Restrict .htm Pages and Partials in OctoberCMS with Nginx

I'm using OctoberCMS, based on Laravel and Twig, with Nginx and PHP7.0-FPM.

If I visit localhost:8888/mypage, php is rendered but source is hidden.

But if I visit localhost:8888/themes/mysite/pages/mypage.htm I can view all of the php source code in the browser.

This is supposed to restrict access to those files http://ift.tt/2kKCyFr

But it doesn't work. I put it in my sites-available and restarted Nginx. I can still access the .htm file.

My Nginx sites-available:

server {
    listen 80;

    server_name localhost:8888;

    root /var/www/mysite/public;
    index index.html index.htm index.php;

    location / {
        try_files $uri $uri/ /index.php$is_args$args;
        include  /etc/nginx/mime.types;
    }

    rewrite ^themes/.*/(layouts|pages|partials)/.*.htm /index.php break;
    rewrite ^bootstrap/.* /index.php break;
    rewrite ^config/.* /index.php break;
    rewrite ^vendor/.* /index.php break;
    rewrite ^storage/cms/.* /index.php break;
    rewrite ^storage/logs/.* /index.php break;
    rewrite ^storage/framework/.* /index.php break;
    rewrite ^storage/temp/protected/.* /index.php break;
    rewrite ^storage/app/uploads/protected/.* /index.php break;

    location ~ \.php$ {
        # With php7-fpm:
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include /etc/nginx/fastcgi.conf;
    }

    # Support Search Engine Friendly URLs
    location ~ / {
        try_files $uri $uri/ /index.php?q=$request_uri;
        include  /etc/nginx/mime.types;
    }

    # Deny running scripts inside writable directories
    location ~* /(images|cache|media|logs|tmp)/.*\.(php|pl|py|jsp|asp|sh|cgi)$ {
        return 403;
        error_page 403 /403_error.html;
    }
}

from Newest questions tagged laravel-5 - Stack Overflow http://ift.tt/2kKOx5V
via IFTTT