Skip to content

Commit

Permalink
only check for internal ip-address
Browse files Browse the repository at this point in the history
Signed-off-by: Simon L <szaimen@e.mail.de>
  • Loading branch information
szaimen committed Feb 21, 2023
1 parent 60399ac commit b8930bc
Showing 1 changed file with 4 additions and 8 deletions.
12 changes: 4 additions & 8 deletions Containers/nextcloud/entrypoint.sh
Original file line number Diff line number Diff line change
Expand Up @@ -438,8 +438,8 @@ if [ "$COLLABORA_ENABLED" = 'yes' ]; then
# Fix https://github.com/nextcloud/all-in-one/issues/188:
php /var/www/html/occ config:system:set allow_local_remote_servers --type=bool --value=true
# Make collabora more save
COLLABORA_IPv4_ADDRESS="$(echo "<?php echo gethostbyname('$NC_DOMAIN');" | php | head -1)"
COLLABORA_IPv6_ADDRESS="<?php \$record = dns_get_record('$NC_DOMAIN', DNS_AAAA);"
COLLABORA_IPv4_ADDRESS="$(echo "<?php echo gethostbyname('$COLLABORA_HOST');" | php | head -1)"
COLLABORA_IPv6_ADDRESS="<?php \$record = dns_get_record('$COLLABORA_HOST', DNS_AAAA);"
# shellcheck disable=SC2016
COLLABORA_IPv6_ADDRESS+='if (!empty($record)) {echo $record[0]["ipv6"];}'
COLLABORA_IPv6_ADDRESS="$(echo "$COLLABORA_IPv6_ADDRESS" | php | head -1)"
Expand All @@ -453,7 +453,7 @@ if [ "$COLLABORA_ENABLED" = 'yes' ]; then
fi
fi
else
echo "Warning: No ipv4-address found for $NC_DOMAIN."
echo "Warning: No ipv4-address found for $COLLABORA_HOST."
fi
if [ -n "$COLLABORA_IPv6_ADDRESS" ]; then
if ! echo "$COLLABORA_ALLOW_LIST" | grep -q "$COLLABORA_IPv6_ADDRESS"; then
Expand All @@ -464,13 +464,9 @@ if [ "$COLLABORA_ENABLED" = 'yes' ]; then
fi
fi
else
echo "No ipv6-address found for $NC_DOMAIN."
echo "No ipv6-address found for $COLLABORA_HOST."
fi
if [ -n "$COLLABORA_ALLOW_LIST" ]; then
PRIVATE_IP_RANGES='127.0.0.1/8,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,fd00::/8,::1'
if ! echo "$COLLABORA_ALLOW_LIST" | grep -q "$PRIVATE_IP_RANGES"; then
COLLABORA_ALLOW_LIST+=",$PRIVATE_IP_RANGES"
fi
php /var/www/html/occ config:app:set richdocuments wopi_allowlist --value="$COLLABORA_ALLOW_LIST"
else
echo "Warning: wopi_allowlist is empty which should not be the case!"
Expand Down

7 comments on commit b8930bc

@Zoey2936
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can I ask what this change means?

@szaimen
Copy link
Collaborator Author

@szaimen szaimen commented on b8930bc Feb 21, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is what @juliushaertl recommended in the beginning. But due to the user-proxy being enabled on my test-instance, this wasn't working. Now with the user-proxy disabled, it works and we don't need to add all the other ip-ranges. however we could still discuss if this change makes sense since it might break in reverse-proxy scenarios.

@Zoey2936
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure, what would be if a user has something running in docker, which requires user-land proxy?

@szaimen
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think user-proxy was deprecated a while ago and should not be used in the future anyway?

@szaimen
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Zoey2936
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But it seems to come with a lot of problems...

@szaimen
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah you are right. Then lets just document for if you get problems with it as I did in #2045.
I'll revert this then

Please sign in to comment.