From 062efbb2ffc5d2135be095e708f44230766d9222 Mon Sep 17 00:00:00 2001 From: oparoz Date: Mon, 5 Sep 2016 15:20:24 +0200 Subject: [PATCH 1/3] Add zip blocking example --- .../files_access_control.rst | 14 ++++++++++++++ .../files_access_control_block_mimetype.png | Bin 0 -> 11956 bytes 2 files changed, 14 insertions(+) create mode 100644 admin_manual/configuration_files/images/files_access_control_block_mimetype.png diff --git a/admin_manual/configuration_files/files_access_control.rst b/admin_manual/configuration_files/files_access_control.rst index 44f50a0b3..087b84ad9 100644 --- a/admin_manual/configuration_files/files_access_control.rst +++ b/admin_manual/configuration_files/files_access_control.rst @@ -49,6 +49,20 @@ This example blocks access to any folder with the tag ``Confidential``. .. figure:: images/files_access_control_collaborative_tags.png :alt: Deny access based on collaborative tag +Prevent uploading of specific files +------------------------- + +It's possible to prevent specific files from being uploaded to Nextcloud. You +simply need to define a rule based on the mimetype and our powerful access control +engine will block any attempt to upload the file. The safest way to define the rule +is to use a regular expression, as it will help you cover all the known media types +used for the type of file you're trying to block. + +The following example prevents zip files from being uploaded. + + .. figure:: images/files_access_control_block_mimetype.png + :alt: Prevent upload based on mimetype + .. _available-rules-label: Available rules diff --git a/admin_manual/configuration_files/images/files_access_control_block_mimetype.png b/admin_manual/configuration_files/images/files_access_control_block_mimetype.png new file mode 100644 index 0000000000000000000000000000000000000000..1dc9b7b1cd5d573e2cf3ca856ba3b6ef77ae895e GIT binary patch literal 11956 zcmch7bySqy+pda&1t>9ugwo*9-6}bxAT8w#;m{)~DT)$9NJt5cw19vk4FaOfAkrn> zB`qZk`E7XLUwrGFbm>}T(N@B6y%>$*bkYpIZ4roVjV%o$Rcs-o_h zGen=jb;HGT;M4E(4IS{~tgEidy)#Aa3=81PdE2|1ch8)`MqN30bOC(7|!