# Helicon ISAPI_Rewrite configuration file
# Version 3.1.0.87
<ifModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
</ifModule>
RewriteRule ^(.*)\.html $1\.php
RewriteRule ^account/logout(|/)$ logout.php
RewriteRule ^articles(|/)$ articles.php
RewriteRule ^articles/(.*)$ ./articles.php?web-articles-id=$1
RewriteRule ^captcha(|/)$ error.php
RewriteRule ^captcha/monofont.ttf(|/)$ error.php
RewriteRule ^captcha/php-captcha.inc.php(|/)$ error.php
RewriteRule ^client(|/)$ client.php
RewriteRule ^clientutils(|/)$ clientutils.php
RewriteRule ^community(|/)$ community.php
RewriteRule ^community/staff(|/)$ staff.php
RewriteRule ^community/vip(|/)$ vip.php
RewriteRule ^community/xler(|/)$ xler.php
RewriteRule ^community/topstats(|/)$ topstats.php
RewriteRule ^credits(|/)$ credits.php
RewriteRule ^credits/getcredits(|/)$ getcredits.php
RewriteRule ^credits/habboclub(|/)$ club.php
RewriteRule ^credits/pixels(|/)$ pixel.php
RewriteRule ^credits/shop(|/)$ marktplatz.php
RewriteRule ^credits/shop/vip(|/)$ shop.php
RewriteRule ^credits/transactions(|/)$ ./transactions.php
RewriteRule ^data_classes(|/)$ error.php
RewriteRule ^data_classes/server-data.php_data_classes-config.php(|/)$ error.php
RewriteRule ^data_classes/server-data.php_data_classes-core.php(|/)$ error.php
RewriteRule ^data_classes/server-data.php_data_classes-mus.php(|/)$ error.php
RewriteRule ^data_classes/server-data.php_data_classes-news.php(|/)$ error.php
RewriteRule ^data_classes/server-data.php_data_classes-session.php(|/)$ error.php
RewriteRule ^forgot(|/)$ forgot.php
RewriteRule ^groupsdata/(..*)$ ./groups.php?web-group-id=$1
RewriteRule ^help(|/)$ help.php
RewriteRule ^help/(..*)$ ./help.php?web-faq-id=$1
RewriteRule ^habblet/(|/)$ error.php
RewriteRule ^habblet/cproxy?habbletKey=news$ client_news.php
RewriteRule ^home(|/)$ home.php
RewriteRule ^home/(..*)$ ./home.php?web-home-name=$1
RewriteRule ^index(|/)$ index.php
RewriteRule ^phpmyadmin(|/)$ index.php
RewriteRule ^maintenance(|/)$ maintenance.php
RewriteRule ^me(|/)$ me.php
RewriteRule ^myhabbo/rating/rate(|/)$ ./myhabbo/rating_rate.php
RewriteRule ^myhabbo/rating/reset_ratings(|/)$ ./myhabbo/rating_reset_ratings.php
RewriteRule ^rd/([^/]+)(|/)$ ./rd.php?id=$1
RewriteRule ^quickregister/back(|/)$ /register.php?stap=7
RewriteRule ^quickregister/cancel(|/)$ /register.php?cancal
RewriteRule ^quickregister/backToAccountDetails(|/)$ /register.php?stap=8
RewriteRule ^quickregister/start(|/)$ /register.php?stap=1
RewriteRule ^quickregister/start/error/([^/]+)(|/)$ /register.php?stap=1&errors=$1
RewriteRule ^quickregister/age_gate_submit(|/)$ /register.php?stap=2
RewriteRule ^quickregister/email_password(|/)$ /register.php?stap=3
RewriteRule ^quickregister/email_password/error/([^/]+)(|/)$ /register.php?stap=3&errors=$1
RewriteRule ^quickregister/email_password_submit(|/)$ /register.php?stap=4
RewriteRule ^quickregister/captcha(|/)$ /register.php?stap=5
RewriteRule ^quickregister/captcha/error/([^/]+)(|/)$ /register.php?stap=5&errors=$1
RewriteRule ^quickregister/captcha_submit(|/)$ /register.php?stap=6
RewriteRule ^quickregister/refresh_avatars(|/)$ /register.php?stap=9
RewriteRule ^papers/disclaimer(|/)$ disclaimer.php
RewriteRule ^papers/privacy(|/)$ privacy.php
RewriteRule ^profile(|/)$ profile.php
RewriteRule ^profile/([^/]+)(|/)$ ./profile.php?web-profile-tab=$1
RewriteRule ^tag(|/)$ ./tag.php
RewriteRule ^tag/([^/]+)(|/)$ ./tag.php?tag=$1
RewriteRule ^xml(|/)$ ./error.php
RewriteRule ^xml/badge_data.xml(|/)$ error.php
