HOR-2533

workflow/engine/src/ProcessMaker/BusinessModel/Light.php

@@ -902,6 +902,16 @@ class Light
         $response = array();
         if (is_array($request_data)) {
             foreach ($request_data as $k => $file) {
+                $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
+                if (\Bootstrap::getDisablePhpUploadExecution() === 1 && $ext === 'php') {
+                    $message = \G::LoadTranslation('THE_UPLOAD_OF_PHP_FILES_WAS_DISABLED');
+                    \Bootstrap::registerMonologPhpUploadExecution('phpUpload', 550, $message, $file['name']);
+                    $response[$k]['error'] = array(
+                        "code" => "400",
+                        "message" => $message
+                    );
+                    continue;
+                }
                 $oCase = new \Cases();
                 $delIndex = $oCase->getCurrentDelegation($app_uid, $userUid);
                 $docUid = !empty($file['docUid']) ? $file['docUid'] : -1;