When creating a custom path alias, users currently can set the alias to an internal path, eg. /modules/custom/my_custom_module/custom.js .
When a users visit a node with this path alias, instead of showing the actual node data it will try to access the file instead.
1. Create a new topic
2. Set the path alias to /modules/custom/my_custom_module/custom.js
3. Make sure that the actual path exist and that the file is actually there.
4. Try to visit this URL
5. You should be prompted to download this file.
Add a custom validation function that disallow to set path alias that starts with a reserved Drupal path or a path that points to an actual file on the server itself.
Fixed
13.0
Code (back-end)