docs: block access to metadata files in nginx sample configs

[szaimen]

☑️ Resolves

• Fix Block superfluous file access #15101

The nginx sample configs (nginx-root.conf.sample and nginx-subdir.conf.sample) served the following top-level metadata files as plain files:

• https://nc-domain/composer.json
• https://nc-domain/composer.lock
• https://nc-domain/package.json
• https://nc-domain/package-lock.json
• https://nc-domain/core/shipped.json

These paths matched neither an existing return 404 block nor the static-asset extension list, so they fell through to location / → try_files $uri and were served verbatim, leaking dependency information.

This adds a 404 location block matching these files to both samples, placed alongside the existing rules that hide non-public paths:

location ~ ^/(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ { return 404; }

The block is positioned before the \.php and static-asset regex blocks so nginx (which evaluates regex location blocks in file order) matches it first.

Note

The upstream server/.htaccess does not block these files either — it only covers the build|tests|config|lib|3rdparty|templates directories and dotfiles. Apache installs likely have the same exposure. It may be worth opening a nextcloud/server issue to add the equivalent rule there so the two configs don't drift.

🖼️ Screenshots

No visual change — these are literalinclude-d config samples, not rendered page content.

✅ Checklist

• I have built the documentation locally and reviewed the output
• Screenshots are included for visual changes
• I have not moved or renamed pages (or added a redirect if I did)
• I have run codespell or similar and addressed any spelling issues

🤖 Generated with Claude Code

[github-actions]

📖 Documentation Preview

🔍 Open preview →

No RST documentation pages changed in this PR.

Last updated: Tue, 09 Jun 2026 17:22:56 GMT

[joshtrichards]

The upstream server/.htaccess does not block these files either — it only covers the build|tests|config|lib|3rdparty|templates directories and dotfiles.

I'd really like to change the directory structure so that only the bare minimum (i.e entrypoints) are in a public/ or similar (which becomes the webroot). And everything else is in the parent and/or subfolders of the parent. Then this problem goes away (and accidents become less likely).

But that's a far bigger change and likely unrealistic for the time being I suppose.

[szaimen]

But that's a far bigger change and likely unrealistic for the time being I suppose.

Yes I fear so

[skjnldsv]

Backports ?

[szaimen]

/backport to stable34

[szaimen]

/backport to stable33

[backportbot]

The backport to stable33 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable33
git pull origin stable33

# Create the new backport branch
git checkout -b backport/15102/stable33

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick f89d70c3

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/15102/stable33

Error: Failed to check for changes with origin/stable33: No changes found in backport branch

---

Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

[szaimen]

#15145