LiteSpeed: document security considerations for INI overrides

Make it clear that the `alter_ini()` function is indeed meant to be operating
at the `ZEND_INI_SYSTEM` level, and document in the README file that only
trusted sources should be granted direct access to the listener.

Author: DanielEScherzer

sapi/litespeed/README.md

@@ -76,6 +76,14 @@ have lsphp bind to address 192.168.0.2:3000,
 
 have lsphp accept request on Unix domain socket `/tmp/lsphp_manual.sock`.
 
+### INI Security
+
+The lsphp listener must only be reachable by trusted sources, generally just 
+LiteSpeed web front end. Any source that can set its own environment variables
+can configure arbitrary PHP INI directives at the `ZEND_INI_SYSTEM` level for
+that request. This is the equivalent level of access as the Apache
+`php_admin_value` directive or the FPM's `PHP_ADMIN_VALUE` parameter.
+
 ## Using LiteSpeed PHP with LiteSpeed Web Server
 
 Detailed information about how to configure LiteSpeed web server with PHP

sapi/litespeed/lsapi_main.c

@@ -774,6 +774,11 @@ static int lsapi_module_main(int show_source)
 }
 
 
+/* The use of `type = ZEND_INI_SYSTEM when the key starts with `\x01\x04` is
+ * intentional - this is the mechanism by which LiteSpeed communicates the
+ * system-level INI options that should be set. This is only called from
+ * override_ini() with LSAPI_ForeachSpecialEnv(). See README.md in this
+ * directory for more details. */
 static int alter_ini( const char * pKey, int keyLen, const char * pValue, int valLen,
                 void * arg )
 {