@Y!(sNrz?!*9a^dEav>_rxi3F zT!-Vp%@oy)=wj2VC#xe>&RKjJEnVxnG;wUO{GL7|-#^QPtSXTVG1ZZgDm&_oIx%c{ z89vzEuP?7;#n#oy$z>Vq8k$zSg@WIftifWkJgRBX&FoE)jOvuS{fx5SaaxHSV4R}9 zS|i_?@6pb61P)DAv;OgMZB7kJFn0fm;W&EUlR4!DVvRCiVvS2ll=Vi9Ngq)N4z)0H zwU!OfUyzXFXK-j5!y;4I{YV&M{l4JooMmay>eqjdRJpb$$@+K%1O&8JZNt~2Syc=Q zO_bFl@6x zaJ?~<@(Ki6x!EqgR=rdN-fwLHJKdeFjx=sb61Ej{82HlN9LpJXLwq$_h3OIXTmoE> zu-|8BVOHT}hIC&Zua`Gp`3~k-Z_`E(@!J{obeQSQd!QqfZ!R$2=2-fk_;e49U>hfR-a!~%5 z5EXEMSQ#p7omU;40}rowx;eKv8LoA@`>EDl)v*jNOxnDA_*^B+S1hSwxd0 zAaAHPe@%W1rr|S99Jh4(B8CY#A{0KXz*~tzwBL%YwD8x5H{TI5|7dx)W+zHI3WxFE zTloBRlZBFmXLH201LsLxu6?x1_A~0QrFb_FM;)? z-_cT5fS{`?57HnMSR96ZsRp4(ecK@Jo*m>Z3u#BHwD_@{i7?r%db#WQ*vdGR!qWF2 zp<-YR*s*#%^pVha{cNQ@#D?~Upi&Ce#-K% z_x*wySsB10+EXM6l1_pgQ@V57xB=2(eQr7dzw`%Dz0wDRP^ zyJUnFZt)>=X8d2LrOL?kAW%$BJ5}n<&E1uX@f?abM&Xp4THt(UO_wv}>gGEz+PzvmyfZCIXb5&)uaMbc;A3ERpOMD)lttCs5h2&PR?o4g zoVq@RcA`T#cw_w&ar>ViLMb^vp(4F!f4o_j*#!|1WT`b2Ws;xk6!+I6*HWXM&t?s@ zy%o>Bv`z6hgfPMTRO%P6|BW^>jo~=imcIcfI1yWEdxD?rhwa1hjwILGd8^RXN91%@h+dr?dIEU@>~R!za4{TfBQR zy}t{Cze<7=DE+%I_^Tv1jg*tZK;$y031$HfEm%}WXFbBrz861E;srAwojM5KVc(|b zQ!`EOR?4?^lZFHUGyrLp5G)cVc%JqmQuS)%t<3zMTy0nBDqq5rMfM1=sb3i17Z*p7 zBjedf3)B<%P&!lHz4ratMR@qysxIC|l_*m-IDAObeUa+8)@vQUczXr4Ch4(kl>9m? z4Fy()?>;g^9IO{cJ|GRfi-hrBB_UR#XL4r{vV)ACAYoopDe9j^hHl5NwYB+kZ#cXa zcHk(Pov?x`wpR+9M2O&UVnuSg-+}At3c+BS-q#X1{_$j2!XGAnYeAOo-|s0e=pysT zWU~mzl3$FVdE#{F+9q{ac!-G1qGF()NxlL(Kx_K+aNO8*Hk+~{c#VuZJiLAB!C*ln z?t>|<>r$|?kVZ-A+R*lRBK2v$}N|y+g1@-50H);2qij{T&;PpvWL0 zh)+~P4DEHKS8wRKyi&bjCQu}Z-20Edw%5hgbqjyO>;rAt?Lk{iHZtP;D6$NoQfh5h zXd2BwroRefT?!hH`E{$p1$wkvv*v%eWPy=#=h0kJKAaP;mjtCjawqRh?amk?JS+4M z*PqkUYl{Mb8upP1MDA@Z$mj18Is&vZhCrRO*&)x&Uc-Ri-``K*w>avrKN8g(_vO@1 z8~ON%C^#u6Si!<#JVOb61mHVs;qKBC=p3lg`DoI zk?;1R{zlJ3=h`FrXtw|Ki8FV^FhN-nqiOrge?AcO(HS7Fs0bCQ)HWt;0w%%HN~n8Klvd)_0i~p*f+E0u>1U#akR`OvW%6q*K#+x84B3hi?Q3i$HzfAiFfK=j8Xd(f-(KcS zix6xpMfT*B+4qZ;_HQpff#N~Jtn6_K2y15QrN0JJT5-i19Xgm%*6Jcc@T^xR5||;qO1g&dkF?Aisia^*X(0in&wvXj=a0h4W+l zRP=Q;x|#u9^~E&vimbJC-~kDLXai|6wn7{{pRRqrvLpWXxwL& zr{1JP?!GZJ2giPZQd_3$kOZF%7H#b5e5!5QQx44$23&B1zG*7$V-XAAG;wF97krRW zwmL;r0Z*;s-5IkI8_iX(k+%8Pq;J$W<#}`ZSH|n>hlB%;_s2_|l7F!v)=Ba3)w;K0 zj$s{r&$f5!kNvh6`v453h#SpiKK?xoBGZX#gdRS&D?