chore: update Nextcloud to 33.0.8

Dockerfile

@@ -1,7 +1,7 @@
 # -------------- Build-time variables --------------
-ARG NEXTCLOUD_VERSION=34.0.3
-ARG PHP_VERSION=8.5
-ARG NGINX_VERSION=1.30
+ARG NEXTCLOUD_VERSION=33.0.8
+ARG PHP_VERSION=8.4
+ARG NGINX_VERSION=1.28
 
 ARG ALPINE_VERSION=3.23
 ARG HARDENED_MALLOC_VERSION=14
@@ -10,8 +10,8 @@ ARG SNUFFLEUPAGUS_VERSION=0.13.0
 ARG UID=1000
 ARG GID=1000
 
-# nextcloud-34.0.3.tar.bz2
-ARG SHA256_SUM="d7ed36ac0e14a2d9bbd167d6f6d4fc498f0f39fcccdf304e67e35bfc42e4506d"
+# nextcloud-33.0.8.tar.bz2
+ARG SHA256_SUM="70bad597b1e31002b04c03c80bf90f97f05e5d7ec91e4283439813149df22eff"
 
 # Nextcloud Security <security@nextcloud.com> (D75899B9A724937A)
 ARG GPG_FINGERPRINT="2880 6A87 8AE4 23A2 8372  792E D758 99B9 A724 937A"
@@ -62,6 +62,7 @@ RUN apk -U upgrade \
         bz2 \
         intl \
         ldap \
+        opcache \
         pcntl \
         pdo_mysql \
         pdo_pgsql \

rootfs/usr/local/etc/php/conf.d/docker-php-ext-opcache.ini

@@ -1,3 +1,4 @@
+zend_extension=opcache.so
 opcache.enable=1
 opcache.enable_cli=1
 opcache.memory_consumption=<OPCACHE_MEM_SIZE>

rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules

@@ -15,10 +15,7 @@ sp.harden_random.enable();
 
 # Globally activate strict mode
 # https://www.php.net/manual/en/language.types.declarations.php#language.types.declarations.strict
-# Disabled: PHP 8.5 expanded strict_types=1 to reject implicit object->string
-# coercion via __toString(). This breaks symfony/console Helper::substr() which
-# returns UnicodeString from a :string method. No per-file exclusion available.
-# sp.global_strict.enable();
+sp.global_strict.enable();
 
 # Prevent unserialize-related exploits
 # sp.unserialize_hmac.enable();
@@ -37,7 +34,7 @@ sp.sloppy_comparison.enable();
 # https://snuffleupagus.readthedocs.io/features.html#protection-against-cross-site-request-forgery
 sp.cookie.name("PHPSESSID").samesite("lax");
 
-# Nextcloud whitelist (tested with Nextcloud 34.0.0)
+# Nextcloud whitelist (tested with Nextcloud 27.0.1)
 sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
 sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/private/legacy/OC_Helper.php").allow();
 sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/public/Util.php").allow();
@@ -52,7 +49,6 @@ sp.disable_function.function("exec").param("command").value("apachectl -M | grep
 
 # Nextcloud inherently enables XXE-Protection since 27.0.1, therefore, drop setting a new external entity loader
 sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/base.php").allow(); 
-sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/apps2/user_saml/lib/Helper/TXmlHelper.php").allow();
 sp.disable_function.function("libxml_set_external_entity_loader").drop(); 
 
 # Harden the `chmod` function (0777 (oct = 511, 0666 = 438)