Nextcloud reports issue (14.0.4)

LayLow · December 13, 2018, 6:41am

I just updated NS7, which included NC14.0.4. Now NC reports:

The admin manual says ‘no-referer’ is hardcoded and in effect by default

Any suggestions on what I can do, or is this an oversight in the RPM, or something else?

TIA

ps. found a hint, but I wonder what is the root cause…

apachectl -M shows the required modules are loaded:

and the NC .htaccess file has:

dnutan · December 14, 2018, 10:20am

It seems caused by having the Referrer-Policy header send twice (duplicated): one in the default vhost and another one in .htaccess

Cannot check it right now, but commenting one of them should suffice. For instance, commenting the line from vhost:

github.com

NethServer/nethserver-nextcloud/blob/master/root/etc/e-smith/templates/etc/httpd/conf.d/zz_nextcloud.conf/10base#L17


  Options +FollowSymLinks
  AllowOverride All
  Require all granted


  <IfModule mod_dav.c>
    Dav off
  </IfModule>


  <IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=15552000"
    Header always set Referrer-Policy "no-referrer"
  </IfModule>


  <FilesMatch \.php$>
    SetHandler "proxy:fcgi://127.0.0.1:'.$php_port.'"
  </FilesMatch>


  SetEnv HOME /usr/share/nextcloud
  SetEnv HTTP_HOME /usr/share/nextcloud
  SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</Directory>

LayLow · December 14, 2018, 11:21am

Spot on. I commented it out in the .htaccess file and the warning is no longer there:

Thanks!

dnutan · December 14, 2018, 12:06pm

IIRC the .htaccess comes from nextcloud package, therefore next update could bring back the issue, so maybe a fix is needed on our (nethserver) part. Let’s give some time to the developers to take a look at it.

LayLow · December 14, 2018, 12:07pm

Understand (quick test) and agree.

alep · December 14, 2018, 4:01pm

It is correct, I have the same results.

The Referrer-Policy header was introduced with upgrade to 14.0.0 version.

The warning has appeared on 14.0.0 version and the set of Apache HTTP header added by nethserver-nextcloud fixed the warning until the new version 14.0.4.

Because now the header is present into the .htaccess (by nextcloud rpm) I think it should be removed from nethserver-nextcloud httpd template (as @dnutan said).

alep · December 18, 2018, 9:53am

As explained here Nextcloud 15 available new Nextcloud 15 is in testing and also this warning should be resolved.

alep · December 18, 2018, 11:16am

@LayLow could you confirm this ?

LayLow · December 18, 2018, 11:38am

@alep, I can test in 6 hours or so.

HTH

LayLow · December 20, 2018, 6:40am

Sorry for the delay, yes I can confirm that the ‘referrer’ issue is no longer present.

Many thanks!

alep · December 20, 2018, 11:05am

After some successful test we have released the final version https://github.com/NethServer/dev/issues/5674

Happy nextcloud !

LayLow · December 21, 2018, 7:22am

Upgrade from 14.0.4 to 15.0 went just fine. Many thanks!