Check filename before including for security reasons

php/autoload.php

@@ -10,6 +10,9 @@ if (!defined('LYCHEE')) exit('Error: Direct access is not allowed!');
 
 function lycheeAutoloaderModules($class_name) {
 
+	$modules = array('Album', 'Database', 'Import', 'Log', 'Module', 'Photo', 'Plugins', 'Session', 'Settings');
+	if (!in_array($class_name, $modules)) return false;
+
 	$file = LYCHEE . 'php/modules/' . $class_name . '.php';
 	if (file_exists($file)!==false) require $file;
 
@@ -17,6 +20,9 @@ function lycheeAutoloaderModules($class_name) {
 
 function lycheeAutoloaderAccess($class_name) {
 
+	$access = array('Access', 'Admin', 'Guest', 'Installation');
+	if (!in_array($class_name, $access)) return false;
+
 	$file = LYCHEE . 'php/access/' . $class_name . '.php';
 	if (file_exists($file)!==false) require $file;