disable $document_root variable in the "root/alias" directive
diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index 4a957d2..5683c24 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -2659,6 +2659,17 @@
value = cf->args->elts;
+ if (ngx_strstr(value[1].data, "$document_root") != 0
+ || ngx_strstr(value[1].data, "${document_root}") != 0)
+ {
+ ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+ "the $document_root variable may not be used "
+ "in the \"%V\" directive",
+ &cmd->name);
+
+ return NGX_CONF_ERROR;
+ }
+
lcf->alias = alias;
lcf->root = value[1];