Issue #1587270 by klausi, greggles, sun: Forbid execution of PHP files in subfolders by default (except those needed by core).