I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, gives access to various resources which I assumed were therefore password-protected. That is, until I tried to log out and type https://server/nextcloud/data/user/files/, which, to my surprise, showed a directory listing of Nextcloud files belonging to user, without requiring a password at all!

Is Nextcloud really missing any data protection whatsoever in its right-out-of-the-box state, or did I miss something obvious?


The problem isn't with Nextcloud, but rather with the random guy's installation guide that you chose to follow. Had you followed Nextcloud's official one instead, then that attack wouldn't work. The problem is that Nextcloud uses a .htaccess file to protect that directory, and the random unofficial installation guide didn't bother to tell you that you needed to enable .htaccess files in Apache's config (AllowOverride). This mistake is common enough that under "Security & setup warnings" under Administration -> Overview, it will self-test and warn you about it if it detects it.

Further, following Nextcloud's hardening and security guidance would also stop this, as they recommend that you set the data directory to be somewhere that's not under the document root.

| improve this answer | |
  • Thanks, that was it! Good thing I checked this before I really started using it. – Dmitry Grigoryev Sep 14 '19 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.