Enhancement: additional options when viruses are detected

[Forza-tng]

Steps to reproduce

1. Enable Antivirus for files
2. Go to Security Settings
3. Select drop down "When infected files..."

Expected behaviour

• I would like an option to send an admin notice
• I would like an option to send an email
• I would like an option to quaratine

Actual behaviour

Only log and Delete file are the only available options

Server configuration

Operating system:
Gentoo Linux: Kernel 5.17.15

Web server:
Caddy v2.5.1

Database:
MariaDB 10.6.8

PHP version:
PHP with FPM 8.1.8

Nextcloud version: (see Nextcloud admin page)
24.0.3.2

Where did you install Nextcloud from:
Initially used Gentoo Portage, but changed to use occ upgrade

[julian70400]

Yes, email notification to admin would be wonderfull and really usefull !

Actually, we - admin - are notifyed by nothing.. If there is something wrong, if user don't see the small notification, nothing happened except quarantine or delete.

As admin, we need to be alerted by mail.

[tx0h]

i just added a pull request which adds a virus warning to the suspected files filename. it is simple to do and you could take it as a scheme for your own needs.

[komoricodrutz]

Hi. I would also add some other possible useful features:

1. Regarding the suggestion above: Perhaps even easier than sending an e-mail, the option to notify the current user himself and the admin user(s) by means of the nextcloud notifications system.
2. An option to quarantine would indeed be beneficial.
3. Perhaps a multiple selection available in that "When infected..." dropdown menu for possible actions.
4. If the option to delete was selected, perhaps when deleting, replacing the file with a text file called "[initialfilename]-Deleted by antivirus" or something like that. This would make the antivirus activity more transparent to the user and serve to also caution them that they may possibly be infected (especially important if the user does not use the Web UI so often and relies on the desktop client app for syncing).
5. Currently, if you are syncing files with the desktop client app, the upload of infected files still takes place, relying on the background scan to actually detect and to remove the file (only if the option was selected). But between those background scans, the file is already on the server, allowing other users to potentially become infected (if it is a shared folder, especially if that shared folder is also synced with other desktop clients)... So perhaps a scan during file creation on the server should also take place, just as it does in the web ui and at least block the upload, if not delete it from the client computer's synced folder or quarantining it.
6. A dedicated, easily accessible log location in the ui, thus removing the need for admins to sift through all the logs in order to find antivirus events.
7. And perhaps also some hints in the UI about the signatures, database version, last update, etc, perhaps also including the option to manually run a freshclam and see the output of the freshclam process.

[Kamilcuk]

Hello. Many my files were just wiped out in the background throughout months without me even noticing, including for example an X-ray in an .iso file received from a hospital. In my opinion, an option to just move the files to some location instead of just crude force deletion is just a must-have for antivirus tool. I vote to prioritize this enhancement if possible, if not, just implement the ability to execute a custom script with the filename as an argument - then users can do what they want. Thanks.

[4oo4]

Just discovered this setting in clamd.conf, which looks like it might be a good workaround for now, to run a custom script upon detection. However this definitely isn't a replacement for any of the suggested features for this (especially those proposed by @komoricodrutz). This is super important info that should be more visible/actionable inside Nextcloud itself.

# Execute a command when virus is found.
# Use the following environment variables to identify the file and virus names:
# - $CLAM_VIRUSEVENT_FILENAME
# - $CLAM_VIRUSEVENT_VIRUSNAME
# In the command string, '%v' will also be replaced with the virus name.
# Note: The '%f' filename format character has been disabled and will no longer
# be replaced with the file name, due to command injection security concerns.
# Use the 'CLAM_VIRUSEVENT_FILENAME' environment variable instead.
# For the same reason, you should NOT use the environment variables in the
# command directly, but should use it carefully from your executed script.
# Default: no
#VirusEvent /opt/send_virus_alert_sms.sh