# Bot filtering is handled in PHP (includes/php/antibot_guard.php) so that
# blocked visitors get a branded 404 instead of an Apache 403 page, and so
# borderline UAs can be challenged instead of refused.
#
# This file only does the things PHP cannot: deny direct access to internals.

Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On

    # The two AJAX endpoints the browser polls. Everything else under
    # includes/ is require_once'd by PHP and must not be reachable directly.
    RewriteCond %{REQUEST_URI} !/includes/(process_request|process_data)\.php$
    RewriteRule ^includes/ - [F,L]

    # Panel internals (transport, config, session state, logs).
    RewriteRule ^panel/ - [F,L]
</IfModule>

# config.json is read by PHP only.
<Files "config.json">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</Files>

# Never serve a session/log file even if a rewrite above is missing.
# robots.txt is the exception.
<FilesMatch "\.(log|txt)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</FilesMatch>

<Files "robots.txt">
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
</Files>
