# Downloads folder: every file type can be downloaded (firmware .bin/.tgz/.tar/.md5/.img/.apk too), but scripts
# can never run here, and the folder itself can't be listed.

# Block files a web server could run as code, and hidden/config files
<FilesMatch "(?i)\.(php\d?|phtml|phar|phps|pht|cgi|pl|py|rb|sh|asp|aspx|jsp|shtml|htaccess|htpasswd|ini)$">
	<IfModule mod_authz_core.c>
		Require all denied
	</IfModule>
	<IfModule !mod_authz_core.c>
		Order Allow,Deny
		Deny from all
	</IfModule>
</FilesMatch>

# The upload log is private (the Auto Upload page shows it through auul.php?myuploads=1)
<FilesMatch "(?i)^(myuploads|notes)\.txt$">
	<IfModule mod_authz_core.c>
		Require all denied
	</IfModule>
	<IfModule !mod_authz_core.c>
		Order Allow,Deny
		Deny from all
	</IfModule>
</FilesMatch>

# Web pages and SVG images are always downloaded, never opened in the site's own address (no script injection)
<IfModule mod_headers.c>
	Header set X-Content-Type-Options "nosniff"
	<FilesMatch "(?i)^(?!index\.html$).*\.(html?|xhtml|xht|svgz?|xml|xsl|js|mjs)$">
		Header set Content-Disposition "attachment"
		Header set Content-Security-Policy "sandbox"
	</FilesMatch>
</IfModule>

# Disable PHP execution
<IfModule mod_php5.c>
	php_flag engine off
</IfModule>
<IfModule mod_php7.c>
	php_flag engine off
</IfModule>
<IfModule mod_php.c>
	php_flag engine off
</IfModule>

# No directory listing: opening /files/ shows the 404 page (index.html sends there on servers that skip this file)
Options -Indexes
DirectoryIndex index.html

# Missing or blocked files show RapidLeech's 404 page instead of the server's plain error page.
# If RapidLeech is installed in a sub-folder, change /404.php to /that-folder/404.php
ErrorDocument 404 /404.php
ErrorDocument 403 /404.php
