null, 'postflight' => function () { // Public media types that may be served directly from user/data. // Keep in sync with the root .htaccess rule and the 2026-06-09 update. $mediaExt = 'jpe?g|png|gif|webp|avif|bmp|ico|mp4|webm|ogg|ogv|mov|mp3|wav|m4a|flac|pdf'; // ---- Per-folder backup: upgrade user/data/.htaccess in place. ---- $denyExceptMedia = << Require all denied Order allow,deny Deny from all Require all granted Order allow,deny Allow from all HTACCESS; $dataDir = GRAV_ROOT . '/user/data'; $dataHtaccess = $dataDir . '/.htaccess'; if (is_dir($dataDir) && is_writable($dataDir) && is_file($dataHtaccess)) { $existing = (string) @file_get_contents($dataHtaccess); // Only touch the deny-all file this feature wrote: it denies all and // has no media carve-out yet. Leave hand-rolled files alone. if (strpos($existing, 'FilesMatch') === false && strpos($existing, 'Require all denied') !== false) { @file_put_contents($dataHtaccess, $denyExceptMedia); } } // ---- Site root: swap the blanket folder rule for the media-aware one. ---- $root = GRAV_ROOT . '/.htaccess'; if (!is_file($root) || !is_writable($root)) { return; } $contents = file_get_contents($root); if ($contents === false) { return; } // Already on the media-aware form (or never patched) - nothing to do. if (strpos($contents, 'RewriteRule ^(user)/(accounts|config|data|env)/(.*) error [F]') === false) { return; } $newBlock = "# Block all direct access to these sensitive user folders, whatever the file type\n" . "RewriteRule ^(user)/(accounts|config|env)/(.*) error [F]\n" . "# Block user/data too, but allow public media uploads (e.g. Flex Object images)\n" . "# to be served directly. SVG is intentionally excluded as a stored-XSS vector.\n" . "RewriteCond %{REQUEST_URI} !\\.($mediaExt)$ [NC]\n" . "RewriteRule ^(user)/data/(.*) error [F]\n"; // Prefer replacing the comment+rule pair the 2026-06-09 update wrote, so we // don't leave its now-stale comment behind; fall back to the rule line alone. $oldPair = "# Block all direct access to these sensitive user folders, whatever the file type\n" . "RewriteRule ^(user)/(accounts|config|data|env)/(.*) error [F]\n"; if (strpos($contents, $oldPair) !== false) { $patched = str_replace($oldPair, $newBlock, $contents); } else { $patched = str_replace( "RewriteRule ^(user)/(accounts|config|data|env)/(.*) error [F]\n", $newBlock, $contents ); } if ($patched !== $contents) { @file_put_contents($root, $patched); } } ];