From b1fccd42547201f4dbfe941bcc59c8eac3456364 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Wed, 25 Oct 2017 14:33:34 -0400
Subject: [PATCH] Do not allow direct download of .inc files (unparsed PHP
 source). Fixes #8005

---
 src/etc/inc/system.inc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/etc/inc/system.inc b/src/etc/inc/system.inc
index 879bb966b6..da084d2f9f 100644
--- a/src/etc/inc/system.inc
+++ b/src/etc/inc/system.inc
@@ -1532,7 +1532,10 @@ EOD;
 		location / {
 			index  index.php index.html index.htm;
 		}
-
+		location ~ \.inc$ {
+			deny all;
+			return 403;
+		}
 		location ~ \.php$ {
 			try_files \$uri =404; #  This line closes a potential security hole
 			# ensuring users can't execute uploaded files