
+                   <match url="\bsilverstripe_version$" />
+                   <action type="AbortRequest" />
+               </rule>
+           </rules>
+       </rewrite>
+   </system.webServer>
+</configuration>