diff --git a/.htaccess b/.htaccess index 84c52d2..18e1930 100644 --- a/.htaccess +++ b/.htaccess @@ -1,37 +1,44 @@ ### SILVERSTRIPE START ### + +# Deny access to templates (but allow from localhost) Order deny,allow Deny from all Allow from 127.0.0.1 +# Deny access to IIS configuration Order deny,allow Deny from all -# This denies access to all yml files, since developers might include sensitive -# information in them. See the docs for work-arounds to serve some yaml files +# Deny access to YAML configuration files which might include sensitive information Order allow,deny Deny from all +# Route errors to static pages automatically generated by SilverStripe ErrorDocument 404 /assets/error-404.html ErrorDocument 500 /assets/error-500.html SetEnv HTTP_MOD_REWRITE On - RewriteEngine On - + RewriteEngine On + + # Deny access to potentially sensitive files and folders RewriteRule ^vendor(/|$) - [F,L,NC] RewriteRule silverstripe-cache(/|$) - [F,L,NC] RewriteRule composer\.(json|lock) - [F,L,NC] - + + # Process through SilverStripe if no file with the requested name exists. + # Pass through the original path as a query parameter, and retain the existing parameters. RewriteCond %{REQUEST_URI} ^(.*)$ RewriteCond %{REQUEST_FILENAME} !-f RewriteRule .* framework/main.php?url=%1 [QSA] - + + # If framework isn't in a subdirectory, rewrite to installer RewriteCond %{REQUEST_URI} ^(.*)/framework/main.php$ RewriteCond %{REQUEST_FILENAME} !-f RewriteRule . %1/install.php? [R,L]