diff --git a/.htaccess b/.htaccess deleted file mode 100644 index af7ba0c..0000000 --- a/.htaccess +++ /dev/null @@ -1,34 +0,0 @@ -RewriteEngine On # Turn on the rewriting engine - -# Disallow access to the given subfolders -RewriteRule ^(\.git|conf|vendor/|composer\.json|composer\.lock|functions) - [F,L,NC] - -# Only allow GET|HEAD|POST -RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|POST|OPTIONS) -RewriteRule .? - [F] - -# RewriteCond %{REQUEST_URI} output=json -# RewriteRule ^.*$ - [ENV=LONGCACHE:true] -# Header set Access-Control-Allow-Origin "*" env=LONGCACHE -# Header set Access-Control-Allow-Methods "GET, OPTIONS" env=LONGCACHE -# Header set Access-Control-Allow-Headers "X-PINGOTHER, Content-Type, Accept-Encoding, cache-control" env=LONGCACHE -# Header set Access-Control-Max-Age "86400" env=LONGCACHE -HEADER set X-Frame-Options DENY env=LONGCACHE - -# RewriteCond %{REQUEST_FILENAME} -f -# RewriteRule ^(.+)\.pdf$ /cgi-bin/pdf.php?file=$1 [L,NC,QSA] - -# Disallow execution of the following types of scripts -RemoveHandler cgi-script .pl .py .cgi .sh - -## MAIN DEFAULTS -Options -Indexes -DirectoryIndex index.php - -# Set deailt charset -AddDefaultCharset UTF-8 - -# Set content and feature security headers -Header set Content-Security-Policy "default-src 'none'; connect-src 'none'; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; frame-src 'none'; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self';" -Header set Feature-Policy "midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker *; payment 'none'; fullscreen 'none'; geolocation 'none';" -