File 0017-Ensure-that-Paths-configured-as-Aliases-are-exempt-f.patch of Package ea-apache2

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Rishwanth Yeddula <rish@cpanel.net>
Date: Tue, 26 Mar 2019 13:52:34 -0500
Subject: [PATCH 17/21] Ensure that Paths configured as Aliases are exempt from
 the symlink protection checks.

Case CPANEL-22257: Paths that are configured via the "Alias" directive
are now flagged as such in mod_alias. When processing requests for files
in these locations, the symlink protection checks now make an exception
and allow these files to be served successfully.

Case CPANEL-27056: Fix bug in condition that allowed for non-user files
to be served.
---
 modules/mappers/mod_alias.c | 1 +
 server/core.c               | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/modules/mappers/mod_alias.c b/modules/mappers/mod_alias.c
index 35eca74..bdd0980 100644
--- a/modules/mappers/mod_alias.c
+++ b/modules/mappers/mod_alias.c
@@ -592,6 +592,7 @@ static char *try_alias_list(request_rec *r, apr_array_header_t *aliases,
              */
             if (!is_redir) {
                 found = ap_server_root_relative(r->pool, found);
+                apr_table_setn(r->notes, "is_aliased_path", "true");
             }
             if (found) {
                 *status = alias->redir_status;
diff --git a/server/core.c b/server/core.c
index 7742c13..900606f 100644
--- a/server/core.c
+++ b/server/core.c
@@ -5040,8 +5040,9 @@ static int default_handler(request_rec *r)
                 return HTTP_NOT_FOUND;
             }
 
-
-            if (apr_uid_compare(r->finfo.user, post_open_dirstat.user)
+            const char *is_aliased_path = apr_table_get(r->notes, "is_aliased_path");
+            if ( !(is_aliased_path != NULL && strcmp(is_aliased_path, "true") == 0 ) &&
+                apr_uid_compare(r->finfo.user, post_open_dirstat.user)
                 != APR_SUCCESS || apr_uid_compare(post_open_finfo.user, r->finfo.user)
                 != APR_SUCCESS) {
                 /* Then we've caught a race condition abuser. */