hoellen/docker-nextcloud
1
0
Fork 0
mirror of https://github.com/hoellen/docker-nextcloud.git synced 2025-07-01 15:46:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: disable snuffleupagus xxe protection

Browse Source 
Nextcloud now prevents loading external entities by using libxml_set_external_entity_loader.

ref:
https://github.com/nextcloud/server/pull/39490
https://github.com/hoellen/docker-nextcloud/issues/42
This commit is contained in:
hoellen
2023-07-25 06:34:32 +02:00
parent 9070495ad0
commit 2d3fd8f5c3
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules
View File

@ -8,7 +8,7 @@
sp.harden_random.enable();
# Disabled XXE
sp.xxe_protection.enable();
#sp.xxe_protection.enable();
# Global configuration variables
# sp.global.secret_key("YOU _DO_ NEED TO CHANGE THIS WITH SOME RANDOM CHARACTERS.");
@ -34,7 +34,7 @@ sp.sloppy_comparison.enable();
# https://snuffleupagus.readthedocs.io/features.html#protection-against-cross-site-request-forgery
sp.cookie.name("PHPSESSID").samesite("lax");
# Nextcloud whitelist (tested with Nextcloud 25.0.0)
# Nextcloud whitelist (tested with Nextcloud 27.0.1)
sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/private/legacy/OC_Helper.php").allow();
sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/public/Util.php").allow();