{$q~SGboB{D)3!oa**AGa`4=~3B zjOjA`jmyNBvue5uG6%oEl^q9Q^ec_DK^xJUDA<#uiLeJK$~mB8Tdl>jMWm&gLb+H1 zswq$uckGO~lHbTx>x~#y!hZ3y?k_SEwrRDT)>{Lia&)lS(evptS&-wL>p&6mJ@pC& zCNpq=yT)ceB?#2ly6k^$T*xoPHwcmCY4=KMAxwVe3#>?Zu9}L8TK}N>aj+9`EY2y( z>(pF>;9k*^j@KP(PnAag0N^Czr|^EW{&2YdP~GQvulRVc{&>GWZ)8=UnEk8Civ+aCk%1cKMQ1r#jskS-%~ z*{%C-0$LL8A$5$Tcaw(V?fMCWxGVgh@3a}CmIttIZ$WgYNuXGG>-0}*KlcPNr<#>= zy)CIO4+Uy8ziH)1he06|PR)v=`6F;#nkU$~>UXEm*(CV5T%y)wQM40Lk-T&Lp+{tI zkU$2lY#^c@G&|fb{brtr9mfac_DW|P3zO$St$o&->rT^fiERgf%8WbQkc1-@f&HoH ztxA@l1o?1f&-}x1e?QG(QhRH>;RmCJQ1}t(kR+7Vx(DA2oHR-Yc1L`DzMve%ZJJ6+ z?eV%#P|XT0|H3vgW%@K(T_U`2!pPIqhq)YO!s%GiI{1tMBoz^+N*h&OiPnMfd_h8G zxm&qR!*HO50cXrV57GI2grOjcq9MJ|v`VNi@1<)?(&XjlZg`Jd_f{D_Jyo{9uJ;Tb z_3rL;)WT~j%PT0F%%M`V-awn7S|87`iD#qas4)p%2L9n0DTt;9osHb@FGLQp?vhB` zj>e>Efz;YKdWKmO2dK>azAKJOZTPkkwmSrrdSciNE3u!Zr zrs20Sn-jpiyJKDXvD|>C3GUHUm|>K-g`a5FNj!ccIbkvPHa(%cTk7{i#L#7;EFlE3Yosv<%y}2ORbXpoA?SXgtXP z7=ZuXPGZ#PFBur#Dl&?K+C-&%Gu3VfADI zIoisVSDK&C_=C1Mm;zvsfm%T5yjt@a;e1l#GPi*3qP!#ARawQT?#JJFja6g*qk2bZ z#|Kqu$gr%*BIuqYU?Oh*CIopi5;l)5Los3+UOc*jc!LKzb&02v&Q0quNC9|EjMTP^~ugs zg8?N&XbTTJR6WrB>LsI?l@K8|l9e^^qx)l*e5_Aj z_%6Mx&G!raW@Vw#?a~`u7!9p@qbN-wSS2=RIFESqYL!InJN26uJqIyG{b}=WY&UFa zQmWtcI{uJg37D_eS^g48^r7!#NJrb-3%u$tk+WRdHLl~iUvcfNEOpnqKM6Kh6rVP? zTw?dB4gJL^G>z%6h`+^FuE?gfbdom0wYUuJymg_MMFfaGnav^iAC^17dU#E%I5d;> zd~KgCox2s|L=~HDx(03_U(#~emYgYE^Hj8xK z`@Y*(>`&cscaRK&_8}SWxWJ_$)e5_~yaTea%}mz9IVrA}ReM)nW%Im!9h>KFXMW0Zcwea)N6N)k4%{CF)i@l$d z!%1R8um7V^Df-rcr;HXEl~SkV(3lv$m+TZuLX6CKu2ibzTlA-v7H%~q;#WB2!S9q+ zwTY2HJ+IO8{l-9Q7rSmLB>4C+Jq(vk+tijg8H z$fe18=E-3=topX~FCIa<_PPD2R8A(Gm2l+CD?*tP9D`bduy>WL z@Y{ZAS~t+=LT}-9G=4HM7W80T9Sbbj&WUnDnlc~oJvL<_nec@;K9LpKErWg zx}8~piN=1%m12+*KJjyWG}#@g6HGe31EvniTFG_!>30|AmkX%U25vh3=;PqX`*OH5 zuHBq?KBB#Lc{af!@*3SP@mGOXow}<1zz|sB69H1aHwL#?(WEi;tS%*dI%TD5kBx%n z+PWX*7w@`K?DCl`w&EVC3XcL*7ik0Z6lf3se1&WzK_g%Cy}Lq(UMg!bPd9_kIRMP7 zD1}_86zjqxtDh-_w|29LwHF!3=R>bx675 z)*C@OXE1$d7oroUHWAaX{l0wi{s-c5sY*42aiYOW6sr%6lDDkMA2HxANVi#KrY{YO zyB86->@{M&1wbl6MIpBDCfTU=AC|3^N%y6fkD__|MhFX++?GNAoP8nl4mX`^ljapC zDp@O4xL}1{avEDgPO+aJ!