<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">I disagree with the current nginx
config... Near as I can see it's got gaping security holes and
duplicated code<br>
<br>
I have posted my current best suggestion on issue 56 below, but
I'm really not happy with it (and it doesn't include the neat
suggestions for HTTP auth from another user)<br>
<br>
Bigger issue is that Owncloud seems to have some mild policy, but
has no issue serving files willy nilly across the installation,
nor does it limit the executable PHP locations.. (coupled with
writeable PHP this is a potential security blackspot)<br>
<br>
Nginx tends to encourage one to review the setup much more
carefully because you need to write stanzas more carefully for
each file path. As you can see you end up with a rather messy
configuration, which could be improved by increasing the tightness
(and security) of OCs filesystem layout for apps...<br>
<br>
Please see if you can improve on my suggestion in issue 56 (it's
the "if" which needs to be removed...)<br>
<br>
Ed W<br>
<br>
<br>
On 21/02/2013 06:07, Victor Dubiniuk wrote:<br>
</div>
<blockquote
cite="mid:CA+UHsBumh9Nu_Bzt0+5Q2ygztqYVQg3z8N07CYoqUEeejnG+HQ@mail.gmail.com"
type="cite">Hi,
<div><br>
</div>
<div>Basic Nginx config is here [1].</div>
<div>I'm using the following config with 4.5 [2].</div>
<div>I haven't set up 5.0 on this host yet but as I see there are
some updates for it [3].</div>
<div>
<br>
</div>
<div>[1] <a moz-do-not-send="true"
href="http://doc.owncloud.org/server/5.0/admin_manual/installation/installation_others.html">http://doc.owncloud.org/server/5.0/admin_manual/installation/installation_others.html</a></div>
<div>[2] <a moz-do-not-send="true"
href="https://github.com/owncloud/documentation/issues/21">https://github.com/owncloud/documentation/issues/21</a></div>
<div>[3] <a moz-do-not-send="true"
href="https://github.com/owncloud/documentation/issues/56">https://github.com/owncloud/documentation/issues/56</a></div>
<div><br>
</div>
<div>Victor</div>
<div><br>
</div>
<div><br>
<div class="gmail_quote">On Thu, Feb 21, 2013 at 2:21 AM, Boulet
<span dir="ltr"><<a moz-do-not-send="true"
href="mailto:boulet@moiboulet.eu" target="_blank">boulet@moiboulet.eu</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Hi
everyone,
<div><br>
</div>
<div>I want to test OC 5 with nginx but I have some mistakes
with the rewrite rules.</div>
<div>
<span
style="line-height:22.22222328186035px;color:rgb(51,51,51);font-size:13.333333969116211px;font-family:Helvetica,arial,freesans,clean,sans-serif">Is
anyone using nginx could share his nginx config ?</span></div>
<div><span
style="line-height:22.22222328186035px;color:rgb(51,51,51);font-size:13.333333969116211px;font-family:Helvetica,arial,freesans,clean,sans-serif"><br>
</span></div>
<div><span
style="line-height:22.22222328186035px;color:rgb(51,51,51);font-size:13.333333969116211px;font-family:Helvetica,arial,freesans,clean,sans-serif">Thanks
a lot,</span></div>
<div><span
style="line-height:22.22222328186035px;color:rgb(51,51,51);font-size:13.333333969116211px;font-family:Helvetica,arial,freesans,clean,sans-serif"><br>
</span></div>
<div><span
style="line-height:22.22222328186035px;color:rgb(51,51,51);font-size:13.333333969116211px;font-family:Helvetica,arial,freesans,clean,sans-serif">Boulet,</span></div>
<div><span
style="line-height:22.22222328186035px;color:rgb(51,51,51);font-size:13.333333969116211px;font-family:Helvetica,arial,freesans,clean,sans-serif">A
junior developer.</span></div>
<br>
_______________________________________________<br>
Owncloud mailing list<br>
<a moz-do-not-send="true" href="mailto:Owncloud@kde.org">Owncloud@kde.org</a><br>
<a moz-do-not-send="true"
href="https://mail.kde.org/mailman/listinfo/owncloud"
target="_blank">https://mail.kde.org/mailman/listinfo/owncloud</a><br>
<br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Owncloud mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Owncloud@kde.org">Owncloud@kde.org</a>
<a class="moz-txt-link-freetext" href="https://mail.kde.org/mailman/listinfo/owncloud">https://mail.kde.org/mailman/listinfo/owncloud</a>
</pre>
</blockquote>
<br>
</body>
</html>