# The application answers the document root, not a static file.
#
# Apache's default DirectoryIndex lists index.html before index.php, and this
# script shipped a leftover mock-up called index.html beside the front
# controller -- so the domain's front door served a dead demo page. The
# packager no longer carries that file; this makes sure nothing else can take
# its place.
<IfModule mod_dir.c>
    DirectoryIndex index.php
</IfModule>

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# Deny by PATH, not by filename.
#
# Everything below used to be protected only by <FilesMatch>, which Apache
# evaluates against the BASENAME of the request. So .env was denied because its
# name begins with a dot -- but /storage/logs/laravel.log matched nothing at
# all, and was served in full: stack traces, request payloads, email addresses.
# /config/database.php, /app/Models/User.php and /routes/web.php went the same
# way. The front controller never saw those requests, because Apache serves a
# file that exists before rewriting to index.php.
#
# These rules are path-based and run before the front-controller rule, so a
# real file inside an application directory is refused rather than returned.
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Any dot-prefixed segment, at any depth: .env, .env.backup, .git/config.
    RewriteRule (^|/)\. - [F,L]

    # Application source and data.
    #
    # docs/ is in here deliberately. The offline documentation is meant to be
    # opened from a file manager when the site will not start, not fetched over
    # HTTP -- and it describes the installer, the cron endpoint and the admin
    # path, which is a roadmap there is no reason to publish. The same text is
    # available signed in, under Settings.
    RewriteRule ^(app|bootstrap|config|database|docs|resources|routes|tests|vendor)/ - [F,L]

    # storage/ is private EXCEPT storage/app/public, which is where uploaded
    # logos, KYC documents and payment proofs are served from by design.
    RewriteRule ^storage/(?!app/public/) - [F,L]
</IfModule>

# The mod_rewrite section above was never closed, and an empty mime_module
# section was opened and never closed either. Apache rejects a
# configuration with an unterminated section, which would take the whole site
# down with a 500; this server's LiteSpeed happens to tolerate it, so the fault
# has been invisible rather than absent.

# Everything below is denied twice over, because the two Apache generations
# spell it differently. Writing only the 2.2 form -- which is what this file
# had -- means that on an Apache 2.4 server without mod_access_compat the
# directives are unrecognised, and the request is then ALLOWED rather than
# denied. Each block is guarded so exactly one of them applies.
<FilesMatch "^(\.|composer\.|artisan$|server\.php$|phpunit\.xml$|error_log$|package(-lock)?\.json$)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

Options -Indexes

# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php8_module>
   php_flag display_errors Off
   php_value max_execution_time 30
   php_value max_input_time 60
   php_value max_input_vars 3000
   php_value memory_limit 512M
   php_value post_max_size 64M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php82"
   php_value upload_max_filesize 64M
   php_flag zlib.output_compression Off
</IfModule>
<IfModule lsapi_module>
   php_flag display_errors Off
   php_value max_execution_time 30
   php_value max_input_time 60
   php_value max_input_vars 3000
   php_value memory_limit 512M
   php_value post_max_size 64M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php82"
   php_value upload_max_filesize 64M
   php_flag zlib.output_compression Off
</IfModule>
# END cPanel-generated php ini directives, do not edit


<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>
