From 146ca74b84c376a8bcc28f70489ee2e3e4e7d40f Mon Sep 17 00:00:00 2001
From: chris <c6ristian@christian.moe>
Date: Wed, 21 Oct 2026 20:31:49 +0200
Subject: [PATCH] nextcloud: build oci-images with php strict_mode enabled

---
 nextcloud/99-security-hardening.ini | 9 +++++++++
 nextcloud/Containerfile             | 2 ++
 2 files changed, 11 insertions(+)
 create mode 100644 nextcloud/99-security-hardening.ini

diff --git a/nextcloud/99-security-hardening.ini b/nextcloud/99-security-hardening.ini
new file mode 100644
index 0000000..90a4b57
--- /dev/null
+++ b/nextcloud/99-security-hardening.ini
@@ -0,0 +1,9 @@
+; Whether to use strict session mode.
+; Strict session mode does not accept an uninitialized session ID, and
+; regenerates the session ID if the browser sends an uninitialized session ID.
+; Strict mode protects applications from session fixation via a session adoption
+; vulnerability. It is disabled by default for maximum compatibility, but
+; enabling it is encouraged.
+; https://wiki.php.net/rfc/strict_sessions
+session.use_strict_mode = 1
+
diff --git a/nextcloud/Containerfile b/nextcloud/Containerfile
index d76a998..a1fa572 100644
--- a/nextcloud/Containerfile
+++ b/nextcloud/Containerfile
@@ -1,6 +1,8 @@
 ARG TAG
 FROM git.hamburg.ccc.de/ccchh/oci-images/nextcloud-base:${TAG}
 
+COPY 99-security-hardening.ini /usr/local/etc/php/conf.d/99-security-hardening.ini
+
 RUN apt-get update \
     && apt-get install -y supervisor \
     && rm -rf /var/lib/apt/lists/* \