From cabf1b6becbc0143f6a9d0d6846fd948c06b5a64 Mon Sep 17 00:00:00 2001
From: VirtualTam <virtualtam@flibidi.net>
Date: Sat, 20 Jan 2018 16:20:53 +0100
Subject: htaccess: prevent accessing resources not managed by SCM

See:
- https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/
- https://stackoverflow.com/questions/2530372/how-do-i-disable-directory-browsing
- https://httpd.apache.org/docs/current/mod/mod_rewrite.html

Signed-off-by: VirtualTam <virtualtam@flibidi.net>
---
 .htaccess | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to '.htaccess')

diff --git a/.htaccess b/.htaccess
index 66ef8f69..19dd72a8 100644
--- a/.htaccess
+++ b/.htaccess
@@ -1,4 +1,12 @@
+# Disable directory listing
+Options -Indexes
+
 RewriteEngine On
+
+# Prevent accessing subdirectories not managed by SCM
+RewriteRule ^(.git|doxygen|vendor) - [F]
+
+# REST API
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteRule ^ index.php [QSA,L]
-- 
cgit v1.2.3