Merge pull request #7493 from kinglozzer/require-me-some-isolation

FIX: Use isolated scope when requiring files for module activation

src/Core/Manifest/Module.php

@@ -158,7 +158,7 @@ class Module implements Serializable
     {
         $config = "{$this->path}/_config.php";
         if (file_exists($config)) {
-            require_once $config;
+            requireFile($config);
         }
     }
 
@@ -247,3 +247,15 @@ class Module implements Serializable
             ->exists();
     }
 }
+
+/**
+ * Scope isolated require - prevents access to $this, and prevents module _config.php
+ * files potentially leaking variables. Required argument $file is commented out
+ * to avoid leaking that into _config.php
+ *
+ * @param string $file
+ */
+function requireFile()
+{
+    require_once func_get_arg(0);
+}