From 1f05044f4f0c3f9688cced6af92c4834be1ea127 Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Tue, 9 Jun 2026 18:05:09 +0200
Subject: [PATCH] docs: block access to metadata files in nginx sample configs

The nginx sample configs served top-level metadata files (composer.json,
composer.lock, package.json, package-lock.json, core/shipped.json) as plain
files, since they matched neither a 404 block nor the static-asset extension
list and fell through to `try_files $uri`. This leaked dependency information.

Add a 404 location block matching these files to both the root and subdir
sample configs, alongside the existing rules that hide non-public paths.

Fixes #15101

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 .../installation/nginx-root.conf.sample         | 17 ++++++++++++-----
 .../installation/nginx-subdir.conf.sample       | 17 ++++++++++++-----
 2 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/admin_manual/installation/nginx-root.conf.sample b/admin_manual/installation/nginx-root.conf.sample
index 5e571361d6d..519442d1a55 100644
--- a/admin_manual/installation/nginx-root.conf.sample
+++ b/admin_manual/installation/nginx-root.conf.sample
@@ -1,4 +1,5 @@
-# Version 2025-07-23
+# Nextcloud nginx configuration — root installation
+# Version 2026-06-09
 
 upstream php-handler {
     server 127.0.0.1:9000;
@@ -148,10 +149,16 @@ server {
     location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
     location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
 
-    # Ensure this block, which passes PHP files to the PHP process, is above the blocks
-    # which handle static assets (as seen below). If this block is not declared first,
-    # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
-    # to the URI, resulting in a HTTP 500 error response.
+    # Hide metadata files which would otherwise be served as plain files and
+    # leak dependency information (composer.json, package.json, core/shipped.json).
+    location ~ ^/(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ { return 404; }
+
+    # Pass PHP requests to PHP-FPM.
+    #
+    # Important: this block must appear above the static asset locations
+    # below. Those locations fall back to `/index.php$request_uri`; if
+    # they appear first, nginx can repeatedly rewrite to `/index.php`,
+    # causing an internal redirection loop.
     location ~ \.php(?:$|/) {
         # Required for legacy support
         rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
diff --git a/admin_manual/installation/nginx-subdir.conf.sample b/admin_manual/installation/nginx-subdir.conf.sample
index 6fe1dfd7995..99dffa5445d 100644
--- a/admin_manual/installation/nginx-subdir.conf.sample
+++ b/admin_manual/installation/nginx-subdir.conf.sample
@@ -1,4 +1,5 @@
-# Version 2025-07-23
+# Nextcloud nginx configuration — subdirectory installation (/nextcloud)
+# Version 2026-06-09
 
 upstream php-handler {
     server 127.0.0.1:9000;
@@ -147,10 +148,16 @@ server {
         location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)    { return 404; }
         location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console)                  { return 404; }
 
-        # Ensure this block, which passes PHP files to the PHP process, is above the blocks
-        # which handle static assets (as seen below). If this block is not declared first,
-        # then Nginx will encounter an infinite rewriting loop when it prepends
-        # `/nextcloud/index.php` to the URI, resulting in a HTTP 500 error response.
+        # Hide metadata files which would otherwise be served as plain files and
+        # leak dependency information (composer.json, package.json, core/shipped.json).
+        location ~ ^/nextcloud/(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ { return 404; }
+
+        # Pass PHP requests to PHP-FPM.
+        #
+        # Important: this block must appear above the static asset locations
+        # below. Those locations fall back to `/nextcloud/index.php$request_uri`;
+        # if they appear first, nginx can repeatedly rewrite to
+        # `/nextcloud/index.php`, causing an internal redirection loop.
         location ~ \.php(?:$|/) {
             # Required for legacy support
             rewrite ^/nextcloud/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /nextcloud/index.php$request_uri;