From daaedeed7ea1f7447ac46f2b52c1249fc35608ae Mon Sep 17 00:00:00 2001
From: Pig Fang <g-plane@hotmail.com>
Date: Thu, 16 Aug 2018 18:01:16 +0800
Subject: [PATCH] Update URI processing of web servers

---
 .htaccess  | 28 +++++++++++++++----
 web.config | 81 +++++++++++++++++++++++++++++++-----------------------
 2 files changed, 69 insertions(+), 40 deletions(-)

diff --git a/.htaccess b/.htaccess
index d01bce0a..62dcb4d6 100644
--- a/.htaccess
+++ b/.htaccess
@@ -1,10 +1,26 @@
-RewriteEngine On
+<IfModule mod_rewrite.c>
+    <IfModule mod_negotiation.c>
+        Options -MultiViews -Indexes
+    </IfModule>
 
-RewriteBase /
+    RewriteEngine On
 
-RewriteRule (^\.|/\.) - [F]
+    # You may need to uncomment the following line for some hosting environments,
+    # if you have installed to a subdirectory, enter the name here also.
+    #
+    # RewriteBase /
 
-RewriteCond %{REQUEST_FILENAME} !-f
-RewriteCond %{REQUEST_FILENAME} !-d
+    # Black list protected files
+    RewriteRule (^\.|/\.) - [F]
+    RewriteRule ^storage/.* - [F]
 
-RewriteRule ^.*$ index.php [L]
+    # Redirect trailing slashes if not a folder
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteCond %{REQUEST_URI} (.+)/$
+    RewriteRule ^ %1 [L,R=301]
+
+    # Handle front controller
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteRule ^ index.php [L]
+</IfModule>
diff --git a/web.config b/web.config
index 5ec190f5..c25037d0 100644
--- a/web.config
+++ b/web.config
@@ -1,34 +1,47 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<configuration>
-  <system.webServer>
-    <staticContent>
-      <mimeMap fileExtension="." mimeType="image/png" />
-      <remove fileExtension=".woff"/>
-      <mimeMap fileExtension=".woff" mimeType="application/x-font-woff" />
-      <remove fileExtension=".woff2"/>
-      <mimeMap fileExtension=".woff2" mimeType="application/x-font-woff2" />
-    </staticContent>
-    <!-- For rewrite to work install URL Rewrite Module via Web Platform Installer -->
-    <rewrite>
-      <rules>
-        <rule name="bss" patternSyntax="Wildcard">
-          <match url="*" />
-          <conditions>
-            <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
-            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
-          </conditions>
-          <action type="Rewrite" url="index.php" />
-        </rule>
-      </rules>
-    </rewrite>
-  </system.webServer>
-
-  <!-- Protect .env file -->
-  <location path="~/.env">
-    <system.web>
-      <authorization>
-        <deny users="*"/>
-      </authorization>
-    </system.web>
-  </location>
-</configuration>
+	<configuration>
+	  <system.webServer>
+	    <defaultDocument>
+	      <files>
+	        <clear />
+	        <add value="index.php" />
+	        <add value="index.html" />
+	      </files>
+	    </defaultDocument>
+	    <!-- Fix webfont issue on IIS -->
+	    <staticContent>
+	      <mimeMap fileExtension="." mimeType="image/png" />
+	      <remove fileExtension=".woff"/>
+	      <mimeMap fileExtension=".woff" mimeType="application/x-font-woff" />
+	      <remove fileExtension=".woff2"/>
+	      <mimeMap fileExtension=".woff2" mimeType="application/x-font-woff2" />
+	    </staticContent>
+	    <!-- For rewrite to work please install IIS URL Rewrite Module -->
+	    <rewrite>
+	      <rules>
+	        <rule name="Block access to dotfiles">
+	          <match url="(^\.|/\.)" ignoreCase="false" />
+	          <action type="CustomResponse" statusCode="403" statusReason="Forbidden" />
+	        </rule>
+	        <rule name="Block access to storage path">
+	          <match url="^storage/.*" ignoreCase="false" />
+	          <action type="CustomResponse" statusCode="403" statusReason="Forbidden" />
+	        </rule>
+	        <rule name="Redirect trailing slashes if not a folder" stopProcessing="true">
+	          <match url="^(.*)/$" ignoreCase="false" />
+	          <conditions>
+	            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
+	          </conditions>
+	          <action type="Redirect" redirectType="Permanent" url="/{R:1}" />
+	        </rule>
+	        <rule name="Handle front controller" stopProcessing="true">
+	          <match url="^" ignoreCase="false" />
+	          <conditions>
+	            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
+	            <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
+	          </conditions>
+	          <action type="Rewrite" url="index.php" />
+	        </rule>
+	      </rules>
+	    </rewrite>
+	  </system.webServer>
+	</configuration>