Fix #2524 (#2525)

web/download/backup/index.php

@@ -30,7 +30,7 @@ if (!file_exists('/backup/'.$backup)) {
     }
 
     if ((!empty($_SESSION['user'])) && ($_SESSION['userContext'] != 'admin')) {
-        if (strpos($backup, $user.'.') === 0) {
+        if (strpos($backup, $_SESSION['user'].'.') === 0) {
             header('Content-type: application/gzip');
             header("Content-Disposition: attachment; filename=\"".$backup."\";");
             header("X-Accel-Redirect: /backup/" . $backup);

web/inc/main.php

@@ -127,6 +127,10 @@ if (isset($_SESSION['look']) && $_SESSION['look']  != '' && ($_SESSION['userCont
     $user_plain = htmlentities($_SESSION['look']);
 }
 
+if (empty($_SESSION['look'])) {
+    $_SESSION['look'] = '';
+}
+
 require_once(dirname(__FILE__) . '/i18n.php');
 
 function check_error($return_var)