<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <directoryBrowse enabled="false" />
    <rewrite>
      <rules>
        <rule name="Block storage sensitive directories" stopProcessing="true">
          <match url="^(sessions|settings|database_backups|maintenance_exports)(/.*)?$" ignoreCase="true" />
          <action type="CustomResponse" statusCode="403" subStatusCode="0" statusReason="Forbidden" statusDescription="Forbidden" />
        </rule>
        <rule name="Block direct payment slip access" stopProcessing="true">
          <match url="^uploads/payment_slips(/.*)?$" ignoreCase="true" />
          <action type="CustomResponse" statusCode="403" subStatusCode="0" statusReason="Forbidden" statusDescription="Forbidden" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>
