Update admin/overview to link to my server's specific security scan results
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
How to use GitHub
- Please use the 👍 reaction to show that you are interested in the same feature.
- Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
- Subscribe to receive notifications on status change and new comments.
Is your feature request related to a problem? Please describe.
- I keep a record of the nextcloud scan results URL for each of my servers
- I update the security scan results after each server update in case new technologies have introduced any recommended changes for my server configuration
- More admins would follow this practice if the scan URL from admin/overview went directly to the specific results for each server.
Describe the solution you'd like
"our security scan" on the admin overview page should link directly to the server's results
This can be done by:
- Add a config variable in config/config.php to hold the scan results details
- Update apps/settings/templates/settings/admin/overview.php to include the scan results details if configured
- Update
occ support:reportto consider 'scanresult' a sensitive value (not covered here)
Proof of Concept
- config/config.php
(for this proof-of-concept I included "/results/" in the config.php setting for 'scanresult', but this feels a bit kludgy...)
'scanresult' => '/results/my-server-specifc-scan-result-id',
- apps/settings/templates/settings/admin/overview.php
- <?php print_unescaped($l->t('Check the security of your Nextcloud over <a target="_blank" rel="noreferrer noopener" href="%s">our security scan ↗</a>.', ['https://scan.nextcloud.com']));?>`
+ <?php print_unescaped($l->t('Check the security of your Nextcloud over <a target="_blank" rel="noreferrer noopener" href="%s">our security scan ↗</a>.', ['https://scan.nextcloud.com'. \OC::$server->getSystemConfig()->getValue('scanresult')]));?>
Optimally
- the value of scanresult would be only the unique server identifier, not the entire URL as I have done above
- the text of the message would change if 'scanresult' is configured
Suggested alternative language:
-
If "scanresult" is
- configured (non-blank)
- appears valid (36 character hex value in 5 segments -
af3a7d24-4033-4dca-8b05-52bd28c39382
-
then the message would change to
Check and update your [Nextcloud security scan results ↗] (https://scan.nextcloud.com/results/[value-of-scanresult-from-config.php]) -
OTHERWISE use the current language:
Check the security of your Nextcloud over [our security scan ↗] (https://scan.nextcloud.com/).
Describe alternatives you've considered
This could also be addressed by making changes to both the web server at scan.nextcloud.com and the admin/overview hyperlink to securely pass a servername value (perhaps overwritehost) to the scan server search box
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with apps/settings/templates/settings/admin/overview.php and the system configuration access described in the issue, then review config/config.php and occ support:report. The work is done when a configured valid scan identifier links to that server's results, while an absent or invalid value keeps the current scan link and the configured value is treated as sensitive by occ support:report.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend, cli
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100