foto-portfolio/router.php

<?php
/**
 * Router for the PHP built-in server used in local development:
 *
 *     php -S localhost:8080 router.php
 *
 * The built-in server does not read .htaccess, so this mirrors the production
 * protection rules — otherwise data/*.json (which contains gallery password
 * hashes) and other internals would be readable while testing locally.
 * Not used in production; Apache ignores it.
 */
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH) ?? '/';

$blocked = preg_match('#^/(app|config|data|docs)/#', $path)   // internals
    || preg_match('#(^|/)\.[^/]#', $path)                     // dotfiles/dirs
    || preg_match('#\.(json|md|lock|buf)$#', $path)           // data/docs
    || str_ends_with($path, '.sample.php');                   // config templates

if ($blocked) {
    http_response_code(403);
    echo 'Forbidden';
    return true;
}

// Let the built-in server serve the requested file (or its own 404) as usual.
return false;