Insecure demo file disclosure

[Xyntax]

Unauthorized file manipulation - /vendor/vakata/jstree/demo/filebrowser/index.php

http://zikula.org/vendor/vakata/jstree/demo/filebrowser/

Possible unauthorized SSRF - /javascript/js-webshim/dev/shims/FlashCanvasPro/proxy.php

if (extension_loaded('curl')) {
    // Use cURL extension
    $ch = curl_init($url);
//  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
//  curl_setopt($ch, CURLOPT_MAXREDIRS, 10);
    curl_exec($ch);
    curl_close($ch);
} else {
    // Use the http:// wrapper
    readfile($url);
}

Please make a review.

[Guite]

Maybe we should report that at the vendor projects so they can provide a central fix?

[Xyntax]

Yes we can report that, but I'm afraid not all vendors cares about it.
Maybe we should make a simple review ourselves.

[Guite]

We could possibly block access to these files using the .htaccess file in the root folder.

[Guite]

javascript/js-webshim/dev/shims/FlashCanvasPro/proxy.php is already blocked by javascript/.htaccess.

[Guite]

Added a fix for the first one in #3261

[Guite]

Reported to vendor here: vakata/jstree#1651