X-Git-Url: https://jasonwoof.com/gitweb/?p=wfpl-cms.git;a=blobdiff_plain;f=.htaccess;h=38ace93f74672878f8e2f872303fcef7e340b5b5;hp=832b4a5edc479bd4040f66114c46cd4dad19055f;hb=HEAD;hpb=0defdb39c2df636ce2cf2e17d2882042097dc4f1

diff --git a/.htaccess b/.htaccess
index 832b4a5..38ace93 100644
--- a/.htaccess
+++ b/.htaccess
@@ -1,16 +1,41 @@
-php_value post_max_size 25M
-php_value upload_max_filesize 20M
+php_value post_max_size 250M
+php_value upload_max_filesize 200M
 php_flag register_globals off
 php_flag magic_quotes_gpc off
-Options -MultiViews
 DirectorySlash Off
+DirectoryIndex disabled
 AddDefaultCharset UTF-8
+AddCharset UTF-8 .css
 RewriteEngine  on
-RewriteRule    ^[^/.]*$  /run.php [L]
-RewriteRule    ^style_[0-9]*.css$  /style.css [L]
-RewriteRule    ^style_[0-9]*.less$  /style.less [L]
+RewriteRule ^[^/.]*$ /wfpl_main.php [L]
 
 <FilesMatch "\.(css|jpg|png)$">
-	ExpiresActive On
-	ExpiresDefault A31536000
+    ExpiresActive On
+    ExpiresDefault A31536000
 </FilesMatch>
+
+# SECURITY: don't execute code on the server (exception below)
+SetHandler none
+SetHandler default-handler
+# this option is needed for RewriteRule to work:
+Options SymlinksIfOwnerMatch
+php_flag engine off
+RemoveHandler .cgi .php .php3 .php4 .php5 .phtml .pl .py .pyc .pyo
+# code execution exception: allow only /wfpl_main.php
+# <Files> matches regardless of directory/path, so rewrite php in subdirs
+RewriteRule ^(wfpl_main\.php|paypal_ipn\.php|cms_images_autoresize\.php)$  - [L]
+RewriteRule .*\.php$ - [L,R=404]
+<Files "wfpl_main.php">
+    php_flag engine on
+    SetHandler application/x-httpd-php
+</Files>
+<Files "paypal_ipn.php">
+    php_flag engine on
+    SetHandler application/x-httpd-php
+</Files>
+<Files "cms_images_autoresize.php">
+    php_flag engine on
+    SetHandler application/x-httpd-php
+</Files>
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteRule ^cms_images/[0-9a-f]+w[0-9]+\.[pj][np]g$ /cms_images_autoresize.php