start

public/..htaccess

@@ -0,0 +1,32 @@
+# -------------------------------------------------
+# Apache Front Controller Setup (public/.htaccess)
+# -------------------------------------------------
+
+RewriteEngine On
+
+# Sicherheit: keine Directory Listings
+Options -Indexes
+
+# -------------------------------------------------
+# 1) Assets DIREKT ausliefern
+# -------------------------------------------------
+RewriteRule ^assets/ - [L]
+
+# -------------------------------------------------
+# 2) page/ von außen sperren (nur intern per require nutzbar)
+# -------------------------------------------------
+RewriteRule ^page/ - [F,L]
+
+# -------------------------------------------------
+# 3) Alles andere an den Front Controller
+# -------------------------------------------------
+RewriteRule ^ index.php [L]
+
+# -------------------------------------------------
+# 4) (Optional) Zusätzliche Sicherheits-Header
+# -------------------------------------------------
+<IfModule mod_headers.c>
+    Header set X-Frame-Options "SAMEORIGIN"
+    Header set X-Content-Type-Options "nosniff"
+    Header set Referrer-Policy "strict-origin-when-cross-origin"
+</IfModule>

public/assets/app.css

@@ -0,0 +1 @@
+/* minimal css placeholder */

public/assets/app.js

@@ -0,0 +1 @@
+console.log('mini example loaded');

public/index.php

@@ -0,0 +1,40 @@
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/fileload.php';
+
+$uriPath = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?: '/';
+$uriPath = preg_replace('~/{2,}~', '/', $uriPath);
+$uriPath = trim($uriPath, '/');
+
+// Sicherheitscheck
+if (str_contains($uriPath, '..')) {
+    http_response_code(400);
+    exit('Bad request');
+}
+
+// Root → page/index.php
+if ($uriPath === '' || $uriPath === 'index' || $uriPath === 'index.php') {
+    $target = __DIR__ . '/page/index.php';
+} else {
+    $base = __DIR__ . '/page/' . $uriPath;
+
+    // 1) Verzeichnis mit index.php
+    if (is_dir($base) && is_file($base . '/index.php')) {
+        $target = $base . '/index.php';
+    }
+    // 2) Datei
+    elseif (is_file($base . '.php')) {
+        $target = $base . '.php';
+    }
+    // 3) 404
+    else {
+        http_response_code(404);
+        $target = __DIR__ . '/page/404.php';
+    }
+}
+
+// Zentrale Ausgabe
+tpl('layout_start', 'structure');
+require $target;
+tpl('layout_end', 'structure');

public/page/index.php

@@ -0,0 +1,3 @@
+<?php
+
+echo "Hello, World!";