From bc41c34d1865c5d53aa99e1695de2e0fea577550 Mon Sep 17 00:00:00 2001 From: "Simon L." Date: Tue, 9 Jun 2026 18:05:09 +0200 Subject: [PATCH] docs: block access to metadata files in nginx sample configs The nginx sample configs served top-level metadata files (composer.json, composer.lock, package.json, package-lock.json, core/shipped.json) as plain files, since they matched neither a 404 block nor the static-asset extension list and fell through to `try_files $uri`. This leaked dependency information. Add a 404 location block matching these files to both the root and subdir sample configs, alongside the existing rules that hide non-public paths. Fixes #15101 Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Simon L. --- admin_manual/installation/nginx-root.conf.sample | 6 +++++- admin_manual/installation/nginx-subdir.conf.sample | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/admin_manual/installation/nginx-root.conf.sample b/admin_manual/installation/nginx-root.conf.sample index ef701f6230b..b14f6ac34af 100644 --- a/admin_manual/installation/nginx-root.conf.sample +++ b/admin_manual/installation/nginx-root.conf.sample @@ -1,5 +1,5 @@ # Nextcloud nginx configuration — root installation -# Version 2026-03-26 +# Version 2026-06-09 # PHP-FPM backend. upstream php-handler { @@ -151,6 +151,10 @@ server { location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } + # Hide metadata files which would otherwise be served as plain files and + # leak dependency information (composer.json, package.json, core/shipped.json). + location ~ ^/(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ { return 404; } + # Pass PHP requests to PHP-FPM. # # Important: this block must appear above the static asset locations diff --git a/admin_manual/installation/nginx-subdir.conf.sample b/admin_manual/installation/nginx-subdir.conf.sample index 4afc823a67d..714269605f0 100644 --- a/admin_manual/installation/nginx-subdir.conf.sample +++ b/admin_manual/installation/nginx-subdir.conf.sample @@ -1,5 +1,5 @@ # Nextcloud nginx configuration — subdirectory installation (/nextcloud) -# Version 2026-03-26 +# Version 2026-06-09 # PHP-FPM backend. upstream php-handler { @@ -151,6 +151,10 @@ server { location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } + # Hide metadata files which would otherwise be served as plain files and + # leak dependency information (composer.json, package.json, core/shipped.json). + location ~ ^/nextcloud/(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ { return 404; } + # Pass PHP requests to PHP-FPM. # # Important: this block must appear above the static asset locations