# Uploaded files are personal data: driver ID scans, licences, medical certificates, bank-account
# confirmations, vehicle registration papers and raw CSV exports containing every driver's earnings.
#
# Nothing in this directory may be fetched directly. Every link in the application goes through
# serve_file.php, which checks that you are signed in and allowed to see that particular file.
#
# The rules below are independent on purpose, so that losing any one of them is not fatal:
#   1. Deny direct HTTP access entirely.
#   2. Even if rule 1 is bypassed, never execute anything here as a script.
#   3. Never list the directory.
#
# Every PHP-specific directive sits inside an <IfModule>: on hosts running PHP-FPM or CGI there is
# no php_flag directive, and an unwrapped one would turn every request here into an HTTP 500.

<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
</IfModule>

<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

<FilesMatch "\.(php|phtml|php[0-9]|phps|pl|py|cgi|asp|aspx|sh|shtml)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

Options -Indexes -ExecCGI
