Restore runtime directory guards

tmp/.htaccess

@@ -0,0 +1 @@
+Deny from all

uploads/.htaccess

@@ -0,0 +1,33 @@
+# Files in uploads are public static assets and must never be executable.
+Options -Indexes -ExecCGI
+
+<IfModule mod_mime.c>
+	RemoveHandler .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .cgi .pl .py .rb .sh
+	RemoveType .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .cgi .pl .py .rb .sh
+</IfModule>
+
+<FilesMatch "(?i)(^\.|\.user\.ini$|web\.config$|\.(php(?:[0-9]+)?|phtml|phar|cgi|pl|py|rb|sh)(?:\..*)?$)">
+	<IfModule mod_authz_core.c>
+		Require all denied
+	</IfModule>
+	<IfModule !mod_authz_core.c>
+		Order allow,deny
+		Deny from all
+	</IfModule>
+</FilesMatch>
+
+<FilesMatch "(?i)\.svgz?$">
+	<IfModule mod_headers.c>
+		Header set Content-Security-Policy "sandbox; default-src 'none'; style-src 'unsafe-inline'"
+		Header set Content-Disposition "attachment"
+		Header set X-Content-Type-Options "nosniff"
+	</IfModule>
+</FilesMatch>
+
+#Header set Cache-Control "max-age=7200, must-revalidate"
+
+<IfModule mod_rewrite.c>
+	RewriteEngine On
+	RewriteCond %{REQUEST_FILENAME} !-f
+	RewriteRule .(jpg|JPG|jpeg|JPEG|gif|GIF|png|PNG|webp|WEBP|bmp|BMP) /inc/thumb.php [QSA,L]
+</IfModule>

uploads/index.php

@@ -0,0 +1,21 @@
+<?php
+
+	/*
+	|--------------------------------------------------------------------------------------
+	| AVE.cms
+	|--------------------------------------------------------------------------------------
+	| @package      AVE.cms
+	| @file         uploads/index.php
+	| @author       AVE.cms <support@ave-cms.ru>
+	| @copyright    2007-2026 (c) AVE.cms
+	| @link         https://ave-cms.ru
+	| @version      3.3
+	*/
+
+	/**
+					 * Файл-заглушка, предназначенный для запрета показа списка файлов в текущей директории,
+					 * если через адресную строку браузера было прямое общращение к данной директории.
+					 */
+					header('Location:/');
+					exit;
+				?>