From 8612fc23d4d7ca90ea80e5a12e7bd51ed315e0dd Mon Sep 17 00:00:00 2001
From: Chris Smith <toonarmy@phpbb.com>
Date: Wed, 28 Apr 2010 19:20:54 +0100
Subject: [PATCH] [ticket/9520] New web.config file as suggested by Microsoft
 using request filter

PHPBB3-9520
---
 phpBB/web.config | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/phpBB/web.config b/phpBB/web.config
index 7f2b40ec1b..e374e611f6 100644
--- a/phpBB/web.config
+++ b/phpBB/web.config
@@ -1,17 +1,25 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <configuration>
 	<system.webServer>
-		<rewrite>
-			<rules>
-				<rule name="phpBB config.php Rule" patternSyntax="Wildcard" stopProcessing="true">
-					<match url="*config.php" />
-					<action type="AbortRequest" />
-				</rule>
-				<rule name="phpBB common.php Rule" patternSyntax="Wildcard" stopProcessing="true">
-					<match url="*common.php" />
-					<action type="AbortRequest" />
-				</rule>
-			</rules>
-		</rewrite>
+		<security>
+			<requestFiltering>
+				<hiddenSegments>
+					<add segment="cache" />
+					<add segment="files" />
+					<add segment="store" />­
+				</hiddenSegments>
+			</requestFiltering>
+		</security>
 	</system.webServer>
+	<location path="images/avatars">
+		<system.webServer>
+			<security>
+				<requestFiltering>
+					<hiddenSegments>
+						<add segment="upload" />
+					</hiddenSegments>
+				</requestFiltering>
+			</security>
+		</system.webServer>
+	</location>
 </configuration>