Accessing URL to script filemanager.config.php creates a file system inside the includes directory

I can confirm this behavior. We saw similar attempts today.

If someone visits sites/all/modules/ckeditor/includes/filemanager.config.php (simple GET or POST request), it will create a sites/all/modules/ckeditor/includes/sites/default/files directory with .htaccess and css and js folders (because of the subsequent error).

It is because Drupal is bootstrapped from the /sites/all/modules/ckeditor/includes directory and the $base_path is set to /sites/all/modules/ckeditor/includes (by $_SERVER['SCRIPT_NAME']), see drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL); --> drupal_settings_initialize();:

    // $_SERVER['SCRIPT_NAME'] can, in contrast to $_SERVER['PHP_SELF'], not
    // be modified by a visitor.
    if ($dir = rtrim(dirname($_SERVER['SCRIPT_NAME']), '\/')) {
      $base_path = $dir;
      $base_url .= $base_path;
      $base_path .= '/';
    }
    else {
      $base_path = '/';
    }

We should probably check if the resolveUrl() function exists. See the proposed patch.

We encountered the same problem when a bot ran over this file. In addition, all our CSS / JS aggregate become empty, so website were full buggy.

To fix this issue quickly we went to admin/config/development/performance and we disabled :
- Aggregate and compress CSS files.
- Aggregate JavaScript files.
then Clear Cache.

Thanks for this patch, it's should be reviewed quickly.

Automatically closed - issue fixed for 2 weeks with no activity.