問題描述

使用寶塔nginx+php8.1 添加域名如aa.com，設(shè)置php版本為純靜態(tài),運(yùn)行start后一切都正常，
當(dāng)在根目錄（start.php同級(jí)）添加一個(gè)a.php文件后，瀏覽器訪問aa.com/a.php 會(huì)變下載a.php的源碼,
甚至訪問start.php文件都會(huì)直接下載源碼，
訪問aa.com/.env 也會(huì)直接吧.env下載下來，
如何設(shè)置不讓下載？？而是訪問403呢？
設(shè)置網(wǎng)站根目錄到/public后也是一樣，能訪問public中的php文件直接下載，和程序根目錄的start.php中的文件

去掉下面代理nginx的配置后，訪問/public目錄下文件，正常執(zhí)行單個(gè)php文件

NG配置

location ^~ / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        #proxy_buffering off;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        if (!-f $request_filename){
            proxy_pass http://127.0.0.1:16661;
        }
    }

config/static.php

return [
    'enable' => true,
    'middleware' => [     // Static file Middleware
        app\middleware\StaticFile::class,
    ],
];

config/middleware.php

return [
    '' => [
        app\middleware\StaticFile::class,
    ]
];

app\middleware\StaticFile.php

<?php
/**
 * This file is part of webman.
 *
 * Licensed under The MIT License
 * For full copyright and license information, please see the MIT-LICENSE.txt
 * Redistributions of files must retain the above copyright notice.
 *
 * @author    walkor<walkor@workerman.net>
 * @copyright walkor<walkor@workerman.net>
 * @link      http://www.wtbis.cn/
 * @license   http://www.opensource.org/licenses/mit-license.php MIT License
 */

namespace app\middleware;

use Webman\MiddlewareInterface;
use Webman\Http\Response;
use Webman\Http\Request;

/**
 * Class StaticFile
 * @package app\middleware
 */
class StaticFile implements MiddlewareInterface
{
    public function process(Request $request, callable $next): Response
    {
        // Access to files beginning with. Is prohibited
        if (strpos($request->path(), '/.') !== false) {
            return response('<h1>403 forbidden</h1>', 403);
        }
        /** @var Response $response */
        $response = $next($request);
        // Add cross domain HTTP header
        /*$response->withHeaders([
            'Access-Control-Allow-Origin'      => '*',
            'Access-Control-Allow-Credentials' => 'true',
        ]);*/
        return $response;
    }
}

config/app.php

<?php

use support\Request;

return [
    'debug' => getenv('DEBUG')?:false,
    'error_reporting' => E_ALL,
    'default_timezone' => 'Asia/Shanghai',
    'request_class' => Request::class,
    'public_path' => base_path() . DIRECTORY_SEPARATOR . 'public',
    'runtime_path' => base_path(false) . DIRECTORY_SEPARATOR . 'runtime',
    'controller_suffix' => 'Controller',
    'controller_reuse' => false,
];