FormLogic v0.1.22

Before you update

• Updating by uploading files? Upload the hidden .htaccess too. This release's fix is in that file, and many FTP clients skip it. An in-app update brings it with the rest.
• Running on nginx? Add the two new location rules from the README's example to your server block, where the example has them. Without them nginx still serves the files listed below.
• A file in the web root ending in one of the endings below now answers 404. If you serve one there on purpose (a .zip people download, say), move it outside the web root or under /api/.

What's fixed

Files left in the web root were served. The web root's .htaccess refused .env and .ht* files and nothing else of the kind. A .git folder (/.git/config, anywhere in the tree), backup.sql, site.zip, backup.tar.gz, index.php.bak, config.old and .DS_Store were plain downloads wherever someone had left them. The README's nginx example had no rule for them either.

Both now answer 404 for:

• any dot folder or dot file, except .well-known
• files ending in .sql, .sql.gz, .db, .sqlite or .sqlite3 (with their -wal and -shm files), .zip, .tar, .tar.gz, .tgz, .7z, .rar, .bak, .old, .orig, .save or .swp, in any case

The rules run after /api/ has gone to the backend, so API routes are unchanged, and .well-known still reaches the backend and the certificate challenge.

Nothing else changed since v0.1.21.

Tested with

SoftN v0.0.31 (ZIPP v0.0.32) and OAIY v0.1.12. Checked on Apache with every such file planted (13 refused; the app, its routes, /api/, /manifest.json and .well-known unchanged) and with the README's block on a real nginx.