From 0d43baf7be7d8fad40a8d1aabc0f4891e3e344d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Thu, 22 Oct 2026 16:39:43 +0200 Subject: [PATCH 1/3] fix: harden PHP request parsing (post_max_size, max_input_nesting_level) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit post_max_size no longer follows OWNCLOUD_MAX_UPLOAD (20G). It defaults to 100M, below a quarter of the 512M memory_limit as Freexian recommends after CVE-2026-109618/-109619, is configurable with the new OWNCLOUD_POST_MAX_SIZE, and is enforced with php_admin_value so that ownCloud's .htaccess cannot raise it. max_input_nesting_level drops to 6, and expose_php = Off is made explicit. File uploads use WebDAV PUT and are unaffected. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- CHANGELOG.md | 11 +++++++++++ ENVIRONMENT.md | 4 +++- v22.04/overlay/etc/entrypoint.d/10-base.sh | 3 +++ .../overlay/etc/php/7.4/mods-available/owncloud.ini | 5 ++++- v22.04/overlay/etc/templates/apache.conf.tmpl | 3 +++ v22.04/overlay/etc/templates/owncloud.ini.tmpl | 5 ++++- v24.04/overlay/etc/entrypoint.d/10-base.sh | 3 +++ .../overlay/etc/php/8.3/mods-available/owncloud.ini | 5 ++++- v24.04/overlay/etc/templates/apache.conf.tmpl | 3 +++ v24.04/overlay/etc/templates/owncloud.ini.tmpl | 5 ++++- 10 files changed, 42 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 41c34b9d..7e184958 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,16 @@ # Changelog +## 2026-10-22 + +* Security + * Hardened PHP's request parsing as recommended after CVE-2026-109618 and + CVE-2026-109619: `post_max_size` now defaults to `100M`, configurable with + the new `OWNCLOUD_POST_MAX_SIZE` and enforced with `php_admin_value`, so + ownCloud's `.htaccess` can no longer raise it to 513M. It used to follow + `OWNCLOUD_MAX_UPLOAD` (20G). `max_input_nesting_level` is lowered from 64 to + 6, and `expose_php = Off` is now set explicitly; Ubuntu's `php.ini` already + had it off. File uploads use WebDAV `PUT` and are not affected + ## 2026-08-18 * Fixed diff --git a/ENVIRONMENT.md b/ENVIRONMENT.md index 7a4d0f1f..c4d35b2d 100644 --- a/ENVIRONMENT.md +++ b/ENVIRONMENT.md @@ -242,7 +242,7 @@ - `OWNCLOUD_MAX_INPUT_TIME=3600` \ Sets PHP option `max_input_time`. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)). - `OWNCLOUD_MAX_UPLOAD=20G` \ - Sets PHP option `upload_max_filesize` and `post_max_size`. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)). + Sets PHP option `upload_max_filesize`. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)). - `OWNCLOUD_MEMORY_LIMIT=512M` \ Sets PHP option `memory_limit`. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)). - `OWNCLOUD_MINIMUM_SUPPORTED_DESKTOP_VERSION=` \ @@ -300,6 +300,8 @@ Path to custom scripts that need to be executed after a cron run. - `OWNCLOUD_POST_INSTALL_PATH=/etc/post_install.d` \ Path to custom scripts that need to be executed after an ownCoud installation command. +- `OWNCLOUD_POST_MAX_SIZE=100M` \ + Sets PHP option `post_max_size`, the size limit for form and multipart POST bodies that PHP parses. File uploads go through WebDAV `PUT` and are not affected, and the body of other POST requests is still readable. Keep it below a