modified .user.ini integrity check fails

[domrim]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.

Steps to reproduce

1. Install Nextcloud 18.0.2 with nginx and php-fpm7.3 as webserver/php-runner
2. modify .user.ini with own custom settings, as described in https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/big_file_upload_configuration.html
   for example, my new .user.ini:

mbstring.func_overload=0
always_populate_raw_post_data=-1
default_charset='UTF-8'
output_buffering=0

upload_max_filesize = 10G
post_max_size = 10G
memory_limit = 512M
max_execution_time = 300

Expected behaviour

occ integrity:check-core should succeed if i don't modify any predefined values.

Actual behaviour

occ integrity:check-core fails with:

  - INVALID_HASH:
    - .user.ini:
      - expected: 4843b3217e91f8536cb9b52700efb20300290292cf6286f92794d4cec99df286afeb7dd6c91b1be20bc55eda541eef230a5c5e7dcd46c189edd0ed1e80c6d3f5
      - current: c2b18102f728f15c56050a6d12e1aed9e4e4b2ad2be4864cbe22f919837698ad785051feb62275098effa6e99952a3ae44dce88496050064657a0f23cb4876f1

I know this was an issue before (#115) so i thought this should work, or am i missing something?

Server configuration

Operating system:
Debian 10 stable
Web server:
nginx 1.14.2
Database:
postgresql 11.6
PHP version:
php-fpm
Nextcloud version: (see Nextcloud admin page)
18.0.2.2
Updated from an older Nextcloud/ownCloud or fresh install:
Updated from 18.0.1. But is also reproducible on a new installation.
Where did you install Nextcloud from:
Nextcloud website download
Signing status:

Signing status

Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.

Results
=======
- core
	- INVALID_HASH
		- .user.ini

Raw output
==========
Array
(
    [core] => Array
        (
            [INVALID_HASH] => Array
                (
                    [.user.ini] => Array
                        (
                            [expected] => 4843b3217e91f8536cb9b52700efb20300290292cf6286f92794d4cec99df286afeb7dd6c91b1be20bc55eda541eef230a5c5e7dcd46c189edd0ed1e80c6d3f5
                            [current] => c2b18102f728f15c56050a6d12e1aed9e4e4b2ad2be4864cbe22f919837698ad785051feb62275098effa6e99952a3ae44dce88496050064657a0f23cb4876f1
                        )

                )

        )

)

List of activated apps:

App list

Enabled:
  - accessibility: 1.4.0
  - activity: 2.11.0
  - bruteforcesettings: 1.5.0
  - calendar: 2.0.2
  - camerarawpreviews: 0.7.3
  - checksum: 0.4.4
  - cloud_federation_api: 1.1.0
  - comments: 1.8.0
  - contacts: 3.2.0
  - dav: 1.14.0
  - documentserver_community: 0.1.5
  - federatedfilesharing: 1.8.0
  - federation: 1.8.0
  - files: 1.13.1
  - files_pdfviewer: 1.7.0
  - files_rightclick: 0.15.2
  - files_sharing: 1.10.1
  - files_trashbin: 1.8.0
  - files_versions: 1.11.0
  - files_videoplayer: 1.7.0
  - firstrunwizard: 2.7.0
  - logreader: 2.3.0
  - lookup_server_connector: 1.6.0
  - nextcloud_announcements: 1.7.0
  - notifications: 2.6.0
  - oauth2: 1.6.0
  - onlyoffice: 4.1.4
  - password_policy: 1.8.0
  - photos: 1.0.0
  - privacy: 1.2.0
  - provisioning_api: 1.8.0
  - recommendations: 0.6.0
  - serverinfo: 1.8.0
  - settings: 1.0.0
  - sharebymail: 1.8.0
  - support: 1.1.0
  - survey_client: 1.6.0
  - systemtags: 1.8.0
  - tasks: 0.12.1
  - text: 2.0.0
  - theming: 1.9.0
  - twofactor_backupcodes: 1.7.0
  - updatenotification: 1.8.0
  - viewer: 1.2.0
  - workflowengine: 2.0.0
Disabled:
  - admin_audit
  - encryption
  - files_external
  - user_ldap

Nextcloud configuration:

Config report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.drimpf.de"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "18.0.2.2",
        "overwrite.cli.url": "https:\/\/cloud.drimpf.de",
        "htaccess.RewriteBase": "\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "skeletondirectory": "",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "dbindex": 1
        },
        "maintenance": false,
        "loglevel": 2,
        "mail_smtpmode": "sendmail",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "tls",
        "mail_smtpauth": 1,
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "theme": "",
        "updater.release.channel": "beta",
        "updater.secret": "***REMOVED SENSITIVE VALUE***"
    }
}

Are you using external storage, if yes which one: no

Are you using encryption: no

Are you using an external user-backend, if yes which one: no

Client configuration

Browser:
Firefox 73.0.1
Operating system:
macOS 10.15.3 (19D76)

Logs

Web server error log

Web server error log

empty

Nextcloud log (data/nextcloud.log)

Nextcloud log

empty

[kesselb]

Changing .user.ini is not supported anymore: #14430. Use the appropriate place to configure that limit. Good to know: Nextcloud's clients use chunking to upload files anyway. Such high limits are not required. Only if you plan to upload files with 3rdparty dav clients.

[dartcafe]

Such high limits are not required. Only if you plan to upload files with 3rdparty dav clients.

At least it is required for the installation of the community document server. Otherwise it fails.

[domrim]

also using the web-updater is critical, because the backuping step can take longer than 30 secs. and i don't want to adjust the settings for all fpm-runners.

[kesselb]

You can adjust those settings for each fpm pool.

cc @nextcloud/server-triage opinions? I'm fine with the current state. We might update the documentation because it's a bit unclear.

[domrim]

ah, i didn't read the php documentation completely 🙈
i'm fine with the current state, maybe the php-docu page could be linked?

[skjnldsv]

If this issue is opened, it probably means we can improve the doc :)
Please provide any desired change to https://github.com/nextcloud/documentation so we can have a look and review :)

[dartcafe]

Such high limits are not required. Only if you plan to upload files with 3rdparty dav clients.

At least it is required for the installation of the community document server. Otherwise it fails.

Here I was referring to the memory_limit. It must be raised to 512M especially with some share hosters.

[skjnldsv]

Which we already recommend, no?
Closing then?

[dartcafe]

The suggested solutions are not satisfying for users without administrative access to the machine or OS.

I have a few instances running on shared webspace (not changeable php memory limit 256M) . Everytime I update NC I have to edit the user.ini or .htaccess (adding php_value memory_limit 512M) in the middle of the update process to prevent the update from failing. In the result, the integrity scan fails.

After that the integrity check fails.

[kesselb]

#18655 is about the memory limit. I agree as long term goal we should not longer ship a .user.ini.

• mbstring.func_overload is deprecated since PHP 7.2
• always_populate_raw_post_data removed in PHP 7.0
• default_charset default is UTF-8 since PHP 5.6
• output_buffering that is the only important one. Probably weird things will happen with a another value. As per https://www.php.net/manual/en/outcontrol.configuration.php we cannot change it at run time 😞

I think we can ship the .user.ini as .user.ini.example and exclude the .user.ini file from the integrity check. Maybe a small patch for the updater is needed to keep (or copy) a .user.ini during the upgrade.