File 0006-FPM-Ensure-docroot-is-in-the-user-s-homedir.patch of Package scl-php73

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Cory McIntire <cory@cpanel.net>
Date: Fri, 2 Mar 2018 11:10:07 -0600
Subject: [PATCH 06/14] FPM: Ensure docroot is in the user's homedir

---
 sapi/fpm/fpm/fpm_main.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c
index 85d8359..70d7a37 100644
--- a/sapi/fpm/fpm/fpm_main.c
+++ b/sapi/fpm/fpm/fpm_main.c
@@ -644,6 +644,9 @@ static void php_cgi_ini_activate_user_config(char *path, int path_len, const cha
 
 	/* Check whether cache entry has expired and rescan if it is */
 	if (request_time > entry->expires) {
+		char pwnambuf[4096 + 256];
+		struct passwd pwd, *pwdp;
+		long homedirlen;
 		char * real_path;
 		int real_path_len;
 		char *s1, *s2;
@@ -672,6 +675,15 @@ static void php_cgi_ini_activate_user_config(char *path, int path_len, const cha
 			s_len = path_len;
 		}
 
+		/* Find our home directory, and ensure the document root is within it.
+		 */
+		if (getpwuid_r(geteuid(), &pwd, pwnambuf, sizeof(pwnambuf), &pwdp) || !pwdp || !pwdp->pw_dir)
+			return;
+
+		homedirlen = strlen(pwdp->pw_dir);
+		if (strncmp(doc_root, pwdp->pw_dir, homedirlen) || doc_root[homedirlen] != '/')
+			return;
+
 		/* we have to test if path is part of DOCUMENT_ROOT.
 		  if it is inside the docroot, we scan the tree up to the docroot
 			to find more user.ini, if not we only scan the current path.