Fix incorrect regex for files in errors/ and return 404 for index.php

[colinmollenhour]

This fixes two problems with the nginx config in dev/openmage:

• The negative lookahead regex for files in errors/ was not working, allowing .php or .xml files stored there to be downloaded
• The index.php file was not explicitly located as 404

These files were added in #1210 to support Apache and are not needed for nginx but any files added to pub/ should be excluded via the config (this kinda defeats the purpose of having a separate directory for pub files but it is what it is).

Manual testing scenarios (*)

These urls should return a 404:

http://localhost/errors/report.php
http://localhost/index.php

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR fixes security vulnerabilities in the OpenMage nginx configuration by correcting a malformed regex pattern that failed to properly restrict file access in the errors/ directory and by blocking direct HTTP access to index.php on the frontend server. The changes ensure that only whitelisted static assets (CSS, images) can be served from the errors directory, while blocking potentially sensitive PHP and XML files. Additionally, the PR reorganizes the nginx directives by moving api.php to the "Apache-only files" section for better logical grouping.

• Fixed malformed negative lookahead regex in errors/ directory to properly block non-whitelisted file extensions
• Added explicit 404 response for direct access to /index.php on frontend (while admin still uses it internally)
• Reorganized api.php directive to the Apache-only files section with exact match modifier for consistency

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
dev/openmage/nginx-frontend.conf	Corrected errors/ regex pattern, added index.php blocking, and reorganized api.php directive location
dev/openmage/nginx-admin.conf	Applied the same regex pattern fix for errors/ directory to maintain consistency with frontend configuration

[sreichel]

I know you dont use it ... but do you still have time to test nginx config with DDEV?

• https://docs.ddev.com/en/stable/users/extend/customization-extendibility/#custom-nginx-configuration

[colinmollenhour]

I know you dont use it ... but do you still have time to test nginx config with DDEV?

• https://docs.ddev.com/en/stable/users/extend/customization-extendibility/#custom-nginx-configuration

I doubt the two configs have many similarities.. But if you want to test it just check like so:

curl -s -D - http://whatever-your-url-is/errors/report.php
curl -s -D - http://whatever-your-url-is/api.php

I think ideally they should return 404 errors. In this case they were just downloading the php source.