Require all denied Order allow,deny Deny from all Require all granted Order allow,deny Allow from all HTACCESS; return [ 'preflight' => null, 'postflight' => function () use ($rootBlock, $accountsCarveOut) { // ---- Site root: open user/accounts to avatar images. ---- $root = GRAV_ROOT . '/.htaccess'; if (is_file($root) && is_writable($root)) { $contents = file_get_contents($root); // Already healed (carve-out present) - nothing to do. Idempotent. if ($contents !== false && strpos($contents, '/user/accounts/avatars/') === false) { // The prior security updates leave the rule on the [F,NC] form; // tolerate a stock [F] too. Once replaced, neither literal // remains, so this is idempotent. $patched = str_replace( [ 'RewriteRule ^(user)/(accounts|config|env)/(.*) error [F,NC]', 'RewriteRule ^(user)/(accounts|config|env)/(.*) error [F]', ], $rootBlock, $contents ); if ($patched !== $contents) { @file_put_contents($root, $patched); } } } // ---- Per-folder backup: convert the blanket deny-all to the carve-out. ---- $accountsHtaccess = GRAV_ROOT . '/user/accounts/.htaccess'; if (is_file($accountsHtaccess) && is_writable($accountsHtaccess)) { $contents = file_get_contents($accountsHtaccess); if ($contents !== false && strpos($contents, 'FilesMatch') === false && strpos($contents, 'Require all denied') !== false) { @file_put_contents($accountsHtaccess, $accountsCarveOut); } } } ];