I noticed that a number of methods in system/Controller.php are public (initController, forceHTTPS, cachePage, validate). I'm not sure if they need to be for internal purposes, but this makes them routable endpoints on any controller. E.g. https://example.com/home/cachePage/1, or https://example.com/home/initController. This should definitely be addressed as it is borderline a security issue - let me know if you want help with that.
I noticed that a number of methods in system/Controller.php are public (initController, forceHTTPS, cachePage, validate). I'm not sure if they need to be for internal purposes, but this makes them routable endpoints on any controller. E.g. https://example.com/home/cachePage/1, or https://example.com/home/initController. This should definitely be addressed as it is borderline a security issue - let me know if you want help with that.