allowSymlinks in /lib/private/Files/Storage/Local.php

[Pecadis]

Hi,

i just want to know why you added this variable to prevent the system to follow Symbolic links. I coldn't see a override option to do it directly in the config.php file.

My case why i want to know it is the following.
I have a Samba AD up and running where the HomeDrive of each user is located on a Disk.
My NC server is validationg the User with the Ldap component and mounting the User Directories on /mnt/userdir/
The /www/data/Exampleuser folder has a symlink to /mnt/userdir/Exampleuser.

With your code to prevent NC to follow symlinks, i'm not able to access those files anymore.

I don't need a solution for that atm but i just want to know why you've decide this way.

Thanks
Pecadis

[icewind1991]

Allowing symlinks creates a security issue since it allows users to gain access to files outside of their home directory with the access rights of the web server if they have the ability to create symlinks themselves.

The proper solution for your usecase seems to be using the ldap "User Home Folder Naming Rule" to have Nextcloud use /mnt/userdir/Exampleuser in the first place

[nickvergessen]

Closing as per above

[h-2]

Allowing symlinks creates a security issue since it allows users to gain access to files outside of their home directory with the access rights of the web server if they have the ability to create symlinks themselves.

From my point of view, these are two different things. You can follow symlinks created by the system administrator and still prevent users from creating new ones. How is this related? Why is the first one being prevented? It broke my setup 😢

Thanks!

[cgrima]

Agreed with h-2. He does not ask for the ability of a user to create symlinks, but he wants NC to follow symlinks created by the administrator through a UNIX-like system.
See #1927 for additional description and use cases.

[Pecadis]

thank you @cgrima for the deeper explanation. looks like i was not clear enough.

@nickvergessen or @icewind1991 could you explain the reccomend way to implement this kind of feature without hitting your security rules?

[tavinus]

Changing the variable $allowSymlinks to true does seem to work.
Not too sure about the vulnerabilities though.

Changed: /lib/private/Files/Storage/Local.php

In:

class Local extends \OC\Files\Storage\Common {
	protected $datadir;
	protected $dataDirLength;
	protected $allowSymlinks = false;
...

To:

	protected $allowSymlinks = true;

And I can see my symlinks contents (had to remove and re-add my external storage that has symlinks).

I don't care too much about other users, since this install only offer access to admins.

I dislike the fact that I had to change core files though, and that it will be lost with an update. But well, I will probably remove the external storages before updating anyways.

I wonder if allowing symlinks can not be set at the config.php file, would be nice.

PS: I have no option in this case, since the symlinks are crucial to this specific use case.

[techc0de]

I'm not using symlink, but external storage that I reshare the shared folder to other users.
I having the same error in NC v11.0.

`fwrite() expects parameter 2 to be string, array given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Wrapper/Encryption.php#230

stream_get_contents() expects parameter 2 to be long, string given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/3rdparty/sabre/http/lib/Message.php#81

imagecreatefromstring(): Empty string or invalid image at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/legacy/image.php#597

fclose() expects parameter 1 to be resource, boolean given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#218`

[techc0de]

I'm on NC 11.0.2, and still have the same issue.

Whenever I play my mp3 files, I get the errors.

Audio Player v1.4.1

imagecreatefromstring(): Empty string or invalid image at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/legacy/image.php#597	5 minutes ago
Error	PHP	fclose() expects parameter 1 to be resource, boolean given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#218	5 minutes ago
Error	PHP	fread() expects parameter 1 to be resource, boolean given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#217	5 minutes ago
Error	PHP	fopen(/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/data/tx7/files/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/core/img/filetypes/audio.svg): failed to open stream: No such file or directory at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#216	5 minutes ago
Error	PHP	filesize(): stat failed for /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/data/tx7/files/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/core/img/filetypes/audio.svg at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#211	5 minutes ago
Error	PHP	imagecreatefromstring(): Empty string or invalid image at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/legacy/image.php#597	5 minutes ago
Error	PHP	fclose() expects parameter 1 to be resource, boolean given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#218	5 minutes ago
Error	PHP	fread() expects parameter 1 to be resource, boolean given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#217	5 minutes ago
Error	PHP	fopen(/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/data/tx7/files/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/core/img/filetypes/audio.svg): failed to open stream: No such file or directory at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#216	5 minutes ago
Error	PHP	filesize(): stat failed for /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/data/tx7/files/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/core/img/filetypes/audio.svg at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#211

Error	PHP	imagecreatefromstring(): Empty string or invalid image at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/legacy/image.php#597	a few seconds ago
Error	PHP	fclose() expects parameter 1 to be resource, boolean given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#218	a few seconds ago
Error	PHP	fread() expects parameter 1 to be resource, boolean given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#217	a few seconds ago
Error	PHP	fopen(/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/data/tx7/files/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/core/img/filetypes/audio.svg): failed to open stream: No such file or directory at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#216	a few seconds ago
Error	PHP	filesize(): stat failed for /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/data/tx7/files/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/core/img/filetypes/audio.svg at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#211	a few seconds ago
Error	PHP	imagecreatefromstring(): Empty string or invalid image at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/legacy/image.php#597	a few seconds ago
Error	PHP	fclose() expects parameter 1 to be resource, boolean given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#218	a few seconds ago
Error	PHP	fread() expects parameter 1 to be resource, boolean given at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#217	a few seconds ago
Error	PHP	fopen(/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/data/tx7/files/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/core/img/filetypes/audio.svg): failed to open stream: No such file or directory at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#216	a few seconds ago
Error	PHP	filesize(): stat failed for /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/data/tx7/files/media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/core/img/filetypes/audio.svg at /media/54bf67db-da31-4c50-bb3c-27140944b223/www/nextcloud/lib/private/Files/Storage/Local.php#211

[fliiiix]

I need this feature because of limitations of my OS I have some symlinks and it would be nice if nexcloud would follow them. I think this should be possible to follow symlinks and disallow user to upload symlinks.

[quamis]

The reporter said that it would be useful to follow sylinks, not create them. Creating symlinks would be a security concern indeed, but following them would allow the server admin to better organize the internal storage, and maybe optimize parts of the storage.

In my case, I ran out of space in the data dir, I cannot add more storage (running on an ARM system, only one SATA port, cannot afford to buy a new HDD & reinstall everything). I had to insert one USB drive and move "slow-changing" parts of the data-dir to the USB drive, and symlink them.