hoellen/docker-nextcloud
1
0
Fork 0
mirror of https://github.com/hoellen/docker-nextcloud.git synced 2026-09-26 06:22:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: update Snuffleupagus rules for Nextcloud 35

Browse Source
This commit is contained in:
hoellen
2026-09-21 10:08:30 +02:00
parent 116a59c7f4
commit c2e0954b77
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules
+10 -7
View File
@@ -39,21 +39,23 @@ sp.cookie.name("PHPSESSID").samesite("lax");
# Nextcloud whitelist (tested with Nextcloud 35.0.0) # Nextcloud whitelist (tested with Nextcloud 35.0.0)
sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow(); sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/private/legacy/OC_Helper.php").allow(); sp.disable_function.function("function_exists").param("function").value("shell_exec").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/public/Util.php").allow();
sp.disable_function.function("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow(); sp.disable_function.function("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/process/Process.php").allow();
sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/3rdparty/symfony/process/ExecutableFinder.php").allow();
sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/public/Util.php").allow();
sp.disable_function.function("function_exists").param("function").value("shell_exec").filename("/nextcloud/apps/serverinfo/lib/OperatingSystems/Linux.php").allow();
sp.disable_function.function("shell_exec").param("command").value("ip route | awk '/default/ { print $3 }'").filename("/nextcloud/apps/serverinfo/lib/OperatingSystems/Linux.php").allow();
sp.disable_function.function("ini_set").param("option").value_r("display_errors").filename("/nextcloud/lib/OC.php").allow(); sp.disable_function.function("ini_set").param("option").value_r("display_errors").filename("/nextcloud/lib/OC.php").allow();
sp.disable_function.function("ini_set").param("option").value_r("display_errors").filename("/nextcloud/lib/base.php").allow();
sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow(); sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow();
sp.disable_function.function("ini_get").param("option").value_r("suhosin").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow(); sp.disable_function.function("ini_get").param("option").value_r("suhosin").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow();
sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/apps2/twofactor_webauthn/vendor/symfony/process/ExecutableFinder.php").allow(); sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/lib/private/Preview/Generator.php").allow();
sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/3rdparty/symfony/process/ExecutableFinder.php").allow();
sp.disable_function.function("ini_get").param("option").value("allow_url_fopen").filename("/nextcloud/3rdparty/guzzlehttp/guzzle/src/Utils.php").allow(); sp.disable_function.function("ini_get").param("option").value("allow_url_fopen").filename("/nextcloud/3rdparty/guzzlehttp/guzzle/src/Utils.php").allow();
sp.disable_function.function("exec").param("command").value("apachectl -M | grep mpm").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow(); sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow();
sp.disable_function.function("exec").param("command").value("apachectl -V | grep MPM").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow();
# Nextcloud inherently enables XXE-Protection since 27.0.1, therefore, drop setting a new external entity loader # Nextcloud inherently enables XXE-Protection since 27.0.1, therefore, drop setting a new external entity loader
sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/OC.php").allow(); sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/OC.php").allow();
sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/base.php").allow();
sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/apps2/user_saml/lib/Helper/TXmlHelper.php").allow(); sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/apps2/user_saml/lib/Helper/TXmlHelper.php").allow();
sp.disable_function.function("libxml_set_external_entity_loader").drop(); sp.disable_function.function("libxml_set_external_entity_loader").drop();
@@ -129,6 +131,7 @@ sp.disable_function.function("is_callable").param("value").value("passthru").dro
# Ensure that certificates are properly verified # Ensure that certificates are properly verified
sp.disable_function.function("curl_setopt").param("value").value("1").allow(); sp.disable_function.function("curl_setopt").param("value").value("1").allow();
sp.disable_function.function("curl_setopt").param("value").value("2").allow(); sp.disable_function.function("curl_setopt").param("value").value("2").allow();
sp.disable_function.function("curl_setopt").param("value").value("TRUE").allow();
# `81` is SSL_VERIFYHOST and `64` SSL_VERIFYPEER # `81` is SSL_VERIFYHOST and `64` SSL_VERIFYPEER
sp.disable_function.function("curl_setopt").param("option").value("64").drop().alias("Please don't turn CURLOPT_SSL_VERIFYCLIENT off."); sp.disable_function.function("curl_setopt").param("option").value("64").drop().alias("Please don't turn CURLOPT_SSL_VERIFYCLIENT off.");
sp.disable_function.function("curl_setopt").param("option").value("81").drop().alias("Please don't turn CURLOPT_SSL_VERIFYHOST off."); sp.disable_function.function("curl_setopt").param("option").value("81").drop().alias("Please don't turn CURLOPT_SSL_VERIFYHOST off.");