From c2e0954b772ed040cf93b550658097eccb1bb289 Mon Sep 17 00:00:00 2001 From: hoellen Date: Mon, 21 Sep 2026 10:08:30 +0200 Subject: [PATCH] fix: update Snuffleupagus rules for Nextcloud 35 --- .../etc/php/snuffleupagus/nextcloud-php8.rules | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules b/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules index e5b8c99..6da6ab2 100644 --- a/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules +++ b/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules @@ -39,21 +39,23 @@ sp.cookie.name("PHPSESSID").samesite("lax"); # Nextcloud whitelist (tested with Nextcloud 35.0.0) sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow(); -sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/private/legacy/OC_Helper.php").allow(); -sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/public/Util.php").allow(); +sp.disable_function.function("function_exists").param("function").value("shell_exec").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow(); sp.disable_function.function("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow(); +sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/process/Process.php").allow(); +sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/3rdparty/symfony/process/ExecutableFinder.php").allow(); +sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/public/Util.php").allow(); +sp.disable_function.function("function_exists").param("function").value("shell_exec").filename("/nextcloud/apps/serverinfo/lib/OperatingSystems/Linux.php").allow(); +sp.disable_function.function("shell_exec").param("command").value("ip route | awk '/default/ { print $3 }'").filename("/nextcloud/apps/serverinfo/lib/OperatingSystems/Linux.php").allow(); sp.disable_function.function("ini_set").param("option").value_r("display_errors").filename("/nextcloud/lib/OC.php").allow(); -sp.disable_function.function("ini_set").param("option").value_r("display_errors").filename("/nextcloud/lib/base.php").allow(); sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow(); sp.disable_function.function("ini_get").param("option").value_r("suhosin").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow(); -sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/apps2/twofactor_webauthn/vendor/symfony/process/ExecutableFinder.php").allow(); -sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/3rdparty/symfony/process/ExecutableFinder.php").allow(); +sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/lib/private/Preview/Generator.php").allow(); sp.disable_function.function("ini_get").param("option").value("allow_url_fopen").filename("/nextcloud/3rdparty/guzzlehttp/guzzle/src/Utils.php").allow(); -sp.disable_function.function("exec").param("command").value("apachectl -M | grep mpm").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow(); +sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow(); +sp.disable_function.function("exec").param("command").value("apachectl -V | grep MPM").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow(); # Nextcloud inherently enables XXE-Protection since 27.0.1, therefore, drop setting a new external entity loader sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/OC.php").allow(); -sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/base.php").allow(); sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/apps2/user_saml/lib/Helper/TXmlHelper.php").allow(); sp.disable_function.function("libxml_set_external_entity_loader").drop(); @@ -129,6 +131,7 @@ sp.disable_function.function("is_callable").param("value").value("passthru").dro # Ensure that certificates are properly verified sp.disable_function.function("curl_setopt").param("value").value("1").allow(); sp.disable_function.function("curl_setopt").param("value").value("2").allow(); +sp.disable_function.function("curl_setopt").param("value").value("TRUE").allow(); # `81` is SSL_VERIFYHOST and `64` SSL_VERIFYPEER sp.disable_function.function("curl_setopt").param("option").value("64").drop().alias("Please don't turn CURLOPT_SSL_VERIFYCLIENT off."); sp.disable_function.function("curl_setopt").param("option").value("81").drop().alias("Please don't turn CURLOPT_SSL_VERIFYHOST off.");