Description:
------------
In the new site redesign, a file called "cached.php" is used in the href for the stylesheet <link> tags, and in the src for a few <script> tags.  A GET parameter called "f" determines what file is served.  However, it looks like just about any path can be manually passed in that parameter, and the script will output the contents of that file, even if it's a PHP source code file.  Not knowing what files are accessible this way, I thought this should be reported, as for all I know there could be sensitive info that could be found out this way.

Expected result:
----------------
It probably ought to reject requests to .php or .inc files.

Actual result:
--------------
It doesn't.