RewriteEngine On
# A. changeprefs with a what= that is not style or lang
RewriteCond %{REQUEST_URI} ^/ubbthreads/ubbthreads\.php$ [NC]
RewriteCond %{QUERY_STRING} (^|&)ubb=changeprefs(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)what= [NC]
RewriteCond %{QUERY_STRING} !(&|^)what=(style|lang)(&|$) [NC]
RewriteRule ^ - [G,L]
# B. curl= with fake https:// or http:// encoding
RewriteCond %{REQUEST_URI} ^/ubbthreads/ubbthreads\.php$ [NC]
RewriteCond %{QUERY_STRING} curl=https?3A2F2F [NC]
RewriteRule ^ - [G,L]
# C. curl= is an absolute http(s) URL that is not stovebolt.com
RewriteCond %{REQUEST_URI} ^/ubbthreads/ubbthreads\.php$ [NC]
RewriteCond %{QUERY_STRING} curl=https?:// [NC]
RewriteCond %{QUERY_STRING} !curl=https?://(www\.)?stovebolt\.com [NC]
RewriteRule ^ - [G,L]
# D. curl= starts with a hostname and no scheme
RewriteCond %{REQUEST_URI} ^/ubbthreads/ubbthreads\.php$ [NC]
RewriteCond %{QUERY_STRING} (^|&)curl=([a-z0-9-]+\.)+[a-z]{2,} [NC]
RewriteCond %{QUERY_STRING} !curl=(https?://)?(www\.)?stovebolt\.com [NC]
RewriteRule ^ - [G,L]
# E. curl=// not pointing at this host
RewriteCond %{REQUEST_URI} ^/ubbthreads/ubbthreads\.php$ [NC]
RewriteCond %{QUERY_STRING} (^|&)curl=// [NC]
RewriteCond %{QUERY_STRING} !curl=//(www\.)?stovebolt\.com(/|&|$) [NC]
RewriteRule ^ - [G,L]
