CMS Made Simple Forums

Code: Select all

php_flag magic_quotes_gpc Off
php_flag register_globals Off
php_flag session.use_trans_sid Off

# Turns off directory browsing
# not absolutely essential, but keeps people from snooping around without 
# needing empty index.html files everywhere
Options -Indexes

# Deny access to config.php
# This can be useful if php ever breaks or dies
# Use with caution, this may break other functions of CMSms that use a config.php
# file.  This may also break other programs you have running under your CMSms
# install that use config.php.  You may need to add another .htaccess file to those
# directories to specifically allow config.php.
<Files "config.php">
	order allow,deny
	deny from all
</Files>

# No sense advertising what we are running
ServerSignature Off


# Make sure you have Options FollowSymLinks
# and Allow on
#Options +FollowSymLinks
RewriteEngine On

# Might be needed in a subdirectory
#RewriteBase /

# URL Filtering helps stop some hack attempts
#IF the URI contains a "http:"
RewriteCond %{QUERY_STRING} http\: [OR]
#OR if the URI contains a "["
RewriteCond %{QUERY_STRING} \[ [OR]
#OR if the URI contains a "]"
RewriteCond %{QUERY_STRING} \] [OR]
#OR if the URI contains a "<__script__>"
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
#OR script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
#OR any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
#IF the URI contains UNION
RewriteCond %{QUERY_STRING} UNION [OR]
#OR if the URI contains a *
RewriteCond %{QUERY_STRING} \*
#then deny the request (403)
RewriteRule ^.*$ - [F,L]
# End URL Filtering


# CMSMS Rewriting
# Set assume mod_rewrite to true in config.php and clear CMSMS cache
RewriteCond %{REQUEST_FILENAME} !-f [NC]
RewriteCond %{REQUEST_FILENAME} !-d [NC]
RewriteRule ^(.+)$ index.php?page=$1 [QSA]
# END CMSMS
# END Rewrite rules

Code: Select all

#Show mod_rewrite URLs in the menu? You must enable 'use_hierarchy' for this to work for modules
$config['assume_mod_rewrite'] = true;

#Extension to use if you're using mod_rewrite for pretty URLs.
$config['page_extension'] = '.html';

#If you don't use mod_rewrite, then would you like to use the built-in
#pretty url mechanism?  This will not work with IIS and the {metadata} tag
#should be in all of your templates before enabling.
$config['internal_pretty_urls'] = false;

#If you're using the internal pretty url mechanism or mod_rewrite, would you like to
#show urls in their hierarchy?  (ex. http://www.mysite.com/parent/parent/childpage)
$config['use_hierarchy'] = true;

#If using none of the above options, what should we be using for the query string
#variable?  (ex. http://www.mysite.com/index.php?page=somecontent)
$config['query_var'] = 'page';