# Carpeta de medios: solo se sirven videos .mp4 y subtítulos .vtt con nombres seguros.
# Ningún script puede ejecutarse aquí.
Options -Indexes -ExecCGI
RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .phps .phar .pht .pl .py .cgi .sh .asp .aspx .jsp
RemoveType .php .phtml .php3 .php4 .php5 .php7 .php8 .phps .phar .pht
AddType video/mp4 .mp4
AddType text/vtt .vtt

<IfModule mod_authz_core.c>
  Require all denied
  <FilesMatch "^[A-Za-z0-9_-]+\.(mp4|vtt)$">
    Require all granted
  </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
  Order deny,allow
  Deny from all
  <FilesMatch "^[A-Za-z0-9_-]+\.(mp4|vtt)$">
    Allow from all
  </FilesMatch>
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule !^(videos/[A-Za-z0-9_-]+\.mp4|subtitulos/[A-Za-z0-9_-]+\.vtt)$ - [F,L]
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Content-Security-Policy "default-src 'none'; media-src 'self'; sandbox"
</IfModule>
