[HIGH] EZSA-2018-009 Do not interpret PHP/PHAR uploads

PKSA-pyck-srww-rjvt GHSA-9895-26wr-4fgv

Affected package: ezsystems/ezpublish-legacy

Affected version: >=2018.9.0,<2018.9.1.3|>=2018.6.0,<2018.6.1.4|>=2011.0.0,<2017.12.4.3|>=5.4.0,<5.4.12.3|>=5.3.0,<5.3.12.6

Reported by:
FriendsOfPHP/security-advisories, GitHub