From 256077398cea63235f9e3fad5e747ee73034635a Mon Sep 17 00:00:00 2001 From: hoellen Date: Thu, 24 Sep 2026 12:30:26 +0200 Subject: [PATCH] fix: allow only setup check to disable TLS verification Also remove non-ascii chars from the configuration file as Snuffleupagus version 0.14 has issues with it --- rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules b/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules index 6da6ab2..ea07484 100644 --- a/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules +++ b/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules @@ -77,7 +77,7 @@ sp.disable_function.function("extract").param("array").value_r("^_").drop() sp.disable_function.function("extract").param("flags").value("0").drop() # This is also burned: -# ini_set('open_basedir','..');chdir('..');…;chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/etc/passwd')); +# ini_set('open_basedir','..');chdir('..');...;chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/etc/passwd')); # Since we have no way of matching on two parameters at the same time, we're # blocking calls to open_basedir altogether: nobody is using it via ini_set anyway. # Moreover, there are non-public bypasses that are also using this vector ;) @@ -132,6 +132,10 @@ sp.disable_function.function("is_callable").param("value").value("passthru").dro sp.disable_function.function("curl_setopt").param("value").value("1").allow(); sp.disable_function.function("curl_setopt").param("value").value("2").allow(); sp.disable_function.function("curl_setopt").param("value").value("TRUE").allow(); +# Turning the verification off is only legitimate for the setup checks that request the +# instance itself, `OCP\SetupCheck\CheckServerResponseTrait` uses `verify => false` for them +sp.disable_function.function("OC\\SetupCheck\\SetupCheckManager::run>curl_setopt").param("option").value("64").allow(); +sp.disable_function.function("OC\\SetupCheck\\SetupCheckManager::run>curl_setopt").param("option").value("81").allow(); # `81` is SSL_VERIFYHOST and `64` SSL_VERIFYPEER sp.disable_function.function("curl_setopt").param("option").value("64").drop().alias("Please don't turn CURLOPT_SSL_VERIFYCLIENT off."); sp.disable_function.function("curl_setopt").param("option").value("81").drop().alias("Please don't turn CURLOPT_SSL_VERIFYHOST off.");