Repository navigation
Snuffleupagus "allow" rules for Memories app #40
Description
Hi,
Nextcloud Memories App https://apps.nextcloud.com/apps/memories depends on shell_exec function, whose execution is dropped by Snuffleupagus configuration in ghcr.io/hoellen/nextcloud:25 docker image.
{"reqId":"kSXRACAVK6v9d1dB9vGU","level":3,"time":"2023-05-08 19:54:11","remoteAddr":"172.17.26.1","user":"XXX","app":"PHP","method":"POST","url":"/settings/apps/enable","message":"[snuffleupagus][0.0.0.0][disabled_function][drop] Aborted execution on call of the function 'shell_exec', because its argument '$command' content (ps -ef | grep go-vod-ocwgkowh3q4h | grep -v grep | awk '{print $2}') matched a rule at /nextcloud/apps2/memories/lib/Util.php#461","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0","version":"25.0.6.1","data":{"app":"PHP"}}
In particular, these two files call shell_exec multiple times:
- https://github.com/pulsejet/memories/blob/master/lib/Util.php
- https://github.com/pulsejet/memories/blob/master/lib/Service/BinExt.php
I have temporarily worked around the issue by allowing the two files to run any (!) command:
$ grep "memories" /usr/local/etc/php/conf.d/nextcloud-php8.rules | grep -v grep
sp.disable_function.function("shell_exec").param("command").filename("/nextcloud/apps2/memories/lib/Util.php").allow();
sp.disable_function.function("shell_exec").param("command").filename("/nextcloud/apps2/memories/lib/Service/BinExt.php").allow();
Activity