From dd67f3faff4ab3a7cab65a7bd039298418c7c7dd Mon Sep 17 00:00:00 2001
From: Alexis Saettler <alexis@saettler.org>
Date: Sun, 8 Jan 2023 23:21:08 +0100
Subject: [PATCH] ci: update htaccess (monicahq/chandler#388)

---
 public/.htaccess               | 11 +++++++++++
 public/security.txt            |  4 ++++
 resources/.htaccess_production | 19 +++++++++++++++----
 3 files changed, 30 insertions(+), 4 deletions(-)
 create mode 100644 public/security.txt

diff --git a/public/.htaccess b/public/.htaccess
index 3aec5e27e..71fe9dfe5 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -9,8 +9,19 @@
     RewriteCond %{HTTP:Authorization} .
     RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
 
+    # Redirect .well-known urls (https://en.wikipedia.org/wiki/List_of_/.well-known/_services_offered_by_webservers)
+    RewriteCond %{REQUEST_URI} .well-known/carddav
+    RewriteRule ^ /dav/ [L,R=301,N]
+
+    RewriteCond %{REQUEST_URI} .well-known/caldav
+    RewriteRule ^ /dav/ [L,R=301,N]
+
+    RewriteCond %{REQUEST_URI} .well-known/security.txt
+    RewriteRule ^ /security.txt [L,R=301,N]
+
     # Redirect Trailing Slashes If Not A Folder...
     RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteCond %{REQUEST_FILENAME} !dav/*
     RewriteCond %{REQUEST_URI} (.+)/$
     RewriteRule ^ %1 [L,R=301]
 
diff --git a/public/security.txt b/public/security.txt
new file mode 100644
index 000000000..cdaf79950
--- /dev/null
+++ b/public/security.txt
@@ -0,0 +1,4 @@
+# Our security address
+
+Contact: security@monicahq.com
+Disclosure: Full
diff --git a/resources/.htaccess_production b/resources/.htaccess_production
index e27122b23..e3d1f58a2 100644
--- a/resources/.htaccess_production
+++ b/resources/.htaccess_production
@@ -5,10 +5,6 @@
 
     RewriteEngine On
 
-    # Redirect to https
-    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
-    RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,N]
-
     <IfModule mod_headers.c>
         # Activate HSTS
         Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;"
@@ -27,12 +23,27 @@
         </filesMatch>
     </IfModule>
 
+    # Redirect to https
+    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+    RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,N]
+
     # Handle Authorization Header
     RewriteCond %{HTTP:Authorization} .
     RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
 
+    # Redirect .well-known urls (https://en.wikipedia.org/wiki/List_of_/.well-known/_services_offered_by_webservers)
+    RewriteCond %{REQUEST_URI} .well-known/carddav
+    RewriteRule ^ /dav/ [L,R=301,N]
+
+    RewriteCond %{REQUEST_URI} .well-known/caldav
+    RewriteRule ^ /dav/ [L,R=301,N]
+
+    RewriteCond %{REQUEST_URI} .well-known/security.txt
+    RewriteRule ^ /security.txt [L,R=301,N]
+
     # Redirect Trailing Slashes If Not A Folder...
     RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteCond %{REQUEST_FILENAME} !dav/*
     RewriteCond %{REQUEST_URI} (.+)/$
     RewriteRule ^ %1 [L,R=301]