quarter of `OWNCLOUD_MEMORY_LIMIT`, so that parsing a large request cannot reach PHP's memory limit. - `OWNCLOUD_POST_SERVER_PATH=/etc/post_server.d` \ Path to custom scripts that need to be executed after an ownCloud server startup. - `OWNCLOUD_PREVIEW_JPEG_IMAGE_DISPLAY_QUALITY=` \ diff --git a/v22.04/overlay/etc/entrypoint.d/10-base.sh b/v22.04/overlay/etc/entrypoint.d/10-base.sh index 55d18f63..4ee72f7e 100755 --- a/v22.04/overlay/etc/entrypoint.d/10-base.sh +++ b/v22.04/overlay/etc/entrypoint.d/10-base.sh @@ -40,6 +40,9 @@ declare -x OWNCLOUD_POST_CRONJOB_PATH declare -x OWNCLOUD_MAX_UPLOAD [[ -z "${OWNCLOUD_MAX_UPLOAD}" ]] && OWNCLOUD_MAX_UPLOAD="20G" +declare -x OWNCLOUD_POST_MAX_SIZE +[[ -z "${OWNCLOUD_POST_MAX_SIZE}" ]] && OWNCLOUD_POST_MAX_SIZE="100M" + declare -x OWNCLOUD_MEMORY_LIMIT [[ -z "${OWNCLOUD_MEMORY_LIMIT}" ]] && OWNCLOUD_MEMORY_LIMIT="512M" diff --git a/v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini b/v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini index c43df61d..1b02d4d0 100644 --- a/v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini +++ b/v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini @@ -3,12 +3,15 @@ variables_order = "EGPCS" apc.enable_cli = 1 upload_max_filesize = "20G" -post_max_size = "20G" +post_max_size = "100M" max_execution_time = 3600 max_input_time = 3600 default_socket_timeout = 60 +expose_php = Off +max_input_nesting_level = 6 + session.save_handler = "files" session.save_path = "/mnt/data/sessions" diff --git a/v22.04/overlay/etc/templates/apache.conf.tmpl b/v22.04/overlay/etc/templates/apache.conf.tmpl index 20f8ce22..d4c7031f 100644 --- a/v22.04/overlay/etc/templates/apache.conf.tmpl +++ b/v22.04/overlay/etc/templates/apache.conf.tmpl @@ -21,5 +21,8 @@ AllowOverride All Options -Indexes +FollowSymlinks LimitRequestBody 0 + # php_admin_value: ownCloud's .htaccess sets php_value post_max_size, which + # would otherwise win over php.ini + php_admin_value post_max_size {{ .Env.OWNCLOUD_POST_MAX_SIZE }} diff --git a/v22.04/overlay/etc/templates/owncloud.ini.tmpl b/v22.04/overlay/etc/templates/owncloud.ini.tmpl index 8d40e57a..9dcc998e 100644 --- a/v22.04/overlay/etc/templates/owncloud.ini.tmpl +++ b/v22.04/overlay/etc/templates/owncloud.ini.tmpl @@ -3,7 +3,7 @@ variables_order = "EGPCS" apc.enable_cli = 1 upload_max_filesize = "{{ .Env.OWNCLOUD_MAX_UPLOAD }}" -post_max_size = "{{ .Env.OWNCLOUD_MAX_UPLOAD }}" +post_max_size = "{{ .Env.OWNCLOUD_POST_MAX_SIZE }}" memory_limit = "{{ .Env.OWNCLOUD_MEMORY_LIMIT }}" max_execution_time = {{ .Env.OWNCLOUD_MAX_EXECUTION_TIME }} @@ -11,6 +11,9 @@ max_input_time = {{ .Env.OWNCLOUD_MAX_INPUT_TIME }} default_socket_timeout = {{ .Env.OWNCLOUD_DEFAULT_SOCKET_TIMEOUT }} +expose_php = Off +max_input_nesting_level = 6 + session.save_handler = "{{ .Env.OWNCLOUD_SESSION_SAVE_HANDLER }}" session.save_path = "{{ .Env.OWNCLOUD_SESSION_SAVE_PATH }}" {{- if eq .Env.OWNCLOUD_SESSION_SAVE_HANDLER "redis" }} diff --git a/v24.04/overlay/etc/entrypoint.d/10-base.sh b/v24.04/overlay/etc/entrypoint.d/10-base.sh index 55d18f63..4ee72f7e 100755 --- a/v24.04/overlay/etc/entrypoint.d/10-base.sh +++ b/v24.04/overlay/etc/entrypoint.d/10-base.sh @@ -40,6 +40,9 @@ declare -x OWNCLOUD_POST_CRONJOB_PATH declare -x OWNCLOUD_MAX_UPLOAD [[ -z "${OWNCLOUD_MAX_UPLOAD}" ]] && OWNCLOUD_MAX_UPLOAD="20G" +declare -x OWNCLOUD_POST_MAX_SIZE +[[ -z "${OWNCLOUD_POST_MAX_SIZE}" ]] && OWNCLOUD_POST_MAX_SIZE="100M" + declare -x OWNCLOUD_MEMORY_LIMIT [[ -z "${OWNCLOUD_MEMORY_LIMIT}" ]] && OWNCLOUD_MEMORY_LIMIT="512M" diff --git a/v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini b/v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini index c43df61d..1b02d4d0 100644 --- a/v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini +++ b/v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini @@ -3,12 +3,15 @@ variables_order = "EGPCS" apc.enable_cli = 1 upload_max_filesize = "20G" -post_max_size = "20G" +post_max_size = "100M" max_execution_time = 3600 max_input_time = 3600 default_socket_timeout = 60 +expose_php = Off +max_input_nesting_level = 6 + session.save_handler = "files" session.save_path = "/mnt/data/sessions" diff --git a/v24.04/overlay/etc/templates/apache.conf.tmpl b/v24.04/overlay/etc/templates/apache.conf.tmpl index 20f8ce22..d4c7031f 100644 --- a/v24.04/overlay/etc/templates/apache.conf.tmpl +++ b/v24.04/overlay/etc/templates/apache.conf.tmpl @@ -21,5 +21,8 @@ AllowOverride All Options -Indexes +FollowSymlinks LimitRequestBody 0 + # php_admin_value: ownCloud's .htaccess sets php_value post_max_size, which + # would otherwise win over php.ini + php_admin_value post_max_size {{ .Env.OWNCLOUD_POST_MAX_SIZE }} diff --git a/v24.04/overlay/etc/templates/owncloud.ini.tmpl b/v24.04/overlay/etc/templates/owncloud.ini.tmpl index 8d40e57a..9dcc998e 100644 --- a/v24.04/overlay/etc/templates/owncloud.ini.tmpl +++ b/v24.04/overlay/etc/templates/owncloud.ini.tmpl @@ -3,7 +3,7 @@ variables_order = "EGPCS" apc.enable_cli = 1 upload_max_filesize = "{{ .Env.OWNCLOUD_MAX_UPLOAD }}" -post_max_size = "{{ .Env.OWNCLOUD_MAX_UPLOAD }}" +post_max_size = "{{ .Env.OWNCLOUD_POST_MAX_SIZE }}" memory_limit = "{{ .Env.OWNCLOUD_MEMORY_LIMIT }}" max_execution_time = {{ .Env.OWNCLOUD_MAX_EXECUTION_TIME }} @@ -11,6 +11,9 @@ max_input_time = {{ .Env.OWNCLOUD_MAX_INPUT_TIME }} default_socket_timeout = {{ .Env.OWNCLOUD_DEFAULT_SOCKET_TIMEOUT }} +expose_php = Off +max_input_nesting_level = 6 + session.save_handler = "{{ .Env.OWNCLOUD_SESSION_SAVE_HANDLER }}" session.save_path = "{{ .Env.OWNCLOUD_SESSION_SAVE_PATH }}" {{- if eq .Env.OWNCLOUD_SESSION_SAVE_HANDLER "redis" }} From 9a2703d042c48482ba44a4d991a3927dccee8130 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Thu, 22 Oct 2026 16:46:39 +0200 Subject: [PATCH 2/3] fix: quote post_max_size in the vhost and correct the ownCloud 10 notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A value with a space no longer breaks Apache's config parsing. On ownCloud 10, .htaccess pins memory_limit to 512M and upload_max_filesize to 513M, so the environment variables do not set those there. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- ENVIRONMENT.md | 4 ++-- v22.04/overlay/etc/templates/apache.conf.tmpl | 2 +- v24.04/overlay/etc/templates/apache.conf.tmpl | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ENVIRONMENT.md b/ENVIRONMENT.md index c4d35b2d..2dd45dc3 100644 --- a/ENVIRONMENT.md +++ b/ENVIRONMENT.md @@ -242,7 +242,7 @@ - `OWNCLOUD_MAX_INPUT_TIME=3600` \ Sets PHP option `max_input_time`. