hoellen/docker-nextcloud
1
0
Fork 0
mirror of https://github.com/hoellen/docker-nextcloud.git synced 2026-09-26 06:22:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow only setup check to disable TLS verification

Browse Source 
Also remove non-ascii chars from the configuration file as Snuffleupagus
version 0.14 has issues with it
This commit is contained in:
hoellen
2026-09-24 12:33:05 +02:00
parent c2e0954b77
commit 256077398c
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules
+5 -1
View File
@@ -77,7 +77,7 @@ sp.disable_function.function("extract").param("array").value_r("^_").drop()
sp.disable_function.function("extract").param("flags").value("0").drop() sp.disable_function.function("extract").param("flags").value("0").drop()
# This is also burned: # This is also burned:
# ini_set('open_basedir','..');chdir('..');…;chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/etc/passwd')); # ini_set('open_basedir','..');chdir('..');...;chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/etc/passwd'));
# Since we have no way of matching on two parameters at the same time, we're # Since we have no way of matching on two parameters at the same time, we're
# blocking calls to open_basedir altogether: nobody is using it via ini_set anyway. # blocking calls to open_basedir altogether: nobody is using it via ini_set anyway.
# Moreover, there are non-public bypasses that are also using this vector ;) # Moreover, there are non-public bypasses that are also using this vector ;)
@@ -132,6 +132,10 @@ sp.disable_function.function("is_callable").param("value").value("passthru").dro
sp.disable_function.function("curl_setopt").param("value").value("1").allow(); sp.disable_function.function("curl_setopt").param("value").value("1").allow();
sp.disable_function.function("curl_setopt").param("value").value("2").allow(); sp.disable_function.function("curl_setopt").param("value").value("2").allow();
sp.disable_function.function("curl_setopt").param("value").value("TRUE").allow(); sp.disable_function.function("curl_setopt").param("value").value("TRUE").allow();
# Turning the verification off is only legitimate for the setup checks that request the
# instance itself, `OCP\SetupCheck\CheckServerResponseTrait` uses `verify => false` for them
sp.disable_function.function("OC\\SetupCheck\\SetupCheckManager::run>curl_setopt").param("option").value("64").allow();
sp.disable_function.function("OC\\SetupCheck\\SetupCheckManager::run>curl_setopt").param("option").value("81").allow();
# `81` is SSL_VERIFYHOST and `64` SSL_VERIFYPEER # `81` is SSL_VERIFYHOST and `64` SSL_VERIFYPEER
sp.disable_function.function("curl_setopt").param("option").value("64").drop().alias("Please don't turn CURLOPT_SSL_VERIFYCLIENT off."); sp.disable_function.function("curl_setopt").param("option").value("64").drop().alias("Please don't turn CURLOPT_SSL_VERIFYCLIENT off.");
sp.disable_function.function("curl_setopt").param("option").value("81").drop().alias("Please don't turn CURLOPT_SSL_VERIFYHOST off."); sp.disable_function.function("curl_setopt").param("option").value("81").drop().alias("Please don't turn CURLOPT_SSL_VERIFYHOST off.");