RewriteRule ^xml/badge_data_xml.xml(|/)$ error.php
RewriteRule ^xml/badge_editor.xml(|/)$ error.php
RewriteRule ^/register(|/)$ /quickregister/start
RewriteRule ^/quickregister/start/complete(|/)$ /me?do=welcome-to-HabboRE-v3.0
RewriteRule ^account/disconnected?reason=logout&origin=popup(|/)$ clientutils.php1
RewriteRule ^quickregister/back(|/)$ /register.php?stap=7
RewriteRule ^quickregister/cancel(|/)$ /register.php?cancal
RewriteRule ^quickregister/backToAccountDetails(|/)$ /register.php?stap=8
RewriteRule ^quickregister/start(|/)$ /register.php?stap=1
RewriteRule ^quickregister/start/error/([^/]+)(|/)$ /register.php?stap=1&errors=$1
RewriteRule ^quickregister/age_gate_submit(|/)$ /register.php?stap=2
RewriteRule ^quickregister/email_password(|/)$ /register.php?stap=3
RewriteRule ^quickregister/email_password/error/([^/]+)(|/)$ /register.php?stap=3&errors=$1
RewriteRule ^quickregister/email_password_submit(|/)$ /register.php?stap=4
RewriteRule ^quickregister/captcha(|/)$ /register.php?stap=5
RewriteRule ^quickregister/captcha/error/([^/]+)(|/)$ /register.php?stap=5&errors=$1
RewriteRule ^quickregister/captcha_submit(|/)$ /register.php?stap=6
RewriteRule ^quickregister/refresh_avatars(|/)$ /register.php?stap=9
RewriteRule ^r=(.*)$ /refer.php?r=$1
RewriteRule ^refer/(.*)$ /refer.php?r=$1
RewriteRule ^referidos/(.*)$ /referidos.php?n=$1
RewriteEngine on
RewriteRule ^(.*)/(.*)$ island.php?habbo=$1&hotel=$2 [L]
## Seguridad extra para PHP
php_flag safe_mode on
php_flag expose_php on
php_flag display_errors on
RewriteEngine On
Options +FollowSymLinks
# Evitar escaneos y cualquier intento de manipulación malintencionada
# de la URL. Con esta regla es imposible lanzar ataques de inyección (SQL, XSS, etc)
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^(-|\.|') [OR]
RewriteCond %{HTTP_USER_AGENT} ^(.*)(<|>|%3C|%3E)(.*) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget)(.*) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^(.*)(libwww-perl|libwwwperl|snoopy|curl|wget|winhttp|python|nikto|scan|clshttp|archiver|loader|email|harvest|fetch|extract|grab|miner|suck|reaper|leach)(.*) [NC,OR]
RewriteCond %{REQUEST_URI} ^(/,|/;|/<|/>|/'|/`|/%2C|/%3C|/%3E|/%27|/////) [NC,OR]
RewriteCond %{HTTP_REFERER} ^(.*)(%00|%08|%09|%0A|%0B|%0C|%0D|%0E|%0F|%2C|<|>|'|%3C|%3E|%26%23|%27|%60)(.*) [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)(%00|%08|%09|%0A|%0B|%0C|%0D|%0E|%0F|%2C|%3C|%3E|%27|%26%23|%60)(.*) [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)('|-|<|>|,|/|\\|\.a|\.c|\.t|\.d|\.p|\.i|\.e|\.j)(.*) [NC,OR]
RewriteCond %{HTTP_COOKIE} ^(.*)(<|>|'|%3C|%3E|%27)(.*) [NC]
RewriteRule ^(.*)$ error.php [NC]
## No permitir acceso al .htaccess
order allow,deny
allow from all
## Evitar que se liste el contenido de los directorios
Options All -Indexes
## Lo mismo que lo anterior
IndexIgnore *
## Denegar el acceso a robots dañinos, browsers offline, etc
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} ^Anarchie [OR]
RewriteCond %{HTTP_USER_AGENT} ^ASPSeek [OR]
RewriteCond %{HTTP_USER_AGENT} ^attach [OR]
RewriteCond %{HTTP_USER_AGENT} ^autoemailspider [OR]
RewriteCond %{HTTP_USER_AGENT} ^Xaldon\ WebSpider [OR]
RewriteCond %{HTTP_USER_AGENT} ^Xenu [OR]
RewriteCond %{HTTP_USER_AGENT} ^Zeus.*Webster [OR]
RewriteCond %{HTTP_USER_AGENT} ^Zeus
##redireccionar a los robots a Scripters, que se jodan ellos xD
RewriteRule ^.*$
Holoscripter - Índice de subforos [R,L]
# Protegerse contra los ataques DOS limitando el tamaño de subida de archivos
LimitRequestBody 10240000
