From 18da631215a0592a0d8f081e405578ff07ee940c Mon Sep 17 00:00:00 2001 From: hoellen Date: Thu, 21 Sep 2023 16:12:33 +0200 Subject: [PATCH] Drop call of libxml_set_external_entity_loader ref: - https://github.com/jvoisin/snuffleupagus/issues/463 - https://github.com/hoellen/docker-nextcloud/issues/42 --- rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules b/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules index 26b3497..e0fc1c3 100644 --- a/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules +++ b/rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules @@ -47,6 +47,10 @@ sp.disable_function.function("ini_get").param("option").value("open_basedir").fi sp.disable_function.function("ini_get").param("option").value("allow_url_fopen").filename("/nextcloud/3rdparty/guzzlehttp/guzzle/src/Utils.php").allow(); sp.disable_function.function("exec").param("command").value("apachectl -M | grep mpm").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow(); +# Nextcloud inherently enables XXE-Protection since 27.0.1, therefore, drop setting a new external entity loader +sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/base.php").allow(); +sp.disable_function.function("libxml_set_external_entity_loader").drop(); + # Harden the `chmod` function (0777 (oct = 511, 0666 = 438) sp.disable_function.function("chmod").param("permissions").value("438").drop(); sp.disable_function.function("chmod").param("permissions").value("511").drop();