Lighttpd 'mod_userdir' Case Sensitive Comparison Security Bypass Vulnerability

Description

Hi,

I run lighttpd 1.4.19 on Linux on top of a case-insensitive filesystem (JFS with OS/2 compatibility enabled). I noticed that while lighty forces lower case filenames for files within the server.document-root, it doesn't for files in a userdir.

Example:

The original filename is test.php (works):

<a href="http://andersman.org/test.php">http://andersman.org/test.php</a>

<a href="http://andersman.org/test.PHP">http://andersman.org/test.PHP</a>

The original filename is test.php (shows sources !!):

<a href="http://andersman.org/~anders/test.php">http://andersman.org/~anders/test.php</a>

<a href="http://andersman.org/~anders/test.PHP">http://andersman.org/~anders/test.PHP</a>

-- anders1