#### Warning! RainLoop data folder is accessible

🍱 Features & apps rainloop
1

Fresh install of NC.
Added Rainloop
Get this warning

Warning!

RainLoop data folder is accessible. Please configure your web server to hide the data folder from external access. Read more here

Added .htaccess in /…data/rainloop-storage/
restarted Apache.
No luck, still same error

How to get rid of the Warning and secure the files

Cheers

[Contents of .htaccess]

Generated by Nextcloud on 2018-05-28 16:45:06

line below if for Apache 2.4

Require all denied

line below if for Apache 2.2

<ifModule !mod_authz_core.c>
deny from all
Satisfy All

section for Apache 2.2 and 2.4

IndexIgnore *
2

You simply have to deny access for the folder /apps/rainloop/app/data inside your Nextcloud installation.
I only use nginx, but here you have to define a location block inside your Nextcloud vHost:

        location ^~ /apps/rainloop/app/data {
                deny all;
        }

You’ll need something similar for Apache.

1 Like
3

Added in /etc/apache2/sites-enabled/nextcloud.conf

<Directory /var/www/nextcloud/apps/rainloop/app/data/>
Require all denied

<Directory /media/USBdrive/data/rainloop-storage/>
Require all denied

Sudo service apache2 restart

  1. Also tried
    …
    AllowOverride All
    …

and added .htaccess with
Require all denied
in the subsequent directories

Sudo service apache2 restart

No results.
Still get the warning… Any clues ?

4

Would be interested in a solution as well.
I have setup Rainloop yesterday and struggeling getting rid of the error.
My “data storage” is located outside the WWW directory on a mounted NFS share, this is also the location of rainloop_storage. rights are assigned to www-data but still. I have no idea how to get rid of the error.

What I tried

apache2.conf
<Directory /media/nfs-share/rainloop_storage/data>
   Options -Indexes
   Deny from all
</Directory>
<Directory /var/www/html/nextcloud/apps/rainloop/app/data>
   Options -Indexes
   Deny from all
</Directory>

and .htaccess in media/nfs-share/rainloop_storage/data and /var/www/html/nextcloud/apps/rainloop/app/data

Deny from all

With www-data:www-data as owner

Still the same error, I I try to access the data directory somehow from the browser, I get redirected to Nextcloud file view

5

I cannot access the Rainloop storage folder from any browser. Ubuntu 16.04, Apache 2.4. There is the .htaccess file from the /data/rainloop-storage folder actually:

/data/rainloop-storage# cat .htaccess 
Deny from all
<IfModule mod_autoindex.c>
Options -Indexes

It should put these files into the data directory too to prevent access from outside:

/data/rainloop-storage# ls
_data_  index.html  index.php  INSTALLED  SALT.php  VERSION

If this is not the case then something with your installation went wrong. The files are generated here:

6

None of these files were created.
Not sure if I can do anything wrong when activating an app from nextcloud directly, but ok.

Is there a log of things going wrong?
Do I need to place the .htaccess now into
/media/nextcloud-data/rainloop-storage/_data_
or
/media/nextcloud-data/rainloop-storage/
or/and
/var/www/html/nextcloud/apps
or
/var/www/html/nextcloud/apps/rainloop/app

This is all not really documented, nor do I understand completely how and what is parsed when.
Perhaps it is even a bug, because all files are there accept this ones, seems strange.

7

It should in the data folder like /var/www/nextcloud/data/rainloop-storage/.

Could be, maybe you should report a bug if the files are not created. Did you check the permissions on that folder?

8

Thanks, I filed a bug because I am out of ideas

9

Hello, this issue is mentioned in this ticket: https://github.com/pierre-alain-b/rainloop-nextcloud/issues/62.

Our analysis so far is that:

  • the data folder is not accessible
  • it is a false positive triggered by the fact that Rainloop checks the status code of the request to one file in the data folder but as Nextcloud redirects the request with a 3xx status code then Rainloop does interprete this as an insecured folder

I should push a change in the Rainloop base code to differentiate a “true” access and a redirect by Nextcloud.

Unless I miss something, there is no security risk for now even with the error message popping up.

5 Likes