Configuring .htaccess to block every request what not image in specified folder and subfolders

Question

I have upload folder where registered user can upload files. How to block all http requests except .png .jpg .gif to upload folder and all sub-folders? Other than upload should not be affected.

It can be done by something like RedirectMatch 404 ^/u/.*\.([^png]+|[^jpg]+|[^jpeg]+|[^gif]+|[^svg]+)$. This is not very correct regexp, but I can't invert (png|jpg|jpeg|gif|svg)

Please help make correct regexp or use something different than RedirectMatch

Update: I have following rewrite rules, how to make both answer and mine work? Just put answer's rules after RewriteEngine On? I can't try it and test, as website is not fully functional yet.

<IfModule mod_rewrite.c>
Options +FollowSymlinks
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^www\.(.*) [NC]
RewriteRule ^(.*)$ https://%1%{REQUEST_URI} [R=301,L]
# startreplace
RewriteRule ^Блог.html$ blog.php [E=HumanURL:1,L]
...

Answer 1

I would use mod_rewrite and put this in your main .htaccess near the top, just below RewriteEngine On:

RewriteCond %{REQUEST_URI} ^/u/.*
RewriteRule !\.(png|jpg|jpeg|gif|svg)$ - [R=404,L]

Using a rewrite rule, shows a 404 error directly at the URL rather than redirect to it. The RewriteCond ensures that only one directory is affected. The ! negates the rule, so it is for any file that doesn't match. The - leaves the URL alone. The R=404 changes it to a 404 status. The L makes it the last rule so that other rewrite rules don't come into play.

The only thing that isn't clear to me in your question is the name of your "upload" directory. I used /u/ like you had in your rule, but your question indicates it may be /upload/.

This is loosely based on Rewrite rule if condition is not matched from StackOverflow.

If this is your only method to prevent users from uploading non-image files, you should also take some other precautions. At the very least you should instruct browsers not to sniff content types. Otherwise somebody could upload a malicious HTML file containing JavaScript with an image extension. Some browsers are happy to discover that it is actually HTML and change how they handle it even with the image extension and mime-type.

Header set X-Content-Type-Options "nosniff"

It would be far better to modify your upload script to only accept valid image files. See the most reliable way to check upload file is an image on StackOverflow.