<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <defaultDocument>
            <files>
                <remove value="index.php" />
                <add value="index.php" />
            </files>
        </defaultDocument>
        <rewrite>
            <rules>
                <rule name="request_filename" stopProcessing="true">
                    <match url="." ignoreCase="false" />
                    <conditions logicalGrouping="MatchAll">
                        <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
                        <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
                    </conditions>
                    <action type="Rewrite" url="index.php" />
                </rule>
                <rule name="user_error_redirect" stopProcessing="true">
                    <match url="^(user)/(.*)\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$" ignoreCase="false" />
                    <action type="Redirect" url="error" redirectType="Permanent" />
                </rule>
                <rule name="ignore_folders" stopProcessing="true">
                    <match url="^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*)" ignoreCase="false" />
                    <action type="Redirect" url="error" redirectType="Permanent" />
                </rule>
                <rule name="user_sensitive_folders" stopProcessing="true">
                    <match url="^user/(config|env)/(.*)" ignoreCase="false" />
                    <action type="Redirect" url="error" redirectType="Permanent" />
                </rule>
                <!-- Block user/accounts too, but allow avatar images to be served
                     directly, whether stored at user/accounts/avatars/<file> (flatfile
                     accounts) or user/accounts/<username>/<file> (Flex folder storage).
                     SVG is intentionally excluded as a stored-XSS vector. -->
                <rule name="user_accounts" stopProcessing="true">
                    <match url="^user/accounts/(.*)" ignoreCase="false" />
                    <conditions>
                        <add input="{REQUEST_URI}" pattern="/user/accounts/[^/]+/[^/]+\.(jpe?g|png|gif|webp|avif|bmp|ico)$" negate="true" />
                    </conditions>
                    <action type="Redirect" url="error" redirectType="Permanent" />
                </rule>
                <!-- Block user/data too, but allow public media uploads (e.g. Flex Object
                     images) to be served directly. SVG is intentionally excluded as a
                     stored-XSS vector. -->
                <rule name="user_data" stopProcessing="true">
                    <match url="^user/data/(.*)" ignoreCase="false" />
                    <conditions>
                        <add input="{REQUEST_URI}" pattern="\.(jpe?g|png|gif|webp|avif|bmp|ico|mp4|webm|ogg|ogv|mov|mp3|wav|m4a|flac|pdf)$" negate="true" />
                    </conditions>
                    <action type="Redirect" url="error" redirectType="Permanent" />
                </rule>
                <rule name="dotenv" stopProcessing="true">
                    <match url="(^|/)\.env(\.|$)" ignoreCase="true" />
                    <action type="Redirect" url="error" redirectType="Permanent" />
                </rule>
                <rule name="system" stopProcessing="true">
                    <match url="^system/(.*)\.(txt|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|twig|sh|bat)$" ignoreCase="false" />
                    <action type="Redirect" url="error" redirectType="Permanent" />
                </rule>
                <rule name="vendor" stopProcessing="true">
                    <match url="^vendor/(.*)\.(txt|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|twig|sh|bat)$" ignoreCase="false" />
                    <action type="Redirect" url="error" redirectType="Permanent" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
    <system.web>
        <httpRuntime requestPathInvalidCharacters="&lt;,&gt;,*,%,&amp;,\,?" />
    </system.web>
</configuration>
