nextcloud
feat: allow to configure php.user
I insist that it should use the new config value instead of the config.php owner if the value is filled. Is if php.user is empty, it checks that running user is the owner of config.php. If php.user is filled, it checks that running user is the one in php.user.
See my previous change suggestion.
but we already get the user via posix_getuid or not?
I insist that it should use the new config value instead of the config.php owner if the value is filled. Is if php.user is empty, it checks that running user is the owner of config.php. If php.user is filled, it checks that running user is the one in php.user. See my previous change suggestion.
but we already get the user via posix_getuid or not?
We do, and we want to check that it’s the correct one.
I insist that it should use the new config value instead of the config.php owner if the value is filled. Is if php.user is empty, it checks that running user is the owner of config.php. If php.user is filled, it checks that running user is the one in php.user. See my previous change suggestion.
but we already get the user via posix_getuid or not?
We do, and we want to check that it’s the correct one.
all right, done!
Not completely happy about it but too much time was spend already, and it does fix the usecase.
Looks like a reasonable solution, if there's not an easy way to just verify if we can write to the directory (as the user is not really relevant, just whether we have write access). I don't remember my PHP so well, but in Python I'd probably just try/except a file write as a test.
as the user is not really relevant, just whether we have write access
The user is actually relevant (there is a separate check for checking write access to the data dir iirc). If an occ/cron command ends up create a file it will be owned by whatever user the command is ran as. So if a user does sudo occ .... Any file created by that will then be read-only to the webserver.
As I wrote in the internal chat: can someone please take over this PR? It looked like a simple change but got more and more complicated. I fear I currently do not have the capacity to finish this as I am busy with AIO and Enterprise-AIO.