null, 'postflight' => function () { // Public media types that may be served directly from user/data. // Keep in sync with the root .htaccess rule and the 2026-06-15 heal. $mediaExt = 'jpe?g|png|gif|webp|avif|bmp|ico|mp4|webm|ogg|ogv|mov|mp3|wav|m4a|flac|pdf'; $denyAll = << Require all denied Order allow,deny Deny from all HTACCESS; // Same deny-all, but re-grant a fixed set of public media extensions so // Flex Object images and similar uploads keep loading (getgrav/grav#4129). $denyExceptMedia = << Require all denied Order allow,deny Deny from all Require all granted Order allow,deny Allow from all HTACCESS; // Drop a backup .htaccess into each sensitive folder that exists. foreach (['accounts', 'config', 'data', 'env'] as $folder) { $dir = GRAV_ROOT . '/user/' . $folder; if (!is_dir($dir) || !is_writable($dir)) { continue; } $file = $dir . '/.htaccess'; if (!is_file($file)) { @file_put_contents($file, $folder === 'data' ? $denyExceptMedia : $denyAll); } } // Patch the site root .htaccess to block the sensitive folders outright. $root = GRAV_ROOT . '/.htaccess'; if (!is_file($root) || !is_writable($root)) { return; } $contents = file_get_contents($root); if ($contents === false) { return; } // Already patched (or a non-Grav file that happens to mention it) - nothing to do. if (strpos($contents, '^(user)/data/') !== false || strpos($contents, '^(user)/(accounts|config|data|env)/') !== false) { return; } $rule = "# Block all direct access to these sensitive user folders, whatever the file type\n" . "RewriteRule ^(user)/(accounts|config|env)/(.*) error [F]\n" . "# Block user/data too, but allow public media uploads (e.g. Flex Object images)\n" . "# to be served directly. SVG is intentionally excluded as a stored-XSS vector.\n" . "RewriteCond %{REQUEST_URI} !\\.($mediaExt)$ [NC]\n" . "RewriteRule ^(user)/data/(.*) error [F]\n"; // Insert right after the stock "block these folders" rule so it sits inside // the existing ... Security block. $patched = preg_replace( '/^(RewriteRule \^\(\\\\\.git\|cache\|bin\|logs\|backup\|webserver-configs\|tests\)\/\(\.\*\) error \[F\]\n)/m', '$1' . $rule, $contents, 1, $count ); if ($count > 0 && $patched !== null && $patched !== $contents) { @file_put_contents($root, $patched); } } ];