Htaccess warning while configuration should be OK

[MichaIng]

Yeah, just testet the following with Satisfy Any inside nextcloud apache config:

• Actually my data directory is outside of nextcloud folder on external drive, so in my case there is no security issue with this.
• But some script created an (unused) data directory in my nextcloud folder and a recent occ maintenance:update:htaccess created the /nextcloud/data/.htaccess file, which is/should be perfectly in use, since AllowOverride All is in place and redirection to pretty URLs + file upload size works by /nextcloud/.htaccess perfectly well.
• I created a test file /nextcloud/data/<user>/test besides the already existing /nextcloud/data/index.html.
• Actually pretty URLs redirects all access tries to the test file to the nextcloud base URL (but /data/index.html IS indeed accessible!), so I disabled pretty URLs inside /nextcloud/.htaccess, which by the way can not influence access rights to /nextcloud/data/ with it’s own .htaccess file.
• Afterwards is WAS able to access and read the test file inside browser!! Crazy shit!
• Next I removed Satisfy Any from nextcloud apache config and access tries to test file as well as index.html got answered with “Access forbidden” as it should be.

Just to answer every doubt, /data/.htaccess looks like this:

# Generated by Nextcloud on 2017-06-02 11:21:34
# line below if for Apache 2.4
<ifModule mod_authz_core.c>
Require all denied
</ifModule>

# line below if for Apache 2.2
<ifModule !mod_authz_core.c>
deny from all
Satisfy All
</ifModule>

# section for Apache 2.2 and 2.4
<ifModule mod_autoindex.c>
IndexIgnore *
</ifModule>

“Require all denied” seems to be without effect if “Satisfy Any” is set. I use apache 2.4.25 btw.

From my point of view this is a huge security issue, as the admin manual more less recommends this setting, if you don’t know about parent folder authentication that might be there. The hint should be completely removed from admin manual. Even a big red warning about this, if data directory is inside nextcloud (which is default) is not enough for my point of view. If one really uses parent directory authentication, one would know it, has to move nextcloud to different location or whatever, but “Satisfy Any” really breaks every permissions attempt by nextclouds .htaccess. Even that admin manual gives warning about accessible data, if users don’t find the reason and instead find .htaccess work perfectly fine, they could ignore it. Also the warning does not clearly say that files ARE accessible, just that they MIGHT BE, which is also no good solution in my opinion.

I will directly open a github issue about this! Crazy nobody found it so far, as it is so easily reproducible .

€:

Data folder accessible if "Satisfy Any" is set