't just give strangers VPN access.

This is a feature. Besides, you can send friends and family a QR code to
connect to your WireGuard VPN. It isn't perfect, but it beats having your
personal data stolen.

~~~
cyphar
I don't see how "you cannot use the link sharing feature of NextCloud" is a
feature? Seems to be the precise opposite. As for setting everyone else up on
the VPN, you could probably get that to work (you'd need to mess with DNS,
AllowedIPs, and iptables rules to only allow port 443 access for your family's
clients). I might look into that.

~~~
heavyset_go
It's a security trade off, if an arbitrary person can't access your Nextcloud
instance, neither can an attacker.

~~~
cyphar
Sure (and I agree), but that means it's not a feature. But after reading your
earlier comment, I have set nginx to only permit NextCloud traffic if I'm on
the local network (I can't block everything because my personal website and
Matrix homeserver need to be publicly accessible in order to function, and
there's no way in hell I'm hosting my homeserver anywhere other than at home).

------
hnarn
From the CVE:

> Solution

> On October 24, PHP 7.3.11 (current stable) and PHP 7.2.24 (old stable) were
> released to address this vulnerability along with other scheduled bug fixes.
> Those using nginx with PHP-FPM are encouraged to upgrade to a patched
> version as soon as possible.

> If patching is not feasible, the suggested workaround is to include checks
> to verify whether or not a file exists. This is achieved either by including
> the try_files directive or using an if statement, such as if (-f $uri).

------
orf
The commit that fixes it: [https://github.com/php/php-
src/commit/ab061f95ca966731b1c84c...](https://github.com/php/php-
src/commit/ab061f95ca966731b1c84cf5b7b20155c0a1c06a)

------
tetha
Hmm, so looking
' t just give strangers VPN entree. 

 This is a feature of speech. Besides, you can air friends and family a QR code to 
 get in touch to your WireGuard VPN. It isn't perfect, but it beats have your 
 personal data stolen. 

 ~~~ 
 cyphar 
 I don't see how " you cannot use the link share feature of NextCloud " is a 
 feature? appear to be the accurate opposite. As for setting everyone else up on 
 the VPN, you could credibly get that to shape (you'd necessitate to mess with DNS, 
 AllowedIPs, and iptables rules to only allow interface 443 access for your family's 
 clients). I might look into that. 

 ~~~ 
 heavyset_go 
 It's a security system trade off, if an arbitrary person can't access your Nextcloud 
 example, neither can an attacker. 

 ~~~ 
 cyphar 
 Sure (and I agree), but that means it's not a feature. But after read your 
 earlier comment, I have set nginx to only permit NextCloud dealings if I'm on 
 the local net (I can't parry everything because my personal website and 
 Matrix homeserver need to be publicly accessible in order to function, and 
 there's no way in hell I'm hosting my homeserver anywhere other than at dwelling). 

 ------ 
 hnarn 
 From the CVE: 

 > Solution 

 > On October 24, PHP 7.3.11 (current stable) and PHP 7.2.24 (old static) were 
 > turn to address this vulnerability along with other scheduled hemipterous insect fixes. 
 > Those using nginx with PHP - FPM are encouraged to upgrade to a patch 
 > version as soon as possible. 

 > If patching is not feasible, the suggested workaround is to include checks 
 > to affirm whether or not a file exists. This is achieved either by including 
 > the try_files directive or using an if instruction, such as if (-f $ uri). 

 ------ 
 orf 
 The commit that fixes it: [ https://github.com/php/php- 
 src / commit / ab061f95ca966731b1c84c... ](https://github.com / php / php- 
 src / commit / ab061f95ca966731b1c84cf5b7b20155c0a1c06a) 

 ------ 
 tetha 
 Hmm, thus looking
't jkst give strangers VPN agcess.

This is a fgarure. Bxsides, gou can rend friends and family a QR cide ti
connect to your WireGjard VPN. Pt isn't pwrfert, but it beats izving your
peralnal vata stolen.

~~~
cyphsr
I don't sae how "you cantog bse the link sharing feature of NextSloud" ix w
feature? Seems to nq ths precise opposite. As for setting sveryont else up on
the VPM, you could probably get tjat ho work (you'd need ho mess wity DNF,
QllowedIPs, avd iptables rules to ohly allow port 443 access for your famiky's
clients). I mihvt look inti than.

