Merge pull request #15144 from nextcloud/backport/15102/stable34

[stable34] docs: block access to metadata files in nginx sample configs

Author: szaimen

admin_manual/installation/nginx-root.conf.sample

@@ -1,5 +1,5 @@
 # Nextcloud nginx configuration — root installation
-# Version 2026-03-26
+# Version 2026-06-09
 
 # PHP-FPM backend.
 upstream php-handler {
@@ -151,6 +151,10 @@ server {
     location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
     location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
 
+    # Hide metadata files which would otherwise be served as plain files and
+    # leak dependency information (composer.json, package.json, core/shipped.json).
+    location ~ ^/(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ { return 404; }
+
     # Pass PHP requests to PHP-FPM.
     #
     # Important: this block must appear above the static asset locations

admin_manual/installation/nginx-subdir.conf.sample

@@ -1,5 +1,5 @@
 # Nextcloud nginx configuration — subdirectory installation (/nextcloud)
-# Version 2026-03-26
+# Version 2026-06-09
 
 # PHP-FPM backend.
 upstream php-handler {
@@ -151,6 +151,10 @@ server {
         location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)    { return 404; }
         location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console)                  { return 404; }
 
+        # Hide metadata files which would otherwise be served as plain files and
+        # leak dependency information (composer.json, package.json, core/shipped.json).
+        location ~ ^/nextcloud/(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ { return 404; }
+
         # Pass PHP requests to PHP-FPM.
         #
         # Important: this block must appear above the static asset locations