web.config

Rama develop · réplica de lectura del repositorio original.

<?xml version="1.0" encoding="UTF-8"?>
<!--
  InvoicePlane web.config for IIS 10+ (requires the URL Rewrite module).

  IIS ignores .htaccess, so this file carries the same refusals as the htaccess template and the
  hardened nginx configuration. Without it, archived invoice PDFs, customer files, import files,
  vendor/, application/ and the project files are served to anyone, without logging in.

  The rules are anchored at the start of the URL, so routes such as /index.php/import keep working.
  Windows collapses repeated slashes and ignores trailing dots and spaces in names, so the patterns
  accept them too: uploads//archive/x.pdf and uploads/archive./x.pdf are the same file as
  uploads/archive/x.pdf. Keep this file next to index.php, in the site root. The front controller is
  the one PHP file that stays reachable.
-->
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="Block private InvoicePlane folders" stopProcessing="true">
          <match url="^/*(application|vendor|storage|resources|node_modules|tests|uploads/+(archive|customer_files|import|temp))[. ]*(/|$)" ignoreCase="true" />
          <action type="CustomResponse" statusCode="404" statusReason="Not Found" statusDescription="Not Found" />
        </rule>
        <rule name="Block dotfiles and dot folders" stopProcessing="true">
          <match url="(^|/)\.(?!well-known/)" ignoreCase="true" />
          <action type="CustomResponse" statusCode="404" statusReason="Not Found" statusDescription="Not Found" />
        </rule>
        <rule name="Block InvoicePlane project files" stopProcessing="true">
          <match url="^/*(composer\.(json|lock)|package(-lock)?\.json|yarn\.lock|[^/]+\.md|phpcs\.xml|phpunit\.xml|phpstan[^/]*|pint\.json|rector\.php|Gruntfile\.js|(docker-)?compose\.yml|crowdin\.yml|Dockerfile|Makefile|playwright\.config\.js|htaccess|ipconfig\.php[^/]*|LICENSE\.txt)[. ]*$" ignoreCase="true" />
          <action type="CustomResponse" statusCode="404" statusReason="Not Found" statusDescription="Not Found" />
        </rule>
        <rule name="Block PHP files other than the front controller" stopProcessing="true">
          <match url="^/*(?!index\.php(/|$)).*\.php[. ]*(/|$)" ignoreCase="true" />
          <action type="CustomResponse" statusCode="404" statusReason="Not Found" statusDescription="Not Found" />
        </rule>
        <rule name="Keep front controller URLs" stopProcessing="true">
          <match url="^/*index\.php(/|$)" ignoreCase="true" />
          <action type="None" />
        </rule>
        <!--
          Clean URLs (REMOVE_INDEXPHP=true in ipconfig.php): switch this rule on by setting enabled="true" so that
          /sessions/login reaches the front controller. It stays off by default because REMOVE_INDEXPHP=false is the
          default and then every URL carries index.php. Requests for files and folders that exist are served as they
          are. With clean URLs also add index.php as the default document of the site, because
          a request for "/" is a folder and is not routed.
        -->
        <rule name="Route clean URLs to the front controller (REMOVE_INDEXPHP=true)" enabled="false" stopProcessing="true">
          <match url="^(.*)$" />
          <conditions logicalGrouping="MatchAll">
            <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
          </conditions>
          <action type="Rewrite" url="index.php/{R:1}" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>