<IfModule mod_rewrite.c>
    RewriteEngine on

    # Pass Authorization header to PHP (required for PHP-FPM/CGI setups)
    RewriteCond %{HTTP:Authorization} .+
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # issue #20691: determine the base path dynamically from the request URI
    # instead of relying on Apache's implicit rewrite-base detection, which
    # can be wrong on shared hosting (e.g. IONOS) where suexec/mod_userdir
    # make the filesystem path diverge from the URL path
    RewriteCond %{REQUEST_URI}::$1 ^(.*?/)(.*)::\2$
    RewriteRule ^(.*)$ - [E=BASE:%1]

    # If the request is NOT for the editor folder"
    RewriteCond %{REQUEST_URI} !/editor/ [NC]
    # if a directory or a file exists, use it directly
    RewriteCond %{REQUEST_FILENAME} !-f
    # RewriteCond %{REQUEST_FILENAME} !-d

    # otherwise forward it to index.php
    RewriteRule ^ %{ENV:BASE}index.php

    # deny access to hidden files and directories except .well-known
    RewriteCond %{REQUEST_URI} !^/\.well-known
    RewriteRule ^(.*/)?\.+ - [F]

    # issue #19865
    RewriteRule ^setdebug.php - [F]

    # deny access to the runtime directory (cache files, application.log, plugin.log)
    # kept here so protection survives clearing the tmp directory content
    RewriteRule ^tmp/runtime/ - [F]

    # deny access to Composer dependencies: never requested directly, only used server-side
    RewriteRule ^vendor/ - [F]

    # deny access to the docs directory (release notes reveal the installed version)
    RewriteRule ^docs/ - [F]

    # issue #19297: deny access to development/build/fingerprinting files at the document root
    RewriteRule ^(composer\.(json|lock)|package\.json|yarn\.lock|gulpfile\.js|open-api-gen\.php|phpunit\.xml|psalm(-\w+)?\.xml|phpci\.yml|phpcs\.ruleset\.xml|publiccode\.yml|manifest\.yml|CONTRIBUTING\.md|README\.md|SECURITY\.md)$ - [F]
</IfModule>

# deny access to hidden files and directories without mod_rewrite
RedirectMatch 403 ^/(?!\.well-known/)(.*/)?\.+

# deny access to the runtime directory without mod_rewrite
RedirectMatch 403 ^/(.*/)?tmp/runtime/

# deny access to Composer dependencies without mod_rewrite
RedirectMatch 403 ^/vendor/

# deny access to the docs directory without mod_rewrite
RedirectMatch 403 ^/docs/

# issue #19297: deny access to development/build/fingerprinting files without mod_rewrite
RedirectMatch 403 ^/(composer\.(json|lock)|package\.json|yarn\.lock|gulpfile\.js|open-api-gen\.php|phpunit\.xml|psalm(-\w+)?\.xml|phpci\.yml|phpcs\.ruleset\.xml|publiccode\.yml|manifest\.yml|CONTRIBUTING\.md|README\.md|SECURITY\.md)$

# General setting to properly handle LimeSurvey paths
# AcceptPathInfo on

# XSS protection
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    <FilesMatch "\.(svgz?)$">
        Header set Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; style-src 'self' 'unsafe-inline'"
    </FilesMatch>
</IfModule>

# Disable Multiviews (issue #16859)
<IfModule mod_negotiation.c>
    Options -MultiViews
</IfModule>
