From 3b598e82dd18d7fdc6f98d87a55dc96ab18144ae Mon Sep 17 00:00:00 2001
From: Moritz <moritz.m@local-it.org>
Date: Tue, 28 Apr 2026 01:21:29 +0200
Subject: [PATCH] harden htaccess

---
 abra.sh            |  4 ++--
 entrypoint.sh.tmpl | 13 +++++++++++++
 htaccess.tmpl      |  5 +++++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/abra.sh b/abra.sh
index f1bb6f3..d087fa6 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,8 +1,8 @@
 export PHP_UPLOADS_CONF_VERSION=v4
-export ENTRYPOINT_CONF_VERSION=v7
+export ENTRYPOINT_CONF_VERSION=v8
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
-export HTACCESS_CONF_VERSION=v2
+export HTACCESS_CONF_VERSION=v3
 export USERS_CONF_VERSION=v1
 
 wp() {
diff --git a/entrypoint.sh.tmpl b/entrypoint.sh.tmpl
index 035fbf1..472395c 100644
--- a/entrypoint.sh.tmpl
+++ b/entrypoint.sh.tmpl
@@ -42,6 +42,19 @@ define('FORCE_SSL_ADMIN', true );
 define('COOKIE_DOMAIN', \$_SERVER['HTTP_HOST']);"
 {{ end }}
 
+
+UPLOADS_HTACCESS=/var/www/html/wp-content/uploads/.htaccess
+if [ ! -f "$UPLOADS_HTACCESS" ]; then
+    mkdir -p /var/www/html/wp-content/uploads
+    cat > "$UPLOADS_HTACCESS" <<'EOF'
+# Prevent PHP execution in uploads directory
+<FilesMatch "\.(?i:php|phtml|phar)$">
+    Require all denied
+</FilesMatch>
+EOF
+    chown www-data:www-data "$UPLOADS_HTACCESS"
+fi
+
 if [ -n "$@" ]; then
 	"$@"
 fi
diff --git a/htaccess.tmpl b/htaccess.tmpl
index 24739f8..a71a625 100644
--- a/htaccess.tmpl
+++ b/htaccess.tmpl
@@ -1,3 +1,8 @@
+# Protect sensitive files from direct access
+<FilesMatch "^(wp-config\.php|\.htaccess|\.htpasswd|readme\.html|license\.txt)$">
+    Require all denied
+</FilesMatch>
+
 {{ if eq (env "MULTISITE") "" -}}
 # BEGIN WordPress