# Files in uploads are public static assets and must never be executable.
Options -Indexes -ExecCGI

<IfModule mod_mime.c>
	RemoveHandler .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .cgi .pl .py .rb .sh
	RemoveType .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .cgi .pl .py .rb .sh
</IfModule>

<FilesMatch "(?i)(^\.|\.user\.ini$|web\.config$|\.(php(?:[0-9]+)?|phtml|phar|cgi|pl|py|rb|sh)(?:\..*)?$)">
	<IfModule mod_authz_core.c>
		Require all denied
	</IfModule>
	<IfModule !mod_authz_core.c>
		Order allow,deny
		Deny from all
	</IfModule>
</FilesMatch>

<FilesMatch "(?i)\.svgz?$">
	<IfModule mod_headers.c>
		Header set Content-Security-Policy "sandbox; default-src 'none'; style-src 'unsafe-inline'"
		Header set Content-Disposition "attachment"
		Header set X-Content-Type-Options "nosniff"
	</IfModule>
</FilesMatch>

#Header set Cache-Control "max-age=7200, must-revalidate"

<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond %{REQUEST_FILENAME} !-f
	RewriteRule .(jpg|JPG|jpeg|JPEG|gif|GIF|png|PNG|webp|WEBP|bmp|BMP) /inc/thumb.php [QSA,L]
</IfModule>