--- Core/core.inc.php	19 Jul 2006 05:24:31 -0000	1.15
+++ Core/core.inc.php	2 Dec 2006 23:18:43 -0000
@@ -1,4 +1,14 @@
 <?
+// Copy certain _SERVER superglobals to the global namespace,
+// so we can access this information on diff versions of PHP.
+if($HTTP_HOST == '') $HTTP_HOST=$_SERVER['HTTP_HOST'];
+if($PHP_SELF == '')  $PHP_SELF=$_SERVER['PHP_SELF'];
+
+// 20061202 - Security Fix - http://secunia.com/advisories/22605
+if(strpos(strtolower($PHP_SELF),'core.inc.php')!==false) {
+	die('Core should *never* be called directly.');
+}
+
 // version and cookie (seperate cookie per version)
 $mp3sds_version='3.0';
 $cookie_name='mp3SDS_'.str_replace('.','_',$mp3sds_version);
@@ -42,10 +52,6 @@
 	foreach($_REQUEST as $key => $value)
 			$$key = $value;
 	
-	// Copy certain _SERVER superglobals to the global namespace.
-	if($HTTP_HOST == '') $HTTP_HOST=$_SERVER['HTTP_HOST'];
-	if($PHP_SELF == '')  $PHP_SELF=$_SERVER['PHP_SELF'];
-
 	// If the user hasn't been here yet, set their current path to the mp3 folder.
 	if(!$base_dir) $base_dir="$location";