From 293c89ed3eb3a2dd6d739370a541b775ecb123ac Mon Sep 17 00:00:00 2001
From: Rasmus Lerdorf <rasmus@php.net>
Date: Thu, 10 Apr 2014 02:40:21 -0700
Subject: [PATCH] *sigh*

---
 cached.php | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/cached.php b/cached.php
index a716a7aed..01c254493 100644
--- a/cached.php
+++ b/cached.php
@@ -1,4 +1,15 @@
 <?php
+/*
+  Yes, we know this can be used to view the source for any file
+  in the docroot directory. This is intentional and not an LFI
+  vulnerability. The source code for everything in the docroot
+  is publicly available at 
+
+    https://github.com/php/web-php
+
+  so there is no vulnerability here. You can't use this to view
+  anything that is private.
+*/  
 $_SERVER['BASE_PAGE'] = 'cached.php';
 include_once 'include/prepend.inc';