docs(admin_manual): document user home containment and user.home_base_dirs

[DeepDiver1975]

Summary

A user backend can supply a per user home directory — with LDAP, the User Home
Folder Naming Rule setting can name it from a per user attribute (attr:cn,
attr:homeDirectory). That value was accepted essentially verbatim, so a home
pointing at the ownCloud code directory gave the user read and write access to
the application's own PHP files. It is now confined to the data directory:

• fix(user): confine backend provided user homes to the data directory core#41752 — containment in SyncService::syncHome(), covering every
  home-providing backend
• fix(user): confine the home folder naming rule to the data directory user_ldap#849 — containment at the LDAP backend's own entry point

This documents the new behaviour and the config option that opts out of it.

Changes

configuration/user/user_auth_ldap.adoc — a CAUTION: in the User Home
Folder Naming Rule item: what is refused, what an affected user sees (login
fails, an error naming the path and the option is logged), how symlinks are
treated (a symlinked data directory keeps working; a symlink inside it cannot be
used to escape), and how to permit additional base directories. It also states
the upgrade case explicitly — an installation whose homes legitimately live
outside the data directory must set the option before upgrading, or those
users cannot log in afterwards.

configuration/server/config_sample_php_parameters.adoc — regenerated,
adding the user.home_base_dirs section.

How this was produced and verified

The parameters page is generated by
owncloud/config-to-docs from
core's config/config.sample.php, so it was regenerated rather than hand-edited:

php convert.php config:convert-adoc \
  --input-file=../core/config/config.sample.php \
  --output-file=../docs-server/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc

• Regeneration is clean: running the generator against the pre-change
  config.sample.php reproduces the currently published page byte for byte
  (diff empty), so the diff here contains nothing but the new option — no
  generator churn.
• Rendering checked with Asciidoctor: the CAUTION: becomes an admonition
  block inside the definition-list item, and the PHP snippet renders.
• The xref: resolves: the target section's generated anchor is
  additional-base-directories-a-user-home-may-be-located-in, confirmed against
  the repo's idprefix: '' / idseparator: '-' attributes — matching the xref
  used here.
• One wording fix went into core alongside this (owncloud/core@540592f), because
  the sample comment wrapped so that a line started with - , which AsciiDoc
  would have rendered as a stray list item on the generated page.

Related: OC10-133 (internal).

🤖 Generated with Claude Code