Data leak on strange Domains

[Mannshoch]

Nextcloud version (eg, 20.0.5): 27.1.4
Operating system and version (eg, Ubuntu 20.04): Synology DSM 7.2 U3

docker-compose.yml:

version: '2'

volumes:
  # nextcloud:
  db:

services:
  db:
    image: mariadb:lts
    restart: always
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    volumes:
      - db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=****
      - MYSQL_PASSWORD=****
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud

  app:
    image: nextcloud
    restart: always
    ports:
      - 8082:80
    links:
      - db
    volumes:
      - /volume1/docker/nextcloud/data:/var/www/html/data
      - /volume1/docker/nextcloud/config:/var/www/html/config
      - /volume1/docker/nextcloud/custom_apps:/var/www/html/custom_apps
      
    environment:
      - MYSQL_PASSWORD=****
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_HOST=db

The issue you are facing:

[internet_connection_check] Fehler: GuzzleHttp\Exception\ConnectException: cURL error 7: Failed to connect to www.edri.org port 80 after 0 ms: Couldn't connect to server (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for http://www.edri.org/ at <<closure>>

[internet_connection_check] Fehler: GuzzleHttp\Exception\ConnectException: cURL error 7: Failed to connect to www.eff.org port 80 after 5209 ms: Couldn't connect to server (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for http://www.eff.org/ at <<closure>>

[internet_connection_check] Fehler: GuzzleHttp\Exception\ConnectException: cURL error 7: Failed to connect to www.startpage.com port 80 after 200 ms: Couldn't connect to server (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for http://www.startpage.com/ at <<closure>>

Steps to replicate it:

1. Install Nextcloud
2. Remove lock internet connection
3. Check Log

The detailed logs do not show an addon that seems the cause.

[jtr]

It’s in the manual:

https://docs.nextcloud.com/server/latest/admin_manual/installation/harden_server.html#connections-to-remote-servers

You can also adjust them:

https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#connectivity-check-domains

Or if you don’t have outbound Internet from your server, you can indicate that:

https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#has-internet-connection

[Mannshoch]

I’m really disappointed! I trusted Nextcloud to work with care. Something like this I would only allow If I’m asked bevor.

Thanks for your help.