# Uploaded files must never be executable, no matter what extension ends up
# on disk. This is the last line of defense behind the mime/extension
# whitelist enforced in classes/Uploader.php.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<FilesMatch "\.(php|php3|php4|php5|php7|phtml|pl|py|cgi|sh|exe)$">
    Require all denied
</FilesMatch>
Options -Indexes -ExecCGI
AddHandler cgi-script .php .php3 .php4 .php5 .php7 .phtml .pl .py .cgi .sh .exe
