Allow .well-known subdirectory and files to bypass file integrity checker

[asuweb]

Steps to reproduce

1. Setup nextcloud in root directory
2. Install letsencrypt certificate using cert-bot
3. Visit nextcloud as administrator

Expected behaviour

No file integrity warning, no prevention of automated upgrade due to file integrity

Actual behaviour

File integrity warnings generated due to presence of .well-known directory and contents required for letsencrypt cert-bot verification

Server configuration

Operating system:

Web server:

Database:

PHP version:

Nextcloud version: (see Nextcloud admin page)
12.0.3

[MorrisJobke]

File integrity warnings generated due to presence of .well-known directory and contents required for letsencrypt cert-bot verification

Best way to handle this is to map this in your web servers config to a different directory. We had in the past problems with random files/folders being present in the Nextcloud directory causing it weird bugs. That's the reason why we do not allow that in the whitelist.

[jene]

Setup:
nextcloud 12.0.4 installed on a managed server running plesk. There is no possibility to access or even change the web server config outside of .htaccess.

Cloud you recommend a way to change the location to an other directory? Is there the possibilty to write an app which will add ^.well-known/acme-challenge/* to the whitelist?

Because having the security warning showing the whole time beats the purpose of it.

Thanks for an answer.

[My1]

@MorrisJobke enough hosters/control panels that do this kind of stuff use this folder with no ability to move it, as far as I read both plesk and cpanel do this, which should affect quite a number of hosters, and the users, as always have no way of changing that.

also this folder exists as a part of an RFC since 2010. it should really at least ginore that folder.

[danieljwonder]

Is there any way to whitelist specific files at least?

[maederm]

@danieljwonder yes, but it's really hacky. You can add a new entry in your config.php

'apps_paths' =>
  array (
    //[...],
    // really ugly workaround for https://github.com/nextcloud/server/issues/7448, see code https://github.com/nextcloud/server/blob/0c8f89c9d76310a2c383dfcd78a3535d32009250/lib/private/IntegrityCheck/Iterator/ExcludeFoldersByPathFilterIterator.php#L17
    1 =>
    array (
      'path' => '/your/path/to/nextcloud/httpdocs/.well-known/acme-challenge',
      'url' => '/appsyolo', // configure whatever
      'writable' => false,
    ),
  ),

After this I stopped getting warnings for .well-known/acme-challenge/.htaccess.

Possible fix

Instead of this you could also add rtrim(\OC::$SERVERROOT . '/.well-known/acme-challenge/.htaccess', '/'), here. Using rtrim($root . '/.well-known/acme-challenge/.htaccess', '/'), doesn't work because $root is only set for the first iteration, after we descend into .well-known it is just an empty string.
Doing this by yourself of course gives a new error. But maybe I can get it into Nextcloud itself.

@MorrisJobke, should I open a PR with this change? If yes, should I replace all $root with \OC::$SERVERROOT as well?
I can't set another directory because of the Plesk installation by my hoster.