# Deploy to /media/sandisk/chat/media/.htaccess on the Pi:
#   ssh pi 'sudo cp /var/www/html/WebRTC/private/media_htaccess.template /media/sandisk/chat/media/.htaccess && sudo chown www-data:www-data /media/sandisk/chat/media/.htaccess && sudo chmod 644 /media/sandisk/chat/media/.htaccess && sudo systemctl reload apache2'
#
# This file ensures uploaded media is NEVER executed as PHP/CGI even if an
# attacker bypasses the upload-side filename allowlist.

<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

<FilesMatch "\.(php|php3|php4|php5|php7|php8|phtml|phar|pht|pl|py|cgi|sh|sql|asp|aspx|jsp)$">
    Require all denied
</FilesMatch>

<FilesMatch "^\.">
    Require all denied
</FilesMatch>

Options -ExecCGI -Indexes

<IfModule mod_mime.c>
    RemoveHandler .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .pht
    RemoveType .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .pht
    AddType text/plain .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .pht
</IfModule>