Security paranoia, reject requests to router.php that aren't from the cli-server...

diff --git a/maintenance/dev/includes/router.php b/maintenance/dev/includes/router.php
index 9067ba8..95bb1fa 100644 (file)
--- a/maintenance/dev/includes/router.php
+++ b/maintenance/dev/includes/router.php
@@ -3,6 +3,10 @@
 # Router for the php cli-server built-in webserver
 # http://ca2.php.net/manual/en/features.commandline.webserver.php
 
+if ( php_sapi_name() != 'cli-server' ) {
+       die( "This script can only be run by php's cli-server sapi." );
+}
+
 ini_set('display_errors', 1);
 error_reporting(E_ALL);