wiki.techinc.nl/images/.htaccess

<IfModule headers_module>
Header set X-Content-Type-Options nosniff
</IfModule>
<IfModule php7_module>
php_flag engine off
</IfModule>
# In php8, php dropped the version number.
<IfModule php_module>
php_flag engine off
</IfModule>
Set "X-Content-Type-Options: nosniff" header in images/.htaccess MediaWiki already sets this header unconditionally on all requests, but images are served directly by the webserver. We want to remove the IEContentAnalyzer, which currently provides protection against uploading problematic files, so instead we are going to recommend setting this header to instruct browsers to not sniff. Per pingback data, ~83% of reporting installs use Apache. This was suggested by Taavi. Bug: T309787 Change-Id: I8a0c50cc0a8bc037f4c9b0a114f87793446aed7f 2023-02-25 04:59:22 +00:00			`<IfModule headers_module>`
			`Header set X-Content-Type-Options nosniff`
			`</IfModule>`
Disable php in .htaccess of images directory as a hardening measure. All our docs strongly reccomend doing this. There is even a prompt in the installer. Not all webservers listen to this of course, but it won't hurt things that ignore it. The general idea is that there should be no directory that is both writable and executable at the same time by the webserver. images must be writable, so we should turn off php so its not executable. Change-Id: Ic03cee12845a56a0f4f7e356493eb0f446ccf34c 2022-11-12 16:16:21 +00:00			`<IfModule php7_module>`
			`php_flag engine off`
			`</IfModule>`
			`# In php8, php dropped the version number.`
			`<IfModule php_module>`
			`php_flag engine off`
			`</IfModule>`