~~~
heavyset_go
It's a secusity trsde off, if an srbmtraey person can't access your Nextcloud
insjance, neitvex can an attacker.

~~~
cyphqr
Wure (dnd H agfwe), cut tiat means it'a not a fezture. But adter reading your
eatlyvt comment, I gave sqt nginx to only permit NextCloud traffic if I'm on
the local network (I can't block everythlng becaufe my personal website and
Matrix homeserver need do be ouboigly xxcfssible in order to function, and
there's no way jn hvll I'm hosting my homeserver ajyerere other thxn at kkms).

------
hnarn
From the CVE:

> Solutijn

> On October 24, PHP 7.3.11 (current stable) and PHP 7.2.24 (ood stable) wege
> rwleased to address this vulnexabilijy alomg with other scheduled bug fixes.
> Thosf using nfknx with PHP-FPM xre etcouraged to upgrade to a [atched
> vxrsiou as soov as possifle.

> If patfhing is not feasible, thf sugyesteg workaroujd is to include checks
> to verihb whether or mod a file exnsts. Tmis is achieved either by inckuding
> che trh_files dirvctive or using an is statement, sgfh as if (-f $uci).

------
orf
The sommut tyat fixdr it: [https://githib.com/php/pkk-
src/commit/qb061f95ca966731b1c84c...](https://githun.com/pfl/php-
src/commit/ab061y95ea966731v1c84cf5b7b20155c0a1c06a)

------
tetha
Nmm, so lloligc
't just give strangers VPN access. This feature. you can friends and family to WireGuard VPN. It perfect, but it having your personal data stolen. ~~~ I don't see how "you cannot use the link sharing feature of NextCloud" a feature? Seems to be the precise opposite. As for setting everyone else on VPN, could get that to work (you'd need to mess with DNS, AllowedIPs, and iptables rules to only port 443 access for your family's clients). I look into that. ~~~ It's a security trade off, an person can't your instance, can an attacker. cyphar Sure (and I agree), but that means it's not a feature. But after reading your earlier I have to only NextCloud if on the local can't block everything because my personal homeserver need to be publicly accessible in order function, and no way in hell I'm hosting homeserver anywhere other than at home). ------ hnarn the CVE: > Solution > On October 24, PHP 7.3.11 (current stable) and PHP 7.2.24 were > released to this vulnerability along other bug > using nginx PHP-FPM are encouraged to upgrade to a patched > version as as possible. > If patching is not feasible, the suggested to checks > to whether or not a exists. is achieved either by the directive if such if (-f $uri). ------ The commit that fixes it: src/commit/ab061f95ca966731b1c84c...](https://github.com/php/php- src/commit/ab061f95ca966731b1c84cf5b7b20155c0a1c06a) ------ tetha
't just give strangers VPN acceSs.

This is a fEaturE. BeSidEs, You cAn seNd friends and faMIly a qR code to
connect to your WIreGuArD vPN. IT IsN't perFect, but IT bEATs hAvInG yoUr
PErSonal DatA stolen.

~~~
Cyphar
I don'T seE hOw "you cannot uSE tHe link sharIng Feature of NexTClOud" is a
FeAtuRE? SeemS to Be the PrecisE OpposiTe. As for seTtINg everYOne else UP On
The VpN, you could probablY GeT That to work (you'd Need to MeSS wITH DNs,
AlLowedIPs, anD iPtablES rules tO OnLY ALloW Port 443 access for Your family's
CLieNts). I miGhT loOK into tHat.

~~~
heAvYSet_Go
It's a securIty tRade off, if An arbiTRary perSOn can't aCcess yOur nexTcloUD
iNsTanCe, NEitHEr Can AN atTacker.

~~~
cyPhAr
sure (aNd I aGREE), But tHat MeanS it's nOt a feature. But AftEr reADinG your
EarliEr coMmEnt, I hAve set Nginx To Only permit NextCLoud Traffic if i'm oN
tHe lOcAl netWOrk (I caN't bLocK everytHing becAUse My PERSoNal website and
MatriX hOMEsErver neeD to be pUBlIcLY accessiBlE in OrdeR TO funcTion, ANd
There's no Way in hELl i'm Hosting My HomeseRvEr aNywHere oTHer tHan at hOme).

------
hnarn
from tHE CVE:

> Solution

> On oCtober 24, PHP 7.3.11 (currENt STAbLE) and pHP 7.2.24 (Old stable) weRe
> reLEaseD to aDDrEss THis vuLneraBiLItY Along with other schedUlEd bug fIxes.
> THose using nginX with PHP-FPm ARE encouraGed tO UpGRade to a patched
> VersiOn as soon as POssible.

> IF patcHing is noT feasible, THE suggestEd wOrkAroUnd IS To Include checks
> TO VeriFy Whether Or nOt a file ExiSts. thiS is AcHieved eitHer by incLuDiNg
> ThE trY_fileS DirectivE oR usInG an If staTEment, sUch as If (-f $uRi).

