config/ subdirectory does not need to be writeable

[UnitedMarsupials-zz]

For people, who maintain their configuration-files with tools like Puppet, making them writeable by the Internet-exposed applications is an unnecessary security risk. Under normal circumstances the config/ subdirectory of a production ownCloud installation does not need to be writeable.

And yet, as things stand, oC considers being unable to write to the directory not even a cause for warning, but a fatal error.

Please, fix. Thank you.

[ghost]

@UnitedMarsupials Does the existing config.php option config_is_read_only won't do the trick here?

https://doc.owncloud.org/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#owncloud-verifications

[UnitedMarsupials-zz]

Does the existing config.php option config_is_read_only won't do the trick here?

Well, yes and no. Yes, because it does allow a work-around. No, because the stern message about it being mandatory for config to be writeable does not mention the option.

More importantly, why make it mandatory at all? If/when an admin attempts to modify the config, the error resulting from a failed attempt can be displayed. But there is no reason to disable the entire instance because of it -- regardless of the config_is_read_only setting.

[PVince81]

Slightly related: #11843

[PVince81]

and possible bug with read only config: #23245

[VicDeo]

right now config.php contains OC version.
I guess upgrade will be possible if there is no write access to config.php

[ownclouders]

Hey, this issue has been closed because the label status/STALE is set and there were no updates for 7 days. Feel free to reopen this issue if you deem it appropriate.

(This is an automated comment from GitMate.io.

[ownclouders]

Hey, this issue has been closed because the label status/STALE is set and there were no updates for 7 days. Feel free to reopen this issue if you deem it appropriate.

(This is an automated comment from GitMate.io.)

[ownclouders]

Hey, this issue has been closed because the label status/STALE is set and there were no updates for 7 days. Feel free to reopen this issue if you deem it appropriate.

(This is an automated comment from GitMate.io.)

[UnitedMarsupials-zz]

This is still as much a bug as it was 11 months ago. But I don’t have an option to reopen. If you do, please, use it.

[PVince81]

closing in favor of #11843 where config.php keys would be moved to the database so config.php would always be read-only