/
.htaccess
207 lines (169 loc) · 7.04 KB
/
.htaccess
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
AddDefaultCharset UTF-8
##############################
#### URL REWRITE ####
##############################
RewriteEngine On
RewriteRule ^(system) - [F,L]
# App single theme
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^assets/(.*)$ app/templates/assets/$1 [QSA,L]
# App multi-theme
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^themes/([0-9a-zA-Z_-]{1,})/assets/(.*)$ app/templates/$1/assets/$2 [QSA,L]
# Module single theme
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([0-9a-zA-Z_-]{1,})/assets/(.*)$ modules/$1/templates/assets/$2 [QSA,L]
# Module multi-theme
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([0-9a-zA-Z_-]{1,})/themes/([0-9a-zA-Z_-]{1,})/assets/(.*)$ modules/$1/templates/$2/assets/$3 [QSA,L]
# index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* index.php/$0 [QSA,L]
######## ERROR DOCS
ErrorDocument 400 '<html><head></head><body><h1>400 Bad Request</h1></body></html>'
ErrorDocument 401 '<html><head></head><body><h1>401 Unauthorized</h1></body></html>'
ErrorDocument 403 '<html><head></head><body><h1>403 Forbidden</h1></body></html>'
ErrorDocument 404 '<html><head></head><body><h1>404 Not Found</h1></body></html>'
ErrorDocument 405 '<html><head></head><body><h1>405 Method Not Allowed</h1></body></html>'
ErrorDocument 500 '<html><head></head><body><h1>500 Internal Server Error</h1></body></html>'
ErrorDocument 501 '<html><head></head><body><h1>501 Not Implemented</h1></body></html>'
ErrorDocument 503 '<html><head></head><body><h1>503 Service Unavailable</h1></body></html>'
######## DISABLE DIRECTORY BROWSING
Options ExecCGI Includes IncludesNOEXEC SymLinksIfOwnerMatch -Indexes
DirectoryIndex index.html index.php index.htm index.cgi index.pl default.htm default.html
######## SERVER CONFIGURATION
<IfModule mod_security.c>
# disable POST processing to not break multiple image upload
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>
<IfModule mod_php5.c>
# adjust memory limit
php_flag short_open_tag off
php_flag display_errors on
php_value error_reporting -1
php_value memory_limit 128M
php_value max_execution_time 60
php_value post_max_size 24M
php_value upload_max_filesize 16M
# disable magic quotes for php request vars
php_flag magic_quotes_gpc off
# disable automatic session start before autoload was initialized
php_flag session.auto_start off
# enable resulting html compression
# php_flag zlib.output_compression on
# disable user agent verification to not break multiple image upload
php_flag suhosin.session.cryptua off
# turn off compatibility with PHP4 when dealing with objects
php_flag zend.ze1_compatibility_mode Off
# Do not use PHPSESSID in URLs:
php_value session.use_only_cookies 1
php_value session.use_trans_sid 0
</IfModule>
# BEGIN extra file handlers
AddType application/x-httpd-php .ini .cfg .conf .phpt .tpl
AddType image/webp webp
AddType audio/ogg oga
AddType video/webm webm vp8
AddType video/ogg ogg ogv
AddType video/mp4 mp4
AddType video/quicktime mov
AddType video/x-matroska mkv
AddType image/svg+xml svg svgz
AddType application/vnd.ms-fontobject eot
AddType font/ttf ttf
AddType font/otf otf
AddType font/x-woff woff
AddType application/x-javascript .js
AddType text/css .css
AddType text/xml .xml
# END extra file handlers
# BEGIN Compress text files
<IfModule mod_deflate.c>
SetOutputFilter DEFLATE
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/xhtml+xml image/svg+xml
AddOutputFilterByType DEFLATE application/javascript application/x-javascript text/javascript
AddOutputFilterByType DEFLATE application/x-httpd-php application/x-httpd-php-source application/x-httpd-fastphp
<FilesMatch "\.(css|js|x?html?|php|ttf|otf|woff|eot|svgz?)$">
SetOutputFilter DEFLATE
</FilesMatch>
# Netscape 4.x has some problems...
BrowserMatch ^Mozilla/4 gzip-only-text/html
# Netscape 4.06-4.08 have some more problems
BrowserMatch ^Mozilla/4\.0[678] no-gzip
# MSIE masquerades as Netscape, but it is fine
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
# Don't compress images
SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|a?png|webp)$ no-gzip dont-vary
# Make sure proxies don't deliver the wrong content
Header append Vary User-Agent env=!dont-vary
</IfModule>
# END Compress text files
# BEGIN Expire headers
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 10 seconds"
ExpiresByType font/ttf "access plus 2592000 seconds"
ExpiresByType font/x-woff "access plus 2592000 seconds"
ExpiresByType font/otf "access plus 2592000 seconds"
ExpiresByType application/vnd.ms-fontobject "access plus 2592000 seconds"
ExpiresByType font/woff "access plus 2592000 seconds"
ExpiresByType image/x-icon "access plus 2592000 seconds"
ExpiresByType image/x-icon "access plus 2592000 seconds"
ExpiresByType image/jpeg "access plus 2592000 seconds"
ExpiresByType image/png "access plus 2592000 seconds"
ExpiresByType image/gif "access plus 2592000 seconds"
ExpiresByType image/webp "access plus 2592000 seconds"
ExpiresByType image/svg+xml "access plus 2592000 seconds"
ExpiresByType application/x-shockwave-flash "access plus 2592000 seconds"
ExpiresByType text/css "access plus 604800 seconds"
ExpiresByType text/javascript "access plus 216000 seconds"
ExpiresByType application/javascript "access plus 216000 seconds"
ExpiresByType application/x-javascript "access plus 216000 seconds"
ExpiresByType text/html "access plus 600 seconds"
ExpiresByType application/xhtml+xml "access plus 600 seconds"
</IfModule>
# END Expire headers
# BEGIN Cache-Control Headers
<IfModule mod_headers.c>
<FilesMatch "\.(ico|jpe?g|png|gif|swf)$">
Header set Cache-Control "max-age=2592000, public"
</FilesMatch>
<FilesMatch "\.(css)$">
Header set Cache-Control "max-age=604800, public"
</FilesMatch>
<FilesMatch "\.(js)$">
Header set Cache-Control "max-age=216000, private"
</FilesMatch>
<FilesMatch "\.(x?html?|php)$">
Header set Cache-Control "max-age=600, private, must-revalidate"
</FilesMatch>
</IfModule>
# END Cache-Control Headers
# BEGIN Turn ETags Off
<IfModule mod_headers.c>
Header unset ETag
</IfModule>
FileETag None
# END Turn ETags Off
# BEGIN Remove Last-Modified Header
<IfModule mod_headers.c>
Header unset Last-Modified
</IfModule>
# END Remove Last-Modified Header
######## FILE PROTECT & COMBINE
# file combination i.e. <!--#include file="jquery-1.7.js" -->
<FilesMatch "\-inc\.(js|css)">
Options +Includes
SetOutputFilter INCLUDES
</FilesMatch>
# prevent direct access to templates and other files
<FilesMatch "\.(htaccess|htpasswd|ini|log|sh|inc|cache|data)$">
Order Allow,Deny
Deny from all
</FilesMatch>