FM / scholar

/home/u764571690/domains/savitrfoundation.com/public_html/scholar/

/home/u764571690/domains/savitrfoundation.com/public_html/scholar

Name	Size	Mode	Actions
ajax/	-	0755	rm
assets/	-	0755	rm
bankverify/	-	0755	rm
pages/	-	0755	rm
sessions/	-	0755	rm
.htaccess	2440	0644	edit dl rm
admin_dashboard.php	461240	0644	edit dl rm
admin_login.php	5183	0644	edit dl rm
admin_logout.php	779	0644	edit dl rm
base_links_helper.php	11593	0644	edit dl rm
db.php	7908	0644	edit dl rm
index.php	748	0644	edit dl rm
manifest.json	477	0644	edit dl rm
student.php	18288	0644	edit dl rm
student_logout.php	1461	0644	edit dl rm

Edit: /home/u764571690/domains/savitrfoundation.com/public_html/scholar/.htaccess (2440B)

# Security configurations for Savitr Foundation Scholarship Application

# Prevent access to sensitive files

<Files "*.log">
    Order Deny,Allow
    Deny from all
</Files>

<Files ".env">
    Order Deny,Allow
    Deny from all
</Files>

# Prevent access to backup files
<FilesMatch "\.(bak|backup|old|tmp)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options SAMEORIGIN
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    # CSP temporarily disabled for development - uncomment and modify for production
    # Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://fonts.googleapis.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com data:; img-src 'self' data: https:; connect-src 'self';"
</IfModule>

# Disable server signature
ServerSignature Off

# Hide .htaccess files
<Files ".htaccess">
    Order Allow,Deny
    Deny from all
</Files>

# Prevent directory browsing
Options -Indexes

# Limit file upload size (adjust as needed)
php_value upload_max_filesize 10M
php_value post_max_size 12M
php_value max_execution_time 300
php_value max_input_time 300

# Enable error logging but hide errors from users
php_flag log_errors on
php_flag display_errors off
php_value error_log /tmp/php_errors.log

# URL Rewriting for extensionless URLs
RewriteEngine On
RewriteBase /scholar/

# Student login - just "student" will work
RewriteRule ^student/?$ student.php [L,QSA]

# Admin dashboard without extension
RewriteRule ^admin/?$ admin_dashboard.php [L,QSA]

# Admin login without extension
RewriteRule ^admin-login/?$ admin_login.php [L,QSA]

# Admin logout without extension
RewriteRule ^admin-logout/?$ admin_logout.php [L,QSA]

# Student logout without extension
RewriteRule ^student-logout/?$ student_logout.php [L,QSA]

# Export users without extension
RewriteRule ^export-users/?$ admin_export_users.php [L,QSA]

# Security configurations for Savitr Foundation Scholarship Application # Prevent access to sensitive files Order Deny,Allow Deny from all Order Deny,Allow Deny from all # Prevent access to backup files Order Deny,Allow Deny from all # Security headers Header always set X-Content-Type-Options nosniff Header always set X-Frame-Options SAMEORIGIN Header always set X-XSS-Protection "1; mode=block" Header always set Referrer-Policy "strict-origin-when-cross-origin" # CSP temporarily disabled for development - uncomment and modify for production # Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://fonts.googleapis.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com data:; img-src 'self' data: https:; connect-src 'self';" # Disable server signature ServerSignature Off # Hide .htaccess files Order Allow,Deny Deny from all # Prevent directory browsing Options -Indexes # Limit file upload size (adjust as needed) php_value upload_max_filesize 10M php_value post_max_size 12M php_value max_execution_time 300 php_value max_input_time 300 # Enable error logging but hide errors from users php_flag log_errors on php_flag display_errors off php_value error_log /tmp/php_errors.log # URL Rewriting for extensionless URLs RewriteEngine On RewriteBase /scholar/ # Student login - just "student" will work RewriteRule ^student/?$ student.php [L,QSA] # Pages without extension and without "pages" folder name RewriteRule ^(dashboard|personal|institute|bank|status|distributed|invite|ack|help|daily_quiz|leaderboard|tasks)/?$ pages/$1.php [L,QSA] # Admin dashboard without extension RewriteRule ^admin/?$ admin_dashboard.php [L,QSA] # Admin login without extension RewriteRule ^admin-login/?$ admin_login.php [L,QSA] # Admin logout without extension RewriteRule ^admin-logout/?$ admin_logout.php [L,QSA] # Student logout without extension RewriteRule ^student-logout/?$ student_logout.php [L,QSA] # Export users without extension RewriteRule ^export-users/?$ admin_export_users.php [L,QSA]