Prevent Apache from serving uploads directly

web-server/apache/gitlab-apache22.conf

@@ -38,7 +38,8 @@
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]
   #Forward all requests to gitlab-workhorse except existing files like error documents
-  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
+  RewriteCond %{REQUEST_URI} ^/uploads/.*
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]
   # needed for downloading attachments

web-server/apache/gitlab-apache24.conf

@@ -39,7 +39,8 @@
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]
   #Forward all requests to gitlab-workhorse except existing files like error documents
-  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
+  RewriteCond %{REQUEST_URI} ^/uploads/.*
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]
   # needed for downloading attachments

web-server/apache/gitlab-omnibus-apache22.conf

@@ -39,7 +39,8 @@
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]
   #Forward all requests to gitlab-workhorse except existing files like error documents
-  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
+  RewriteCond %{REQUEST_URI} ^/uploads/.*
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]
   # needed for downloading attachments

web-server/apache/gitlab-omnibus-apache24.conf

@@ -40,7 +40,8 @@
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]
   #Forward all requests to gitlab-workhorse except existing files like error documents
-  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
+  RewriteCond %{REQUEST_URI} ^/uploads/.*
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]
   # needed for downloading attachments

web-server/apache/gitlab-omnibus-ssl-apache22.conf

@@ -65,7 +65,8 @@
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]
   #Forward all requests to gitlab-workhorse except existing files like error documents
-  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
+  RewriteCond %{REQUEST_URI} ^/uploads/.*
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]
   RequestHeader set X_FORWARDED_PROTO 'https'

web-server/apache/gitlab-omnibus-ssl-apache24.conf

@@ -66,7 +66,8 @@
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]
   #Forward all requests to gitlab-workhorse except existing files like error documents
-  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
+  RewriteCond %{REQUEST_URI} ^/uploads/.*
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]
   RequestHeader set X_FORWARDED_PROTO 'https'

web-server/apache/gitlab-ssl-apache22.conf

@@ -64,7 +64,8 @@
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]
   #Forward all requests to gitlab-workhorse except existing files like error documents
-  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
+  RewriteCond %{REQUEST_URI} ^/uploads/.*
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]
   RequestHeader set X_FORWARDED_PROTO 'https'

web-server/apache/gitlab-ssl-apache24.conf

@@ -65,7 +65,8 @@
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]
   #Forward all requests to gitlab-workhorse except existing files like error documents
-  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
+  RewriteCond %{REQUEST_URI} ^/uploads/.*
   RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]
   RequestHeader set X_FORWARDED_PROTO 'https'