Merge branch 'fix-cve-2020-5301'

See:

https://github.com/simplesamlphp/simplesamlphp/pull/1317

lib/SimpleSAML/Module.php

@@ -259,7 +259,7 @@ class Module
             throw new Error\NotFound('The URL wasn\'t found in the module.');
         }
 
-        if (substr($path, -4) === '.php') {
+        if (mb_strtolower(substr($path, -4), 'UTF-8') === '.php') {
             // PHP file - attempt to run it
 
             /* In some environments, $_SERVER['SCRIPT_NAME'] is already set with $_SERVER['PATH_INFO']. Check for that