Fresh install... Web server directory contents visible. Why? How?

Just now did a fresh install of Nextcloud on a new VM. I installed CentOS, Apache, PHP and MariaDB, and after that Nextcloud through the browser via setup-nextcloud.php.

Nothing has been done to or with this Nextcloud installation. It’s completely fresh and about two minutes old now.

I noticed that when in a browser I go to my https://nextcloud.domain.tld/apps/files/ or even https://nextcloud.domain.tld/apps (omitting index.php), I am presented with a web server directory listing…

How is this possible? I don’t suppose this is intended.
I checked /var/www/html/.htaccess, and in there it does say Options -Indexes, which I believe should prevent directory listings.
What am I missing? What did I do wrong?

(For the record… When I leave index.php in place, the default Nextcloud interface is shown and all seems to work like it should.)

Nextcloud version: 18.0.1
Operating system and version: CentOS 7.7.1908
Apache or nginx version: Apache 2.4.6
PHP version: 7.3.15

Why on earth are you editing .htaccess files if you have root powers and you can just go and edit /etc/httpd/httpd.conf? :smiley:

.htaccess functionality could be turned off from apache config.

However, it’s probably just a DirectoryIndex directive that’s gone missing: https://httpd.apache.org/docs/2.4/mod/mod_dir.html#directoryindex

I did not edit anything. I just checked the .htaccess if ‘Options -Indexes’ was present, because it seemed so odd Nextcloud would just show a directory listing.

But this question is not about .htaccess.

The question is: why on earth is it possible to show directory listings in the browser.

It’s apache’s default behavior.

I don’t believe Nextcloud would want that to happen.
I’d like to believe they would want to prevent that from happening.
It seems odd to make something so elaborate as Nextcloud, and then leave directory listings open?
I can’t help but assume this is bug in some way.

I agree, and I suppose that’s why they ship that .htaccess file. But .htaccess files are not infallible.

Check the virtualhost config and put your directives there, please.

THIS!

Of course. Totally forgot about that one.
So it’s not Nextcloud. It was an apache config setting I forgot, that enables/disables .htaccess…

Thanks.

1 Like