Having used Processwire 1.0 - aka Dictator - for some 7 years now without a single hiccough or security issue - and no patches! - I know that PW is worth it - so thanks for caring enough TO resolve it!
FWIW, why would you ever have "~" in your path? This is a dev server that I don't care to ever have as an actual domain - and the "IP/~account" is Apache's way of accessing account directories created in the home folder...so I'll probably do it again - glad it's an easy, top down "fix".
Malheur on my tab next time I'm there!