nextcloud / nextcloud/server

modified .user.ini integrity check fails

Open
#19,935 29 comments 11 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage 25-feedback bug feature: install and update
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

How to use GitHub
  • Please use the 👍 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
Steps to reproduce
  1. Install Nextcloud 18.0.2 with nginx and php-fpm7.3 as webserver/php-runner
  2. modify .user.ini with own custom settings, as described in https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/big_file_upload_configuration.html
    for example, my new .user.ini:
mbstring.func_overload=0
always_populate_raw_post_data=-1
default_charset='UTF-8'
output_buffering=0

upload_max_filesize = 10G
post_max_size = 10G
memory_limit = 512M
max_execution_time = 300
Expected behaviour

occ integrity:check-core should succeed if i don't modify any predefined values.

Actual behaviour

occ integrity:check-core fails with:

  - INVALID_HASH:
    - .user.ini:
      - expected: 4843b3217e91f8536cb9b52700efb20300290292cf6286f92794d4cec99df286afeb7dd6c91b1be20bc55eda541eef230a5c5e7dcd46c189edd0ed1e80c6d3f5
      - current: c2b18102f728f15c56050a6d12e1aed9e4e4b2ad2be4864cbe22f919837698ad785051feb62275098effa6e99952a3ae44dce88496050064657a0f23cb4876f1

I know this was an issue before (#115) so i thought this should work, or am i missing something?

Server configuration

Operating system:
Debian 10 stable
Web server:
nginx 1.14.2
Database:
postgresql 11.6
PHP version:
php-fpm
Nextcloud version: (see Nextcloud admin page)
18.0.2.2
Updated from an older Nextcloud/ownCloud or fresh install:
Updated from 18.0.1. But is also reproducible on a new installation.
Where did you install Nextcloud from:
Nextcloud website download
Signing status:

Signing status 
Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.

Results
=======
- core
	- INVALID_HASH
		- .user.ini

Raw output
==========
Array
(
    [core] => Array
        (
            [INVALID_HASH] => Array
                (
                    [.user.ini] => Array
                        (
                            [expected] => 4843b3217e91f8536cb9b52700efb20300290292cf6286f92794d4cec99df286afeb7dd6c91b1be20bc55eda541eef230a5c5e7dcd46c189edd0ed1e80c6d3f5
                            [current] => c2b18102f728f15c56050a6d12e1aed9e4e4b2ad2be4864cbe22f919837698ad785051feb62275098effa6e99952a3ae44dce88496050064657a0f23cb4876f1
                        )

                )

        )

)

List of activated apps:

App list 
Enabled:
  - accessibility: 1.4.0
  - activity: 2.11.0
  - bruteforcesettings: 1.5.0
  - calendar: 2.0.2
  - camerarawpreviews: 0.7.3
  - checksum: 0.4.4
  - cloud_federation_api: 1.1.0
  - comments: 1.8.0
  - contacts: 3.2.0
  - dav: 1.14.0
  - documentserver_community: 0.1.5
  - federatedfilesharing: 1.8.0
  - federation: 1.8.0
  - files: 1.13.1
  - files_pdfviewer: 1.7.0
  - files_rightclick: 0.15.2
  - files_sharing: 1.10.1
  - files_trashbin: 1.8.0
  - files_versions: 1.11.0
  - files_videoplayer: 1.7.0
  - firstrunwizard: 2.7.0
  - logreader: 2.3.0
  - lookup_server_connector: 1.6.0
  - nextcloud_announcements: 1.7.0
  - notifications: 2.6.0
  - oauth2: 1.6.0
  - onlyoffice: 4.1.4
  - password_policy: 1.8.0
  - photos: 1.0.0
  - privacy: 1.2.0
  - provisioning_api: 1.8.0
  - recommendations: 0.6.0
  - serverinfo: 1.8.0
  - settings: 1.0.0
  - sharebymail: 1.8.0
  - support: 1.1.0
  - survey_client: 1.6.0
  - systemtags: 1.8.0
  - tasks: 0.12.1
  - text: 2.0.0
  - theming: 1.9.0
  - twofactor_backupcodes: 1.7.0
  - updatenotification: 1.8.0
  - viewer: 1.2.0
  - workflowengine: 2.0.0
Disabled:
  - admin_audit
  - encryption
  - files_external
  - user_ldap

Nextcloud configuration:

Config report 
{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.drimpf.de"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "18.0.2.2",
        "overwrite.cli.url": "https:\/\/cloud.drimpf.de",
        "htaccess.RewriteBase": "\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "skeletondirectory": "",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "dbindex": 1
        },
        "maintenance": false,
        "loglevel": 2,
        "mail_smtpmode": "sendmail",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "tls",
        "mail_smtpauth": 1,
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "theme": "",
        "updater.release.channel": "beta",
        "updater.secret": "***REMOVED SENSITIVE VALUE***"
    }
}

Are you using external storage, if yes which one: no

Are you using encryption: no

Are you using an external user-backend, if yes which one: no

Client configuration

Browser:
Firefox 73.0.1
Operating system:
macOS 10.15.3 (19D76)

Logs
Web server error log
Web server error log 
empty
Nextcloud log (data/nextcloud.log)
Nextcloud log 
empty

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with a modified .user.ini and occ integrity:check-core on the reported Nextcloud setup. Read the integrity-check implementation and the .user.ini handling to determine why custom PHP settings change the reported hash. Done means supported .user.ini customizations no longer produce INVALID_HASH while genuine core modifications remain detectable.

Written by the indexing model from the issue text.

Assessment

Tech stack
nginx, php
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.