SWAMPy

✎ CARVE FLESH

EDITING: .htaccess

# Flora and Creations — API front controller
# Place this file at: api/.htaccess
#
# Routes every request under /api/* to index.php, which hands off to
# Router.php (see Router::dispatch() — it reads $_SERVER['REQUEST_URI']
# directly and strips the "/api" prefix itself, so no PATH_INFO or
# query-string rewriting is needed here).
#
# Real files/directories (e.g. assets/uploads/products/*.jpg served
# directly by Apache) are left alone — only requests that don't match
# an existing file or directory fall through to index.php.

<IfModule mod_rewrite.c>
    RewriteEngine On

# If this file were ever accessed outside an /api/ alias, keep the
    # base pinned to this directory.
    RewriteBase /

# Let real files and directories (uploaded images, etc.) be served
    # as-is instead of being routed through PHP.
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

# Everything else goes through the front controller.
    RewriteRule ^ index.php [L]
</IfModule>

# ---------------------------------------------------------------------
# Security hardening
# ---------------------------------------------------------------------

# Never serve the DB credentials file directly, however it's requested.
<FilesMatch "^config\.php$">
    Require all denied
</FilesMatch>

# Block direct access to source PHP classes — only index.php should be
# hit directly; everything else is loaded via the autoloader.
<FilesMatch "\.(php)$">
    <If "%{REQUEST_URI} !~ m#^/(api/)?index\.php$#">
        Require all denied
    </If>
</FilesMatch>
<IfModule !mod_authz_core.c>
    # Apache 2.2 fallback for the block above
    <FilesMatch "\.(php)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
    <Files "index.php">
        Order allow,deny
        Allow from all
    </Files>
</IfModule>

# Turn off directory listing.
Options -Indexes

# Don't let uploaded files be executed as scripts.
<IfModule mod_php.c>
    <Directory "assets/uploads">
        php_flag engine off
    </Directory>
</IfModule>
<FilesMatch "\.(php|phtml|php3|php4|php5|phar)$">
    <If "%{REQUEST_URI} =~ m#^/(api/)?assets/uploads/#">
        Require all denied
    </If>
</FilesMatch>

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📁 assets/	DIR	—	2026-11-04 13:32
📁 Controllers/	DIR	—	2026-07-15 09:38
📁 database/	DIR	—	2026-11-04 12:42
📁 Middleware/	DIR	—	2026-07-15 09:38
📁 Routes/	DIR	—	2026-07-15 12:04
📁 Utils/	DIR	—	2026-07-15 15:08
📄 .htaccess	HTACCESS	2.3 KB	2026-07-15 09:52	EDIT
📄 Auth.php	PHP	3.4 KB	2026-07-15 09:17	EDIT
📄 Database.php	PHP	814 B	2026-07-15 09:17	EDIT
📄 error_log	?	7.6 KB	2026-11-04 13:10	EDIT
📄 index.php	PHP	1.9 KB	2026-07-15 09:17	EDIT
📄 Router.php	PHP	5 KB	2026-07-15 09:17	EDIT
📄 uploads.zip	ZIP	38.5 MB	2026-11-04 13:31	EDIT