_e&Ka2drH%4g+zw))P0sg-212wZK@=MqwbMAcN5ZC1Gj z=lIr@)dN0@5N*UcKvvLXD;F1|h*H`5Gvtdm`W}^H9~G&@;IDR5?(-Rr?$p0PXTE-?4v;l6#|ElJ09>-ZaluC-_HDX3fKDRDUqSqla9^l?!2 z0Rk%y2xc5)`CND^Qw7m^C7aMqo8M=-M$q{+f!$HXA5?hXD>D2?>sYO|?bat|@AT3Hr=MTo zN;k`=EBn_zidxQdGW5{xCc6RFXYNI<^^BDan`~^X7#lWmZo)i~^<2^`kB+D?qMf-p z5prO<4=n9^ zH{(A2$5<;|Kj%Fs`rb4KJ#C+#BkzXG9ShoeaEyKB$Zb85VhWR5en$0ew%GP6#sr&; zN^6r95Uev)*I@|cPp7VDZ+YeB`SO`A6aYFrI4wTsA(wJ7;5l=1wNm%GRG71?czt2} zev>_a@}R0q88!!arFa=LeLvdJsY8i^+A?iaxw8uVZ8m7IG(D%Yqy)e#^jgcBpe$5U-iom0Dobh#c$wR^3R)F*AfyDX^ zu02b|EUoRY)psOR&w7^boLG0wP!D-^via-*TwTScCT!rB-MVVG2G`!uG_MGsbQdP*0saE z9UMVJ?WrdlTQ=-q&i=7jrrtZoI6+IxP`ixZ5<1i1wb0FO;9L4q-RbiPgB=ZN<)BAd zVf#Go0^w=z`7oU1%)`!a;m>L3+0g$Bw343zl_b}=3MjBxNbd?GLG@A{C_wobpAd<; zmtY_#{P((ijEPcFbOj+;{va^$u%iAjqPQ3P-YCM3U7?JAxwaf$JF&msIclUapDx_P zy!)d;pFbXAm{%nCJr~#CM=+iZ(uCW;}PlMN87umqs}Om6{Z&KmN!E1Zfr?hz4J%S zKVP}fu=}w?xwuyTI=SluPdKradcmE1kP>?>?puju_xCHj*&XV)_7p9(L`dzl$+#X! ztr)w$00Lc!XBy;zezo69^9S6STWdvtj^2VugrSK?pnZ?~_0?1wlUHfr)RC z>ur}We{ASp6pzAsg&+hoe^onWd}x{Aw{9GI=p*QIRR~hCFMqVsyZXGZN_Vp@<~9vB z$LsrY?UqWgWj|pQzG&e`s7zh-;l?4F-;*ocW)@|J@S5oP?$e2QuGHW@v|Qrm*#B}D zYfpw5k#QdTJT)%*9Pt#i{qQTy{=2u>3s(FejPo)*`3GCIAk`OXIQ-NkZ+AcTi&r{# z6wT2tg()AMB38}a-5_av*9o-{lsWLIsA6-I_i=L!yVbf#VPK~MF*7=pk+AbsN-^Ok zt8Spk=so9j0*kB5c=o)W#mkwo6jn07sEuq-<*Ie^jZrvcHo=qVX`GLIK@%IZ8Z4tS zv%4VPc;Q!mb5ye(+3i=$i%aQHYm4laP9v(@wGHRWK_k{D{N-(@$?BhGj&&Mo=F8r$DuiIrg_5(Cj_Xo(Ic8Lyc{coVpc4Y|7 z8lFrbQPw*k(@J)7?cNQOwEhw2+w1%Oh~;eT`9Uv|>H)h6u6+0Qdd0hfa1@qoA_Pzx zX#@Ap|MDF76Ng+dm@(INP$R=Eo9|_oj{U3Ne6ZqGb|~C5W!DeicjMW!YyAM3_|VNo zTCb=hGxstj@5fcNr6#tbQMUt z5vdPKjRBigF=O8(y5F}I@vHH?5Ap1Rnlw~2qR!=i*aW<)CKAX}mTcXeDdaJd86YJq z5}{0e8{P>klBaVU%Q8E>Q+o<^3p_nta(llrL5|0?kQUOq?(Oei(x5^&v)C9=ny(br z(n=81p|Q3dOgw~ka`{hJo{xfCExbR|Pu+t}iX0O0eQ^7=$d9~V3j|@BfQrOX&?owZ zW4Z2BAZYJ%98*B7E2-wrDKXIZ=XAdvEH3xg+CcNyg}{Dhw*rLN)Y%NY-onRnp4C5< z_qf|7ukT{x)z5%UQBFllFQx!JDub4n$x-bQoGw>Zo|jnEcOsBPB1j_J!S--(+tfk= zcpIo}sGs{MuL|}u{6!