问题描述

使用宝塔nginx+php8.1 添加域名如aa.com，设置php版本为纯静态,运行start后一切都正常，
当在根目录（start.php同级）添加一个a.php文件后，浏览器访问aa.com/a.php 会变下载a.php的源码,
甚至访问start.php文件都会直接下载源码，
访问aa.com/.env 也会直接吧.env下载下来，
如何设置不让下载？？而是访问403呢？
设置网站根目录到/public后也是一样，能访问public中的php文件直接下载，和程序根目录的start.php中的文件

去掉下面代理nginx的配置后，访问/public目录下文件，正常执行单个php文件

NG配置

location ^~ / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        #proxy_buffering off;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        if (!-f $request_filename){
            proxy_pass http://127.0.0.1:16661;
        }
    }

config/static.php

return [
    'enable' => true,
    'middleware' => [     // Static file Middleware
        app\middleware\StaticFile::class,
    ],
];

config/middleware.php

return [
    '' => [
        app\middleware\StaticFile::class,
    ]
];

app\middleware\StaticFile.php

<?php
/**
 * This file is part of webman.
 *
 * Licensed under The MIT License
 * For full copyright and license information, please see the MIT-LICENSE.txt
 * Redistributions of files must retain the above copyright notice.
 *
 * @author    walkor<walkor@workerman.net>
 * @copyright walkor<walkor@workerman.net>
 * @link      http://www.workerman.net/
 * @license   http://www.opensource.org/licenses/mit-license.php MIT License
 */

namespace app\middleware;

use Webman\MiddlewareInterface;
use Webman\Http\Response;
use Webman\Http\Request;

/**
 * Class StaticFile
 * @package app\middleware
 */
class StaticFile implements MiddlewareInterface
{
    public function process(Request $request, callable $next): Response
    {
        // Access to files beginning with. Is prohibited
        if (strpos($request->path(), '/.') !== false) {
            return response('<h1>403 forbidden</h1>', 403);
        }
        /** @var Response $response */
        $response = $next($request);
        // Add cross domain HTTP header
        /*$response->withHeaders([
            'Access-Control-Allow-Origin'      => '*',
            'Access-Control-Allow-Credentials' => 'true',
        ]);*/
        return $response;
    }
}

config/app.php

<?php

use support\Request;

return [
    'debug' => getenv('DEBUG')?:false,
    'error_reporting' => E_ALL,
    'default_timezone' => 'Asia/Shanghai',
    'request_class' => Request::class,
    'public_path' => base_path() . DIRECTORY_SEPARATOR . 'public',
    'runtime_path' => base_path(false) . DIRECTORY_SEPARATOR . 'runtime',
    'controller_suffix' => 'Controller',
    'controller_reuse' => false,
];