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)). - `OWNCLOUD_MAX_UPLOAD=20G` \ - Sets PHP option `upload_max_filesize`. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)). + Sets PHP option `upload_max_filesize`. On ownCloud 10 the web server uses 513M instead, because ownCloud's `.htaccess` sets it. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)). - `OWNCLOUD_MEMORY_LIMIT=512M` \ Sets PHP option `memory_limit`. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)). - `OWNCLOUD_MINIMUM_SUPPORTED_DESKTOP_VERSION=` \ @@ -301,7 +301,7 @@ - `OWNCLOUD_POST_INSTALL_PATH=/etc/post_install.d` \ Path to custom scripts that need to be executed after an ownCoud installation command. - `OWNCLOUD_POST_MAX_SIZE=100M` \ - Sets PHP option `post_max_size`, the size limit for form and multipart POST bodies that PHP parses. File uploads go through WebDAV `PUT` and are not affected, and the body of other POST requests is still readable. Keep it below a quarter of `OWNCLOUD_MEMORY_LIMIT`, so that parsing a large request cannot reach PHP's memory limit. + Sets PHP option `post_max_size`, the size limit for form and multipart POST bodies that PHP parses. File uploads go through WebDAV `PUT` and are not affected, and the body of other POST requests is still readable. Keep it below a quarter of PHP's `memory_limit`, so that parsing a large request cannot reach it. That is `OWNCLOUD_MEMORY_LIMIT` on ownCloud 11, but on ownCloud 10 the web server always uses 512M, because ownCloud's `.htaccess` sets it. - `OWNCLOUD_POST_SERVER_PATH=/etc/post_server.d` \ Path to custom scripts that need to be executed after an ownCloud server startup. - `OWNCLOUD_PREVIEW_JPEG_IMAGE_DISPLAY_QUALITY=` \ diff --git a/v22.04/overlay/etc/templates/apache.conf.tmpl b/v22.04/overlay/etc/templates/apache.conf.tmpl index d4c7031f..6fa54c04 100644 --- a/v22.04/overlay/etc/templates/apache.conf.tmpl +++ b/v22.04/overlay/etc/templates/apache.conf.tmpl @@ -23,6 +23,6 @@ LimitRequestBody 0 # php_admin_value: ownCloud's .htaccess sets php_value post_max_size, which # would otherwise win over php.ini - php_admin_value post_max_size {{ .Env.OWNCLOUD_POST_MAX_SIZE }} + php_admin_value post_max_size "{{ .Env.OWNCLOUD_POST_MAX_SIZE }}" diff --git a/v24.04/overlay/etc/templates/apache.conf.tmpl b/v24.04/overlay/etc/templates/apache.conf.tmpl index d4c7031f..6fa54c04 100644 --- a/v24.04/overlay/etc/templates/apache.conf.tmpl +++ b/v24.04/overlay/etc/templates/apache.conf.tmpl @@ -23,6 +23,6 @@ LimitRequestBody 0 # php_admin_value: ownCloud's .htaccess sets php_value post_max_size, which # would otherwise win over php.ini - php_admin_value post_max_size {{ .Env.OWNCLOUD_POST_MAX_SIZE }} + php_admin_value post_max_size "{{ .Env.OWNCLOUD_POST_MAX_SIZE }}" From 2eef8ca7850e79d6fffb284d5431c14f26d87a14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Thu, 22 Oct 2026 22:21:20 +0200 Subject: [PATCH 3/3] fix: disable session.upload_progress MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GHSA-6wmf-4rv5-p3rp names session upload progress as the confirmed mod_php attack path for CVE-2026-109619 and recommends keeping it off after patching. Nothing in ownCloud core or its bundled apps uses it. