How to test if my files are not accessible from the internet?

ernolf · May 28, 2024, 2:41pm

That warning is generated here:

nextcloud/server/blob/7e9f5238729c3d523c4b96507d297bb81a2a3397/core/templates/installation.php#L33


      
          			<?php else: ?>
          				<?php p($err); ?>
          			<?php endif; ?>
          		</p>
          		<?php endforeach; ?>
          	</fieldset>
          	<?php endif; ?>
          	<?php if (!$_['htaccessWorking']): ?>
          	<fieldset class="warning">
          		<legend><strong><?php p($l->t('Security warning'));?></strong></legend>
          		<p><?php p($l->t('Your data directory and files are probably accessible from the internet because the .htaccess file does not work.'));?><br>
          		<?php print_unescaped($l->t(
          			'For information how to properly configure your server, please see the <a href="%s" target="_blank" rel="noreferrer noopener">documentation</a>.',
          			[link_to_docs('admin-install')]
          		)); ?></p>
          	</fieldset>
          	<?php endif; ?>
          	<fieldset id="adminaccount">
          		<legend><?php print_unescaped($l->t('Create an <strong>admin account</strong>')); ?></legend>
          		<p>
          			<label for="adminlogin"><?php p($l->t('Login')); ?></label>

and is thrown if the environmental value htaccessWorking is not set.

That vallue is set in the .htaccess file in this line:

github.com

nextcloud/server/blob/7e9f5238729c3d523c4b96507d297bb81a2a3397/.htaccess#L63


      
            <FilesMatch "\.woff2?$">
              Header set Cache-Control "max-age=604800"
            </FilesMatch>
          </IfModule>
          
          <IfModule mod_php.c>
            php_value mbstring.func_overload 0
            php_value default_charset 'UTF-8'
            php_value output_buffering 0
            <IfModule mod_env.c>
              SetEnv htaccessWorking true
            </IfModule>
          </IfModule>
          
          <IfModule mod_mime.c>
            AddType image/svg+xml svg svgz
            AddType application/wasm wasm
            AddEncoding gzip svgz
            # Serve ESM javascript files (.mjs) with correct mime type
            AddType text/javascript js mjs
          </IfModule>

if mod_env is loaded in apache2.

Since you are on a hoster, it might be possible that mod_env is not loaded and that would explain why you got this message. Nothing else!

If you have got full access to your webserver, you could find out if mod_env is loaded with this call

~$ sudo apachectl -M 2>/dev/null | grep env_module

it should echo this:

 env_module (shared)

Much and good luck,
ernolf