# Prevent execution of PHP and other server-side scripts in uploads directory
# This is a critical security measure to prevent uploaded files from being executed

# Disable PHP execution
<FilesMatch "\.(php[0-9]?|phtml|phar|phps|php3|php4|php5|php7|php8|cgi|pl|py|sh|exe|bat|cmd|asp|aspx|jsp)$">
    Require all denied
</FilesMatch>

# Additional security: Disable script execution
php_flag engine off

# Prevent directory browsing
Options -Indexes

# Force download for potentially dangerous file types
<FilesMatch "\.(htm|html|js)$">
    Header set Content-Disposition "attachment"
    Header set X-Content-Type-Options "nosniff"
</FilesMatch>

# Set proper MIME types for allowed file types
<IfModule mod_mime.c>
    AddType image/jpeg .jpg .jpeg
    AddType image/png .png
    AddType image/gif .gif
    AddType image/webp .webp
    AddType application/pdf .pdf
    AddType text/csv .csv
    AddType text/plain .txt
    AddType application/vnd.ms-excel .xls
    AddType application/vnd.openxmlformats-officedocument.spreadsheetml.sheet .xlsx
    AddType application/vnd.openxmlformats-officedocument.wordprocessingml.document .docx
</IfModule>
