Core Rule Set: ls -la passes in q on a gitea user's or organisation's page (closes #349)

On a path of one segment, q now skips 932250 too, unless the path ends
in .php, as /index.php does. The Forgejo recording gains the two
searches for ls -la, made from the recorded searches for python3.

Model: opus-5-5

internal/coreruleset/gitea.conf

@@ -135,8 +135,8 @@ SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
 # The repositories on a user's or an organisation's page are searched with q
-# too. Their path has one segment, as other apps' pages such as /index.php do,
-# so q keeps 932250 there and skips only these rules:
+# too. Their path has one segment, so q skips these rules on every path of one
+# segment, other apps' pages such as /index.php included:
 #   930120: .profile
 #   932120: powershell-scripts
 #   932260: python3-app
@@ -146,6 +146,13 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
+# On those pages q skips 932250 too, which refused ls -la. A path that ends in
+# .php, such as /index.php, keeps it.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
+    "id:900605,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx \.php$" \
+        "t:lowercase,ctl:ruleRemoveTargetById=932250;ARGS:q"
+
 # These requests name a file in the path, which skips these rules there:
 #   920500: notes.txt~
 #   934100: process.env.d.ts