nextcloud: build oci-images with php strict_mode enabled

nextcloud/99-security-hardening.ini

@@ -0,0 +1,9 @@
+; Whether to use strict session mode.
+; Strict session mode does not accept an uninitialized session ID, and
+; regenerates the session ID if the browser sends an uninitialized session ID.
+; Strict mode protects applications from session fixation via a session adoption
+; vulnerability. It is disabled by default for maximum compatibility, but
+; enabling it is encouraged.
+; https://wiki.php.net/rfc/strict_sessions
+session.use_strict_mode = 1
+

nextcloud/Containerfile

@@ -1,6 +1,8 @@
 ARG TAG
 FROM git.hamburg.ccc.de/ccchh/oci-images/nextcloud-base:${TAG}
 
+COPY 99-security-hardening.ini /usr/local/etc/php/conf.d/99-security-hardening.ini
+
 RUN apt-get update \
     && apt-get install -y supervisor \
     && rm -rf /var/lib/apt/lists/* \