sbpt I tried the lab, but what htaccess rules should i use to fix these
You just have to uncomment the line 9-15 in the supplied file:
01 <IfModule mod_rewrite.c>
02 RewriteEngine on
03
04 # Ensure the Authorization HTTP header is available to PHP
05 RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
06
07 # Uncomment the following lines if you are not using a `public` directory
08 # to prevent sensitive resources from being exposed.
09 # RewriteRule /\.git / [F,L]
10 # RewriteRule ^auth\.json$ / [F,L]
11 # RewriteRule ^composer\.(lock|json)$ / [F,L]
12 # RewriteRule ^config.php$ / [F,L]
13 # RewriteRule ^flarum$ / [F,L]
14 # RewriteRule ^storage/(.*)?$ / [F,L]
15 # RewriteRule ^vendor/(.*)?$ / [F,L]
16
17 # Pass requests that don't refer directly to files in the filesystem to index.php
18 RewriteCond %{REQUEST_FILENAME} !-f
19 RewriteCond %{REQUEST_FILENAME} !-d
20 RewriteRule ^ index.php [QSA,L]
21 </IfModule>
config.php executes, so the sensitive data is inaccessible anyway (unless PHP isn't running) the rule is just to be extra cautious in case the server fails to load it as a PHP file.
