nextcloud / nextcloud/nextcloudpi
Modsecurity prevents update of contacts
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 2.9k
- Forks
- 318
- PR merge metrics
- No merged PRs in 30d
Description
The default configuration of NCP with modsecurity seems to have an issue when handling vcard files.
Setup: current docker instance of NCP with modsecurity enabled, latest updates
Steps to reproduce:
- create new contact
- save contact (successful)
- change contact data
- request error 500 on saving the contact
- data is lost after site refresh
Steps 3-5 are successfull with disabled modsecurity.
Solution:
- create exception for addressbooksync
The corresponding logfile/line:
[Sat Jan 18 17:39:21.463016 2020] [:error] [pid 23201:tid 1817326624] [client xxxxxx] [client xxxxxxx] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "xxxxxxxx"] [uri "/remote.php/dav/addressbooks/users/xxxxxx/xxxxxx/xxxxxx-2DA4-4988-8FC6-xxxxxxxxxx.vcf"] [unique_id "XiNCyZLwCYQ4v2CWduyWOQAAShg"]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the default ModSecurity configuration in the Docker-based setup and the logged DAV request for the .vcf file. Reproduce the contact update with ModSecurity enabled, then verify that an exception for addressbooksync prevents the 500 response and preserves updated contact data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100