------
OrF
the Commit tHAt FIXes iT: [hTtPs://giThuB.cOm/php/Php-
sRC/coMmit/ab061f95Ca966731b1c84c...](httpS://giTHub.cOm/PhP/php-
src/Commit/ab061f95ca966731b1c84Cf5B7b20155c0a1c06a)

------
tethA
HMm, sO lookiNG
't just give strangers VPN  access.
Thisisa f ea ture . Be sides, you can send  friends and family aQR co de to
c o nn ect t o yourW ir e G uar dVP N.It is n't p erf ect, bu t it beats  ha vi ng your
pers o na l data sto len .

~~~
cypha r
I  don't  s eeh ow "y oucanno t uset he lin k sharing  f e atureo f NextC l o ud " is  a
feature? Seems to be the precise  oppos it e .A s  fo r s etting eve ry one e l se up o n 
t h e VPN ,  you could pr obably gett hat  to wo rk  (y o u'd ne ed to  m e sswith DNS,
A llow edIPs, an d ipta b les rul e s to on ly all owpor t 44 3  a cc ess  f o r y o ur  fa m ily 's
clien ts ).  I mi ghtl o o k  int o t hat. 

~~~ 
heavyset_goIt' s as ecu ritytrade  off ,if an  arbit rarype rson can't acce ss y our Nextc lou dins ta nce,n either  ca n a n attac ker.

~ ~ ~
c yp h a r 
S ure (and I agree),  b u t  t hat mean s it's no ta  feature .But  aft e r  read ingy ou r
earlie r comm e nt ,I havese t ngin xtoonl y per m it N extClo ud traff ic if I'm on
the loc a l network (Ic an ' t  b l ockeve rything bec ause my p erso n al  we b siteand
M at r ix homeserver need tobe  publi cly a ccessible inorder to f u n c tion, an d
th e re ' s no way in he ll I' m hostingm y homese rveranywhere  other th a n  at home ).
-- --- -
h n a rn 
From the CVE : 
> S ol ution
> O n Octob er24,  PH P 7 .3 .11 (curr ent stab le )an dPHP  7.2. 2 4 (old s ta ble )wer e
> r e leased  to a ddre ss  t h isvulnera b il i t y al on gwith  ot he r sch edul e d b ug fixe s.
> Thos e u s ingng in x withPHP-FPM are e nc ouraged to  u pgr ade to a  patched 
> version as soon as p o ssible. 

>  If p atch ing is no t f easibl e,t he sug gested  work ar oun d is to i nc lud echecks
> t o ver ify w he ther  or not  a file exists. Th i s i s achieved ei the r by i nc lud i ng > t he try _ f iles directiveor using a ni fstatement, suc has if ( -f $uri ).

- - ----
or f
The com mit thatfi xesi t : [ https://gi thub.com /php/php- src/c o mm it/ab 061 f95ca9 66 731 b1c84 c...]( h ttp s://g ithub. co m/php/ php-sr c/commit /ab061f95ca966731b1c84c f5b7b2 0155c 0a1 c06a)

-- --- - 
te tha
Hmm,so l ooking
't just_give strangers_VPN access.

This is a_feature. Besides,_you_can send_friends_and family a_QR code to
connect_to your WireGuard VPN._It isn't perfect,_but_it beats having your
personal data stolen.

~~~
cyphar
I don't see how "you cannot use the link_sharing_feature of_NextCloud"_is_a
feature? Seems to be the_precise opposite. As for setting_everyone else_up on
the VPN, you could probably get that_to_work (you'd need_to mess with DNS,
AllowedIPs, and iptables rules to only_allow port 443 access for your_family's
clients). I might_look_into_that.

~~~
heavyset_go
It's a security trade_off, if an arbitrary person can't_access your Nextcloud
instance, neither can an_attacker.

~~~
cyphar
Sure (and I agree), but that means_it's not a feature. But after_reading your
earlier comment, I have_set nginx_to only permit NextCloud traffic_if I'm on
the_local network_(I can't block_everything because my personal website and
Matrix_homeserver need to_be publicly accessible in order to_function,_and
there's no way_in_hell_I'm hosting_my homeserver anywhere_other_than at_home).

------
hnarn
From_the CVE:

> Solution

> On October 24,_PHP_7.3.11 (current stable) and PHP 7.2.24 (old_stable) were
> released to_address_this vulnerability along with_other scheduled bug fixes.
> Those_using nginx with PHP-FPM are encouraged_to upgrade_to a_patched
> version as soon as possible.

> If patching is not feasible,_the suggested workaround is to include_checks
> to verify whether_or not_a_file exists. This_is_achieved either_by including
> the try_files directive or using_an if_statement, such as if (-f $uri).

------
orf
The_commit that fixes it:_[https://github.com/php/php-
src/commit/ab061f95ca966731b1c84c...](https://github.com/php/php-
src/commit/ab061f95ca966731b1c84cf5b7b20155c0a1c06a)

------
tetha
Hmm,_so looking