stopplidelsen/innhold
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Updated content

Browse source
This commit is contained in:
Ruben Solvang 2026-02-24 20:26:00 +01:00
commit f0564e87ee
6 changed files with 121 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
content/.htaccess
View file

@ -1,9 +1,31 @@
DirectorySlash Off
# Block direct access to content source files
<FilesMatch "\.(ini|md|html|php)$">
# Allow only the entry point
<If "%{REQUEST_URI} != '/index.php'">
Require all denied
</If>
</FilesMatch>
# Security headers
<IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "DENY"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Header unset X-Powered-By
Header always unset X-Powered-By
</IfModule>
# Restrict HTTP methods to GET, POST, HEAD
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD)$ [NC]
RewriteRule .* - [F,L]
# Route /app requests to index.php
RewriteCond %{REQUEST_URI} ^/app/
RewriteRule ^(.*)$ /index.php [L,QSA]

22
content/.htaccess.base
View file

@ -1,9 +1,31 @@
DirectorySlash Off
# Block direct access to content source files
<FilesMatch "\.(ini|md|html|php)$">
# Allow only the entry point
<If "%{REQUEST_URI} != '/index.php'">
Require all denied
</If>
</FilesMatch>
# Security headers
<IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "DENY"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Header unset X-Powered-By
Header always unset X-Powered-By
</IfModule>
# Restrict HTTP methods to GET, POST, HEAD
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD)$ [NC]
RewriteRule .* - [F,L]
# Route /app requests to index.php
RewriteCond %{REQUEST_URI} ^/app/
RewriteRule ^(.*)$ /index.php [L,QSA]

7
content/index.php
View file

@ -5,5 +5,12 @@ if (str_starts_with($_SERVER['REQUEST_URI'], '/app/')) {
exit;
}
// Harden session cookie before any session starts
ini_set('session.cookie_httponly', '1');
ini_set('session.cookie_samesite', 'Lax');
if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
ini_set('session.cookie_secure', '1');
}
// All other requests go to router
require __DIR__ . '/../app/router.php';