(VrP?(WtYA`_Y31C~gPFWTilec{TJ)P${Cp;*Tn2e7J`S7X z05*`%4@6(VyIhuQr97n84z}V)Ydq)q9lAP2j2CW1)4Ldu(4k>GeYWaE@cvS&Zvwhh z?h`pJhU=fXH%QE)VJ5;qe1Rl9Qb?C8S&Ay)5PIU+EN-)Rra%5b%W;8>vEt9J27}cD zoO==_dvl!I!mj7Ffo&ize?Rn%NghYQ;ye`ReF2}){Bzy^qKe_+=oA@3uu@jX z@#kz%T>PiYhFV1kWc8Z}+6R4{nUT5j#5xgn;)7Z=TO zKd5xrd44(}vB-h0XPOp$o$n@0?#6b-B3@+K4i#+G;95gF(#s_iq4=q}Rg&_g8cn>; zXP|+7P$eWP6b`7SJl(rdFcaJy0Z%+%iJJD`h{c=`SdxUo+=?;pCBPO$6k6-$NI;y#PH1r71p||>qvESeTo<6P zztBDbtze>%^^X%Oa(0xNa1hB z@RGPk%YM6)!6$!c@Tm=s5LBzW{rUyM%t^p^{hiW=jtUVfJp9g&n@59HpQG&xP*iWl zozuqlVv85+pES+BK+|j*tI??eRxhLUCNn^>Hwh^aqZan4SVAezTezIj1rc+aD$ zif1ahwOb;)@J(Hl?W2%atm-R#ItDQhLg!6nc=-|Ken@giht$Ur{f$On#i_NXCK2R)S90an9)hmHzDS zDqk#1nMu_Xb{bhos?5_E%9dF^K6{1>kHn8eU%ygHe^hddZvtvPO2XvzZ0N~?4J#70 z#26aP>@RV&rl^ArJeQu7IUOIJ6Y!;(JL2WrA4Vf?QT@+U3;Oy)(0P8U*WkNqYKLNZvYbA5iu%#@}cF5 z#nyPZk#DW{ZzO6B{of?Msjg-t8C8#ZbIX&7j)ML~2z0LN(@lWmul;kL9~Gl`Ci}j=zTUn*y89LaD*>o%OY?lI``R7D$jT^ucBjNU| z6Nm(a*EX>3kJWAq6oHBA4~oqafQzgHBflnV{)3jRt%Go?@MgvaENug~5U`_7lCi;L zpQ9-fa@?X9=|<7GkX(yyE}Fm`f)2{%`}@IXQDG$jtX)Xa(%FFvVmpjRp2fNX%aYqCa8Iupe#-pR;YP3gpS!BK z2OR?%W0e0^Cg%8H9w@uk$@*Qeq#J+smWoT(fuI#|VpaLMed3~EBh5@h~g zV|3!Ch#}6afUko?VGA@d@Mq8G05%godajL?E|XaJuH%Nv?59IFz>-!t3~uDgALda# zmF9k+n8M!sDURB6WeCSZH3s-IH1Kb6%WaNx(Xo)s7xv+&wB--o20vK?KDWkud$Iob za1Ck9crs$Qz+$1%XK=cik9V7{i;Fu9+<9jT1VmIJu;~G=pQg2m(R1YPNY()ex}?@y zWwAo+*U=4H0RXETtBXHxTt+)VA#1}G&R>HrwWa{wYBP@*!>O6P1*i|jKpwK56Z?pW zsW%s7XJ?1sq%>rgwwS6(9S;;d3I78xsxxRV7f|}F4VB#%s{}I5#dnff9=bVfaKQ@~ zJ3%vhG!v_xsNiShMue3(vU{!RI8?d-=HE(KEGRzl0w#g(bm}dzRQgj=_x@|JfP?j> zAj98*FbdA9SQoI$?Od;2T?I`)wRtg0-m~MhhTG^w;-ch_B(96KIaUQ49gO*`MF3s` z>>-e&9I21ZTU)L3-)Eh~JhF1@J~Xm|1BesJ(+)B_>~r`R!=R=Z2NucJr@%s&c?TSN z6|%h4I9SQ$Cs6;Dvi|N5%p-T8HvJku>E-9 zMAsR@u@gXsZZw$$k}|?3s8{PpmhpxD8)$X;9fL63$?n7o+qNG7iS!{(`qVE;uPl2V zom3CUUCyxD=I>^CCb!k800J0T2f{IlT!%6^=Yai(Hp;3iSsKauo!8LQ+Or#IhIg-e zODfBBq5fd2LU$2Ok$_P4d}!