EZP-31519: Moved app.php rejection snippet from front controller to ezpublish-kernel

[webhdx]

JIRA: https://jira.ez.no/browse/EZP-31519

I've changed the rule in vhost.template files in order to unify logic in both places. This way we can block some requests on httpd level.

Rejection logic has been moved to: ezsystems/ezpublish-kernel#3010

[mnocon]

On nginx/apache this regex blocks paths like:

http://example.com/app.php
http://example.com/TestFolder1/app.php

(where TestFolder1 and TestFolder2 are existing Content Items)

But fails to block (homepage is displayed instead):

http://example.com/TestFolder1/TestFolder2/app.php
http://example.com/app.phprandom

Writing it here as I'm not sure what's supposed to be blocked, maybe this kind of URLs should be rejected as well.

[glye]

As I recall, this is as intended. The point is to block all direct access to app.php, while not blocking content named *app.php*. If in doubt, better to block too much than too little.

[webhdx]

I just moved the logic from EZP-30716. If this should be changed then we need new ticket and this should be done after 3.0 release as this is the highest priority at the moment. I need this to be merged in order to merge it up to 2.5 and master.

ping @lserwatka

EDIT: Let's hold on for a moment. I haven't notice reported issues in ezsystems/ezpublish-kernel#3010

[webhdx]

@mnocon Can I get final approval from you? We need to merge it.