# uploads/ holds files that arrived over the network. Whatever else goes
# wrong, nothing in here may ever EXECUTE. Blocking by extension with both
# authz syntaxes (see the API .htaccess for why both) is the belt; the
# braces are that upload code only ever writes whitelisted extensions
# under random names.
<FilesMatch "(?i)\.(php|phtml|phar|php[0-9]|cgi|pl|py|sh)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

<IfModule mod_autoindex.c>
    IndexIgnore *
</IfModule>

# The Flutter WEB build (admin panel in a browser) fetches these photos
# with CORS; without this header images silently fail there while the
# Android app shows them fine. Guarded so a host without mod_headers
# parses the file anyway (see LESSON 2 in the api .htaccess). Public
# catalogue photos only - medical reports never live in a public folder.
<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
</IfModule>
