silivribel-secap-portal/web.config at main · dusova/silivribel-secap-portal · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="Deny Internal Folders" stopProcessing="true">
                    <match url="^(uygulama|veritabani|depolama|includes|database|storage)(/.*)?$" />
                    <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
                </rule>

                <rule name="Remove PHP Extension" stopProcessing="true">
                    <match url="^(.+)$" />
                    <conditions logicalGrouping="MatchAll">
                        <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
                        <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
                        <add input="{REQUEST_FILENAME}.php" matchType="IsFile" />
                    </conditions>
                    <action type="Rewrite" url="{R:1}.php" />
                </rule>
            </rules>
        </rewrite>

        <httpErrors errorMode="Custom" existingResponse="Replace">
            <remove statusCode="404" />
            <remove statusCode="403" />
            <error statusCode="404" path="/404.php" responseMode="ExecuteURL" />
            <error statusCode="403" path="/403.php" responseMode="ExecuteURL" />
        </httpErrors>

        <security>
            <requestFiltering>
                <hiddenSegments>
                    <add segment="uygulama" />
                    <add segment="veritabani" />
                    <add segment="depolama" />
                    <add segment="includes" />
                    <add segment="database" />
                    <add segment="storage" />
                    <add segment=".git" />
                </hiddenSegments>
                <fileExtensions>
                    <add fileExtension=".sql" allowed="false" />
                    <add fileExtension=".env" allowed="false" />
                    <add fileExtension=".log" allowed="false" />
                    <add fileExtension=".bak" allowed="false" />
                    <add fileExtension=".old" allowed="false" />
                    <add fileExtension=".md" allowed="false" />
                </fileExtensions>
                <denyUrlSequences>
                    <add sequence="ortam.php" />
                    <add sequence="ornek-ortam-ayarlari.php" />
                    <add sequence="env.php" />
                    <add sequence="env.example.php" />
                    <add sequence=".gitignore" />
                    <add sequence="composer.json" />
                    <add sequence="composer.lock" />
                </denyUrlSequences>
            </requestFiltering>
        </security>

        <httpProtocol>
            <customHeaders>
                <remove name="X-Content-Type-Options" />
                <remove name="X-Frame-Options" />
                <remove name="X-XSS-Protection" />
                <remove name="Referrer-Policy" />
                <remove name="Permissions-Policy" />
                <remove name="Content-Security-Policy" />
                <remove name="X-Powered-By" />
                <add name="X-Content-Type-Options" value="nosniff" />
                <add name="X-Frame-Options" value="DENY" />
                <add name="X-XSS-Protection" value="1; mode=block" />
                <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
                <add name="Permissions-Policy" value="camera=(), microphone=(), geolocation=()" />
                <add name="Content-Security-Policy" value="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" />
            </customHeaders>
        </httpProtocol>

        <directoryBrowse enabled="false" />

        <defaultDocument>
            <files>
                <clear />
                <add value="index.php" />
            </files>
        </defaultDocument>
    </system.webServer>
</configuration>