# Slate — uploads hardening (defense in depth).
#
# Uploaded files are user-supplied. This directory must never execute
# server-side code, nor serve markup that a browser would run as active
# content (SVG/HTML can carry <script>). This sits at the uploads ROOT so
# the protection does not depend on the per-folder php_flag drop, which is
# silently ignored under PHP-FPM / SetHandler proxy:fcgi.

# 1. Disable the PHP engine where mod_php / mod_lsapi honor it.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>
<IfModule lsapi_module>
    php_flag engine off
</IfModule>

# 2. Hard-deny any file the server might execute, regardless of handler.
<FilesMatch "(?i)\.(php|php[0-9]|phtml|phps|pht|phar|cgi|pl|py|rb|sh|asp|aspx|jsp|htaccess)$">
    Require all denied
</FilesMatch>

# 3. Markup/script types that are never legitimate uploads: force download
#    so they cannot run JavaScript in this origin (stored XSS).
<FilesMatch "(?i)\.(xml|xhtml|html?|htm|js|mjs|mht|mhtml)$">
    ForceType application/octet-stream
    <IfModule mod_headers.c>
        Header set Content-Disposition "attachment"
        Header set X-Content-Type-Options "nosniff"
    </IfModule>
</FilesMatch>

# 4. SVG is a valid image (logos) and is sanitized on upload, so it stays
#    inline-renderable for <img>. This CSP is a backstop: if it is opened
#    directly as a document, scripts/plugins are blocked even if a future
#    sanitizer gap let something through.
<FilesMatch "(?i)\.(svg|svgz)$">
    <IfModule mod_headers.c>
        Header set Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox"
        Header set X-Content-Type-Options "nosniff"
    </IfModule>
</FilesMatch>
