# Deny direct web access to this folder, except avatar images (account://avatars)
# that Grav serves over HTTP. Account data (.yaml password hashes), databases,
# keys and tokens stay blocked; SVG is excluded as a stored-XSS vector.
# Defense-in-depth backup for the rules in the site root .htaccess.
#
# mod_rewrite, not `Require`: `Require` is AuthConfig-class and returns 500 for
# this whole folder on a host that grants only `AllowOverride FileInfo`, which
# is all the root .htaccess has ever needed (getgrav/grav#4309, #4311).
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteOptions InheritDownBefore

    # REQUEST_URI is the whole original path; the rule pattern only sees the
    # path below this folder, so the exception is written as a condition.
    RewriteCond %{REQUEST_URI} !/user/accounts/[^/]+/[^/]+\.(jpe?g|png|gif|webp|avif|bmp|ico)$ [NC]
    RewriteRule .* - [F]
</IfModule>
