Do not serve hidden files and directories by default

CONFIGURATION.md

@@ -102,9 +102,15 @@ Cache duration (in seconds). Set to `0` to disable caching entirely. This is an
 out-of-spec feature. See [PROPOSALS.md](https://gitlab.com/tslocum/twins/blob/master/PROPOSALS.md)
 for more information.
 
+##### HiddenFiles
+
+When enabled, hidden files and directories may be accessed. This attribute is
+disabled by default.
+
 ##### ListDirectory
 
-Directory listing may be enabled by adding `listdirectory: true`.
+When enabled, directories without an index file will serve a list their
+contents.  This attribute is disabled by default.
 
 ##### Input
 
@@ -116,8 +122,8 @@ Request sensitive text input from the user. Text will not be shown as it is ente
 
 ##### Type
 
-Content type is normally detected automatically, defaulting to
+Content type is normally detected automatically. This attribute forces a
-`text/gemini; charset=utf-8`. This option forces a specific content type.
+specific content type for a path.
 
 ##### FastCGI
 

config.go

@@ -31,6 +31,9 @@ type pathConfig struct {
 	// Request sensitive input
 	SensitiveInput string
 
+	// Serve hidden files and directories
+	HiddenFiles bool
+
 	// List directory entries
 	ListDirectory bool
 

server.go

@@ -139,6 +139,15 @@ func servePath(c *tls.Conn, request *url.URL, serve *pathConfig) {
 		resolvedPath = strings.Join(requestSplit[pathSlashes:], "/")
 	}
 
+	if !serve.HiddenFiles {
+		for _, piece := range requestSplit {
+			if len(piece) > 0 && piece[0] == '.' {
+				writeStatus(c, statusTemporaryFailure)
+				return
+			}
+		}
+	}
+
 	var filePath string
 	if serve.Root != "" {
 		root := serve.Root