fix: security errors and warnings (eb841c9d) · Commits · e / infra / ecloud / nextcloud

.env.example

+1 −1

Original line number	Diff line number	Diff line
		@@ -26,4 +26,4 @@ NEXTCLOUD_DOCKERFILE=slim.Dockerfile
		NEXTCLOUD_DOCKER_IMG=registry.gitlab.e.foundation/e/infra/ecloud/nextcloud/slim
		NEXTCLOUD_ADMIN_USER=admin
		NEXTCLOUD_ADMIN_PASSWORD=@dm1n
		NEXTCLOUD_TRUSTED_DOMAINS=localhost 192.168.0.1
		NEXTCLOUD_TRUSTED_DOMAINS=nginx

config/nginx/templates/default.conf.template

+2 −8

Original line number	Diff line number	Diff line
		@@ -25,7 +25,7 @@ server {
		# will add the domain to a hardcoded list that is shipped
		# in all major browsers and getting removed from this list
		# could take several months.
		#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
		add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;

		# set max upload size and increase upload timeout:
		client_max_body_size 512M;
		@@ -174,10 +174,4 @@ server {
		location / {
		try_files $uri $uri/ /index.php$request_uri;
		}

		# For the Rainloop admin message saying "data folder accessible"
		# It is a false positive as seen at https://github.com/pierre-alain-b/rainloop-nextcloud/issues/62
		location ^~/apps/rainloop/app/data {
		deny all;
		}
		}

hooks.d/post-installation/murena-config.json

+2 −2

Original line number	Diff line number	Diff line
		{
		"system": {
		"integrity.check.disabled": true,
		"profile.enabled": false,
		"defaultapp": "murena-dashboard,files",
		"theme": "eCloud",
		@@ -24,6 +23,7 @@
		],
		"preview_max_x": 1024,
		"preview_max_y": 1024,
		"default_phone_region": "FR"
		"default_phone_region": "FR",
		"maintenance_window_start": 1
		}
		}

hooks.d/post-installation/murena-theme.sh

+0 −3

Original line number	Diff line number	Diff line
		@@ -18,9 +18,6 @@ occ app:enable murena-dashboard
		occ app:enable murena_launcher
		occ app:enable snappymail

		occ app:enable suspicious_login
		occ app:enable bruteforcesettings
		occ app:enable twofactor_totp
		occ app:enable notes
		occ app:enable tasks
		occ app:enable sentry

slim.Dockerfile

+1 −32

Original line number	Diff line number	Diff line
		FROM nextcloud:29.0.14-fpm
		FROM nextcloud:29.0.16-fpm

		ARG BASE_DIR="/usr/src/nextcloud"
		ARG TMP_PATCH_DIR="/tmp/build_patches"

		ARG CONTACTS_URL="https://gitlab.e.foundation/api/v4/projects/1238/packages/generic/contacts/v5.5.3+murena-20250822/contacts-v5.5.3+murena-20250822.tar.gz"
		ARG CALENDAR_URL="https://gitlab.e.foundation/api/v4/projects/1199/packages/generic/calendar/v4.7.13+murena-20250822/calendar-v4.7.13+murena-20250822.tar.gz"
		@@ -45,36 +44,6 @@ RUN curl -sL ${SENTRY_URL} \| tar xzf - -C ${BASE_DIR}/custom_apps
		RUN curl -sL ${THEME_VERSION} \| tar xzf - -C ${BASE_DIR}/themes
		RUN curl -sL ${SNAPPY_THEME_VERSION} \| tar xzf - -C ${BASE_DIR}/themes/Murena/

		# Patches
		COPY patches/ ${TMP_PATCH_DIR}/
		RUN cd ${BASE_DIR} \
		&& patch -p0 < ${TMP_PATCH_DIR}/002-login-without-domain.patch \
		&& patch -u ${BASE_DIR}/apps/settings/lib/Settings/Personal/ServerDevNotice.php -i ${TMP_PATCH_DIR}/007-remove-dev-notice.patch \
		&& patch -p1 < ${TMP_PATCH_DIR}/009-help-links.patch \
		&& patch -u ${BASE_DIR}/lib/private/Updater.php -i ${TMP_PATCH_DIR}/010-disable-app-store-upgrade.patch \
		&& patch -p0 < ${TMP_PATCH_DIR}/011-privacy-settings.patch \
		&& patch -u ${BASE_DIR}/lib/private/Authentication/Token/PublicKeyTokenProvider.php -i ${TMP_PATCH_DIR}/013-revert-token-password-update.patch \
		&& patch -p0 < ${TMP_PATCH_DIR}/015-email-mail-template.patch \
		&& patch -u ${BASE_DIR}/core/Command/User/Setting.php -i ${TMP_PATCH_DIR}/018-occ-user-setting.patch \
		&& patch -u ${BASE_DIR}/3rdparty/sabre/vobject/lib/ITip/Broker.php -i ${TMP_PATCH_DIR}/022-significantchange.patch \
		&& patch -p0 < ${TMP_PATCH_DIR}/026-primary-color-fix.patch \
		&& patch -u ${BASE_DIR}/lib/private/Template/JSResourceLocator.php -i ${TMP_PATCH_DIR}/031-theme-custom-app-translations.patch \
		&& patch -u ${BASE_DIR}/lib/private/L10N/Factory.php -i ${TMP_PATCH_DIR}/032-select-lang-from-session.patch \
		&& patch -p1 < ${TMP_PATCH_DIR}/036-user-config-change-event.patch \
		&& patch -u ${BASE_DIR}/core/templates/layout.user.php -i ${TMP_PATCH_DIR}/003-contact-search-removal.patch \
		&& patch -u ${BASE_DIR}/core/Controller/ContactsMenuController.php -i ${TMP_PATCH_DIR}/004-contact-search-controller-removal.patch \
		&& patch -p0 < ${TMP_PATCH_DIR}/005-autocomplete-user-leak-core.patch \
		&& patch -u ${BASE_DIR}/core/templates/layout.guest.php -i ${TMP_PATCH_DIR}/016-login-screen.patch \
		&& patch -u ${BASE_DIR}/lib/private/Notification/Manager.php -i ${TMP_PATCH_DIR}/020-fairuse-notification-fix.patch \
		&& patch -u ${BASE_DIR}/lib/private/User/Manager.php -i ${TMP_PATCH_DIR}/025-optimize-get-by-email.patch \
		&& patch -u ${BASE_DIR}/apps/dav/lib/Connector/Sabre/Principal.php -i ${TMP_PATCH_DIR}/027-displayname-user-leak-dav.patch \
		&& patch -u ${BASE_DIR}/apps/dav/lib/HookManager.php -i ${TMP_PATCH_DIR}/028-default-task-calendar.patch \
		&& patch -u ${BASE_DIR}/apps/provisioning_api/lib/Controller/UsersController.php -i ${TMP_PATCH_DIR}/029-restrict-user-to-change-primary-email.patch \
		&& patch -u ${BASE_DIR}/lib/private/Security/VerificationToken/VerificationToken.php -i ${TMP_PATCH_DIR}/033-verification-token-private.patch \
		&& patch -u ${BASE_DIR}/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php -i ${TMP_PATCH_DIR}/034-oidc-bearer-token-auth.patch \
		&& rm -rf ${TMP_PATCH_DIR}


		COPY config/syslog-ng/syslog-ng.conf /etc/syslog-ng/syslog-ng.conf

		ENTRYPOINT ["/custom_entrypoint.sh"]