# =====================================================================
#  storage/ — deny all web access
#
#  Redundant with this directory living above the DocumentRoot, and
#  deliberately so (TDD §16.9). Redundant controls are what keep a single
#  Apache misconfiguration from becoming a breach.
#
#  Covers: logs (may contain internal paths and stack traces), sessions
#  (session payloads), uploads (user-supplied content that must never be
#  executed), cache and temp.
# =====================================================================

# Apache 2.4
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>

# Apache 2.2
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>

# Belt and braces: if the deny rules above are somehow not applied, make
# certain nothing here is ever handed to an interpreter.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>

RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .phps
RemoveType .php .phtml .php3 .php4 .php5 .php7 .php8 .phps
AddType text/plain .php .phtml .phps .cgi .pl .py .sh
