# ------------------------------------------------------------------------
# INKRAH Web Design — Open Source Project for Journal Peer Review Portal
# Phone: +62 811-1345-777  |  Email: webmaster@inkrah.com  |  https://inkrah.com
# ------------------------------------------------------------------------

# AUREA JOURNAL PLATFORM — Apache hardening + clean URL routing
#
# Every page is reached through a clean English URL (/login, /journals,
# /articles/some-slug, etc.). The real PHP files stay hidden: they're
# blocked from direct HTTP access below, and are only ever loaded
# server-side (via require()) by the router, muwajjih.php.

# Never list directory contents
Options -Indexes

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Block direct access to internal/sensitive folders entirely.
  RewriteRule ^(nawat|iedad|data|taasis/mukhattat\.sql)(/.*)?$ - [F,L]

  # Block direct HTTP access to the underlying content files/folders — the
  # real file names must never be reachable directly, only through clean
  # routes. This does NOT affect the router, since it reads these files
  # via a plain server-side require(), not a new HTTP request.
  RewriteRule ^(majallat|majalla|maqal|haula|safha|sitemap|khata_404)\.php$ - [F,L]
  RewriteRule ^(hisab|kuttab|tahrir|idara|muraji3in|wasla)/ - [F,L]

  # Everything else that isn't a real file or directory goes through the router.
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^ muwajjih.php [L]
</IfModule>

# Deny access to dotfiles and the sqlite database directly
<FilesMatch "^\.">
  Require all denied
</FilesMatch>
<FilesMatch "\.sqlite$">
  Require all denied
</FilesMatch>

# Security headers (defence in depth; also set in PHP via Amn::ruus_amina)
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

php_flag display_errors off
