瀏覽代碼

Fix nextcloud leak of version information

This could be of obvious use to adversaries
Bob Mottram 8 年之前
父節點
當前提交
32d89e951f
共有 1 個檔案被更改,包括 18 行新增0 行删除
  1. 18
    0
      src/freedombone-app-nextcloud

+ 18
- 0
src/freedombone-app-nextcloud 查看文件

483
         echo '  # Index' >> $nextcloud_nginx_site
483
         echo '  # Index' >> $nextcloud_nginx_site
484
         echo '  index index.php;' >> $nextcloud_nginx_site
484
         echo '  index index.php;' >> $nextcloud_nginx_site
485
         echo '' >> $nextcloud_nginx_site
485
         echo '' >> $nextcloud_nginx_site
486
+
487
+        # By default nextcloud advertises highly specific version information
488
+        # on status.php, which can obviously be used by adversaries.
489
+        # Blocking status.php prevents this information leak
490
+        echo '  location = /status.php {' >> $nextcloud_nginx_site
491
+        echo '    return 404;' >> $nextcloud_nginx_site
492
+        echo '  }' >> $nextcloud_nginx_site
493
+        echo '' >> $nextcloud_nginx_site
494
+
486
         echo '  # PHP' >> $nextcloud_nginx_site
495
         echo '  # PHP' >> $nextcloud_nginx_site
487
         echo '  location ~ \.php {' >> $nextcloud_nginx_site
496
         echo '  location ~ \.php {' >> $nextcloud_nginx_site
488
         echo '    include snippets/fastcgi-php.conf;' >> $nextcloud_nginx_site
497
         echo '    include snippets/fastcgi-php.conf;' >> $nextcloud_nginx_site
539
     echo '  # Index' >> $nextcloud_nginx_site
548
     echo '  # Index' >> $nextcloud_nginx_site
540
     echo '  index index.php;' >> $nextcloud_nginx_site
549
     echo '  index index.php;' >> $nextcloud_nginx_site
541
     echo '' >> $nextcloud_nginx_site
550
     echo '' >> $nextcloud_nginx_site
551
+
552
+    # By default nextcloud advertises highly specific version information
553
+    # on status.php, which can obviously be used by adversaries.
554
+    # Blocking status.php prevents this information leak
555
+    echo '  location = /status.php {' >> $nextcloud_nginx_site
556
+    echo '    return 404;' >> $nextcloud_nginx_site
557
+    echo '  }' >> $nextcloud_nginx_site
558
+    echo '' >> $nextcloud_nginx_site
559
+
542
     echo '  # PHP' >> $nextcloud_nginx_site
560
     echo '  # PHP' >> $nextcloud_nginx_site
543
     echo '  location ~ \.php {' >> $nextcloud_nginx_site
561
     echo '  location ~ \.php {' >> $nextcloud_nginx_site
544
     echo '    include snippets/fastcgi-php.conf;' >> $nextcloud_nginx_site
562
     echo '    include snippets/fastcgi-php.conf;' >> $nextcloud_nginx_site