# START FKS
Options -Indexes

RewriteEngine on
RewriteBase /

# protect internal files: config, exports / backups, error log and include-only scripts
RewriteRule (^|/)\.(?!well-known/) - [F]
RewriteRule ^fokus-config\.php$ - [F]
RewriteRule ^content/export/ - [F]
RewriteRule ^(tests|docs|website/tools)/ - [F]
RewriteRule ^CLAUDE\.md$ - [F]
RewriteRule ^content/(dklassen|stklassen)/.*\.php$ - [F,NC]
RewriteRule ^fokus/(ajax-(?!dashboard/)[a-z]+|widgets|notifications)/ - [F]
RewriteRule ^inc/(classes\.[a-z]+|translations)/ - [F]
RewriteRule ^inc/(compat|header|update|badwords|index)\.php$ - [F]
# uploaded files are never executed
RewriteRule ^content/uploads/.*\.(php[0-9]?|phtml|phar|pht|phps|cgi|pl|py|sh|asp|aspx|jsp|shtml|htaccess)$ - [F,NC]

RewriteCond %{REQUEST_URI} ^/[^\.]+[^/]$
RewriteRule ^(.*)$ %{REQUEST_SCHEME}://%{HTTP_HOST}/$1/ [R=301,L]

RewriteRule ^test-mod-rewrite/$ inc/test.php

RewriteRule ^([a-z]{2})/$ index.php?lan=$1

RewriteRule ^([a-z]{2})/([0-9]+)/([0-9]+)/([^/]+)/([0-9]+)/$ index.php?lan=$1&id=$2&dk=$3&titel=$4&seite=$5
RewriteRule ^([a-z]{2})/([0-9]+)/([0-9]+)/([^/]+)/$ index.php?lan=$1&id=$2&dk=$3&titel=$4

RewriteRule ^([a-z]{2})/([0-9]+)/([^/]+)/([0-9]+)/$ index.php?lan=$1&id=$2&titel=$3&seite=$4
RewriteRule ^([a-z]{2})/([0-9]+)/([^/]+)/$ index.php?lan=$1&id=$2&titel=$3


RewriteRule ^([0-9]+)/([0-9]+)/([^/]+)/([0-9]+)/$ index.php?id=$1&dk=$2&titel=$3&seite=$4
RewriteRule ^([0-9]+)/([0-9]+)/([^/]+)/$ index.php?id=$1&dk=$2&titel=$3

RewriteRule ^([0-9]+)/([^/]+)/([0-9]+)/$ index.php?id=$1&titel=$2&seite=$3
RewriteRule ^([0-9]+)/([^/]+)/$ index.php?id=$1&titel=$2


RewriteRule ^([a-z]{2})/c/([^/]+)/$ index.php?lan=$1&cp=$2
RewriteRule ^([a-z]{2})/c/([^/]+)/([^/]+)/$ index.php?lan=$1&cp=$2&cp_vars=$3
RewriteRule ^c/([^/]+)/$ index.php?cp=$1
RewriteRule ^c/([^/]+)/([^/]+)/$ index.php?cp=$1&cp_vars=$2

RewriteRule ^([a-z]{2})/q/([^/]+)/$ index.php?lan=$1&fks_q=$2
RewriteRule ^q/([^/]+)/$ index.php?fks_q=$1

RewriteRule ^ajax/([^/]+)/$ inc/ajax.php?action=$1

RewriteRule ^static/([a-z]+)/([^/]+)/$ inc/static.php?type=$1&files=$2

RewriteRule ^feed/([0-9]+)/([^/]+)/$ inc/feed.php?id=$1&titel=$2

RewriteRule ^activate/([^/]+)/([^/]+)/$ index.php?fid=$1&acode=$2

RewriteRule ^img/([0-9]+).([0-9]+).([0-9]+).([^/]+)$ inc/img.php?id=$1&w=$2&h=$3&s=$4&titel=$5
RewriteRule ^files/([0-9]+)/([^/]+)$ inc/download.php?id=$1

RewriteRule ^sitemap.xml$ inc/sitemap.php
RewriteRule ^([a-z]{2})/sitemap.xml$ inc/sitemap.php?lan=$1

RewriteRule ^robots.txt$ inc/robots.txt


RewriteRule ^error/([0-9]+)/$ index.php?error=$1
ErrorDocument 403 /error/403/
ErrorDocument 404 /error/404/
ErrorDocument 500 /error/500/
ErrorDocument 503 /error/503/


<FilesMatch "^(fokus-config\.php|.*\.(fks|sql|bak|old|orig|log|sh|ini|dist)|fehler\.txt|installation\.txt)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Deny,Allow
        Deny from all
    </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
    Header always unset X-Powered-By
</IfModule>

AddDefaultCharset utf-8
# END FKS