|$G(>-rEMBQ=H%G}+g!6iL@z=aaSPMuwak2LWrf z@e^Nu^fVIeXE>d3ju{kB!t5)6>}Iq1^g!;~9xKdwsFeG%-sv%Y)%Ck+s<>{?4oGi` z_-=c03Hh=w6v$|&nDKu^j{lnl>mLs}*#pAyg-QW;f${ziz-fL4rlh4< JbkFkne*xRF#eo0- literal 0 HcmV?d00001 From 060ede5195554b3ef8071e97f3ff0b985b8b67b1 Mon Sep 17 00:00:00 2001 From: oparoz Date: Mon, 5 Sep 2016 16:33:07 +0200 Subject: [PATCH 2/3] Add copy-pastable regexp --- admin_manual/configuration_files/files_access_control.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/admin_manual/configuration_files/files_access_control.rst b/admin_manual/configuration_files/files_access_control.rst index 087b84ad9..78a2af135 100644 --- a/admin_manual/configuration_files/files_access_control.rst +++ b/admin_manual/configuration_files/files_access_control.rst @@ -58,7 +58,8 @@ engine will block any attempt to upload the file. The safest way to define the r is to use a regular expression, as it will help you cover all the known media types used for the type of file you're trying to block. -The following example prevents zip files from being uploaded. +The following example prevents zip files from being uploaded by using the regular +expression: ``/^application\/(zip|x-zip-compressed)$/i`` .. figure:: images/files_access_control_block_mimetype.png :alt: Prevent upload based on mimetype From 3a3698ac34ef11d6f0e3ba47c1836dd96d6ac56f Mon Sep 17 00:00:00 2001 From: Morris Jobke Date: Mon, 5 Sep 2016 16:50:04 +0200 Subject: [PATCH 3/3] Fix length of underline --- admin_manual/configuration_files/files_access_control.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/admin_manual/configuration_files/files_access_control.rst b/admin_manual/configuration_files/files_access_control.rst index 78a2af135..884008da7 100644 --- a/admin_manual/configuration_files/files_access_control.rst +++ b/admin_manual/configuration_files/files_access_control.rst @@ -50,7 +50,7 @@ This example blocks access to any folder with the tag ``Confidential``. :alt: Deny access based on collaborative tag Prevent uploading of specific files -------------------------- +----------------------------------- It's possible to prevent specific files from being uploaded to Nextcloud. You simply need to define a rule based on the mimetype and our powerful access control