nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-02-26 14:04:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/nextcloud: make profile.enabled configurable

Browse Source 
I recently learned that Nextcloud 23's new profile feature — basically a
way for users to share personal contact details — has a problematic
default setting, profile data is shared with **everyone** by default.

This means that an unauthenticated user can access personal information
by accessing `nextcloud.tld/u/user.name`.

The announcement of v23 states[1]:

> We go a step further and introduce a profile page. Here you can put a
> description of yourself, show links to, for example, social media, what
> department you are in and information on how to contact you. All these
> are of course entirely optional and you can choose what is visible to who!
> The profile and user status are accessible also from our mobile and desktop clients.

It's not mentioned that by default you share personal information[3] with
everyone and personally I think that's somewhat problematic.

To work around that, I decided to add an option for the recently added[2]
and even set it to `false` by default to make an explicit opt-in for
that feature.

[1] https://nextcloud.com/blog/nextcloud-hub-2-brings-major-overhaul-introducing-nextcloud-office-p2p-backup-and-more/
[2] https://github.com/nextcloud/server/pull/31624/files
[3] By default, this affects the following properties:
    * About
    * Full name
    * Headline
    * Organisation
    * Profile picture
    * Role
    * Twitter
    * Website
    Phone, Address and Email are not affected and only shown to
    authenticated users by default.
This commit is contained in:
Maximilian Bosch 2022-04-23 13:17:51 +02:00
parent d40bc361cc
commit 9931c4a407
No known key found for this signature in database
GPG Key ID: 091DBF4D1FC46B8E
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
nixos/modules/services/web-apps/nextcloud.nix
View File

@ -522,6 +522,29 @@ in {
The nextcloud-occ program preconfigured to target this Nextcloud instance.
'';
};
globalProfiles = mkEnableOption "global profiles" // {
description = ''
Makes user-profiles globally available under <literal>nextcloud.tld/u/user.name</literal>.
Even though it's enabled by default in Nextcloud, it must be explicitly enabled
here because it has the side-effect that personal information is even accessible to
unauthenticated users by default.
By default, the following properties are set to <quote>Show to everyone</quote>
if this flag is enabled:
<itemizedlist>
<listitem><para>About</para></listitem>
<listitem><para>Full name</para></listitem>
<listitem><para>Headline</para></listitem>
<listitem><para>Organisation</para></listitem>
<listitem><para>Profile picture</para></listitem>
<listitem><para>Role</para></listitem>
<listitem><para>Twitter</para></listitem>
<listitem><para>Website</para></listitem>
</itemizedlist>
Only has an effect in Nextcloud 23 and later.
'';
};
nginx.recommendedHttpHeaders = mkOption {
type = types.bool;
@ -650,6 +673,8 @@ in {
if x == null then "false"
else boolToString x;
nextcloudGreaterOrEqualThan = req: versionAtLeast cfg.package.version req;
overrideConfig = pkgs.writeText "nextcloud-config.php" ''
<?php
${optionalString requiresReadSecretFunction ''
@ -689,6 +714,7 @@ in {
'trusted_domains' => ${writePhpArrary ([ cfg.hostName ] ++ c.extraTrustedDomains)},
'trusted_proxies' => ${writePhpArrary (c.trustedProxies)},
${optionalString (c.defaultPhoneRegion != null) "'default_phone_region' => '${c.defaultPhoneRegion}',"}
${optionalString (nextcloudGreaterOrEqualThan "23") "'profile.enabled' => ${boolToString cfg.globalProfiles}"}
${objectstoreConfig}
];
'';