Merge branch 'develop' into 'develop'

Backport !744 Dashboard enhancements / quota view enhancements using bootstrap progress bars

See merge request ispconfig/ispconfig3!1261

Author: Marius Burkard

interface/web/dashboard/dashboard.php

@@ -160,10 +160,14 @@
 $handle = @opendir(ISPC_WEB_PATH.'/dashboard/dashlets');
 while ($file = @readdir($handle)) {
 	if ($file != '.' && $file != '..' && !is_dir(ISPC_WEB_PATH.'/dashboard/dashlets/'.$file)) {
-		$dashlet_name = substr($file, 0, -4);
-		$dashlet_class = 'dashlet_'.$dashlet_name;
-		include_once ISPC_WEB_PATH.'/dashboard/dashlets/'.$file;
-		$dashlet_list[$dashlet_name] = new $dashlet_class;
+		$splitfilename = explode('.', $file);
+		$file_extension = pathinfo($file)['extension'];
+		if ($file_extension === 'php') { // only allow .php files 
+			$dashlet_name = substr($file, 0, -4);
+			$dashlet_class = 'dashlet_'.$dashlet_name;
+			include_once ISPC_WEB_PATH.'/dashboard/dashlets/'.$file;
+			$dashlet_list[$dashlet_name] = new $dashlet_class;
+		}
 	}
 }