Using .php8 in PHP handler leading to RCE about elfinder

[nao-pon]

@passtheticket Thank you for your report. I will fix this. Until a fixed version is released, elFinder administrators can work around this issue by using 'additionalMimeMap' in the roots configuration, as follows:

'roots' => array(
    // Items volume
    array(
        'additionalMimeMap' => array(
            'php8:*' => 'text/x-php',
            'php9:*' => 'text/x-php'
        ),
        'driver'        => 'LocalFileSystem',           // driver for accessing file system (REQUIRED)
        'path'          => '../files/',                 // path to files (REQUIRED)
        'URL'           => dirname($_SERVER['PHP_SELF']) . '/../files/', // URL to files (REQUIRED)
        'trashHash'     => 't1_Lw',                     // elFinder's hash of trash folder
        'winHashFix'    => DIRECTORY_SEPARATOR !== '/', // to make hash same to Linux one on windows too
        'uploadDeny'    => array('all'),                // All Mimetypes not allowed to upload
        'uploadAllow'   => array('image/x-ms-bmp', 'image/gif', 'image/jpeg', 'image/png', 'image/x-icon', 'text/plain'), // Mimetype `image` and `text/plain` allowed to upload
        'uploadOrder'   => array('deny', 'allow'),      // allowed Mimetype `image` and `text/plain` only
        'accessControl' => 'access'                     // disable and hide dot starting files (OPTIONAL)
    ),