Fix for exploit allowing filesystem read access as www-data
(thanks cyber.god@aol.com, whoever you may be)
Merge commit 'origin/master'