# Discussion image uploads — deny execution of any server-side scripts here.
# This is defence-in-depth: the controller already validates extension/MIME,
# but a misconfiguration shouldn't turn a stored image into RCE.

<FilesMatch "\.(?i:ph(?:p[3457]?|t|tml|ar)|inc|hphp|cgi|pl|py|sh|asp|aspx|jsp)$">
    Require all denied
</FilesMatch>

<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

Options -ExecCGI -Indexes
RemoveHandler .php .phtml .phar .pl .py .sh .cgi
