I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, gives access to various resources which I assumed were therefore password-protected. That is, until I tried to log out and type
https://server/nextcloud/data/user/files/, which, to my surprise, showed a directory listing of Nextcloud files belonging to
user, without requiring a password at all!
Is Nextcloud really missing any data protection whatsoever in its right-out-of-the-box state, or did I miss something obvious?