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- CHANGELOG.md | 4 +++- v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini | 1 + v22.04/overlay/etc/templates/owncloud.ini.tmpl | 1 + v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini | 1 + v24.04/overlay/etc/templates/owncloud.ini.tmpl | 1 + 5 files changed, 7 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7e184958..d9be9cd7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,9 @@ ownCloud's `.htaccess` can no longer raise it to 513M. It used to follow `OWNCLOUD_MAX_UPLOAD` (20G). `max_input_nesting_level` is lowered from 64 to 6, and `expose_php = Off` is now set explicitly; Ubuntu's `php.ini` already - had it off. File uploads use WebDAV `PUT` and are not affected + had it off. `session.upload_progress.enabled` is off: the advisory names it as + an attack path, and ownCloud does not use it. File uploads use WebDAV `PUT` + and are not affected ## 2026-08-18 diff --git a/v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini b/v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini index 1b02d4d0..f89758d3 100644 --- a/v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini +++ b/v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini @@ -12,6 +12,7 @@ default_socket_timeout = 60 expose_php = Off max_input_nesting_level = 6 +session.upload_progress.enabled = Off session.save_handler = "files" session.save_path = "/mnt/data/sessions" diff --git a/v22.04/overlay/etc/templates/owncloud.ini.tmpl b/v22.04/overlay/etc/templates/owncloud.ini.tmpl index 9dcc998e..369ce752 100644 --- a/v22.04/overlay/etc/templates/owncloud.ini.tmpl +++ b/v22.04/overlay/etc/templates/owncloud.ini.tmpl @@ -13,6 +13,7 @@ default_socket_timeout = {{ .Env.OWNCLOUD_DEFAULT_SOCKET_TIMEOUT }} expose_php = Off max_input_nesting_level = 6 +session.upload_progress.enabled = Off session.save_handler = "{{ .Env.OWNCLOUD_SESSION_SAVE_HANDLER }}" session.save_path = "{{ .Env.OWNCLOUD_SESSION_SAVE_PATH }}" diff --git a/v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini b/v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini index 1b02d4d0..f89758d3 100644 --- a/v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini +++ b/v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini @@ -12,6 +12,7 @@ default_socket_timeout = 60 expose_php = Off max_input_nesting_level = 6 +session.upload_progress.enabled = Off session.save_handler = "files" session.save_path = "/mnt/data/sessions" diff --git a/v24.04/overlay/etc/templates/owncloud.ini.tmpl b/v24.04/overlay/etc/templates/owncloud.ini.tmpl index 9dcc998e..369ce752 100644 --- a/v24.04/overlay/etc/templates/owncloud.ini.tmpl +++ b/v24.04/overlay/etc/templates/owncloud.ini.tmpl @@ -13,6 +13,7 @@ default_socket_timeout = {{ .Env.OWNCLOUD_DEFAULT_SOCKET_TIMEOUT }} expose_php = Off max_input_nesting_level = 6 +session.upload_progress.enabled = Off session.save_handler = "{{ .Env.OWNCLOUD_SESSION_SAVE_HANDLER }}" session.save_path = "{{ .Env.OWNCLOUD_SESSION_SAVE_PATH }}"