Core: Can we PLEASE have the option to turn off 'Trusted Domain' setting, or at least add wild card?

[ghost]

Original thread here: https://forum.owncloud.org/viewtopic.php?p=105909#p105909

C'mon guys you have been asked this question MANY times now, and have gotten many threads and posts about issues that it is causing. Please give us the option to disable the 'trusted domain' feature or allow us to add wildcards.

I know it's a good security feature but users should still get administrative rights and the right to put their foot down and have the final say on whether or not they want a feature added or not. There is other software, plugins and methods to prevent access to Owncloud via only 'trusted domains'.

Please for the love of god, give users the ability to disable the feature without breaking the entire setup, or allow us to add wildcards into the domain listing to allow for dynamic domain hosts.

[LukasReschke]

Please for the love of god, give users the ability to disable the feature without breaking the entire setup, or allow us to add wildcards into the domain listing to allow for dynamic domain hosts.

Well. Pull request welcome as somebody in the forum has already stated. https://github.com/owncloud/core/pull/12979 would just require fixing the unit tests :wink:

[nickvergessen]

Sometimes we use trusted_domain to generate links (federated share e.g., iirc). I think we need a method then which returns the first non-wildcard domain?

[jnweiger]

From within our community VM, all interfaces and vhosts are under our control as the entire VM is ours.
A TrustedDomains feature is not needed there. I am constantly looking for workarounds, while the feature evolves and becomes more secure -- putting me in a situation fighting against security. That is bad.

From within a VM, we cannot discern our domain name a-priori if e.g. the hypervisor puts us in NAT mode. We need a

• wildcard,
• a switch to disable the check, or maybe
• a way to accept and store $_SERVER['HTTP_HOST'] coming back from the Browser.

Currently the [Add Trusted Domains Button] in the web interface is unreliable. There is some explanation about how this unreliability is part of the design:
https://github.com/owncloud/enterprise/issues/852#issuecomment-148349476

[jnweiger]

@Cursewords please check out the following workaround:
wget https://raw.githubusercontent.com/owncloud/vm/master/vagrant/oc9ce/wildcard-trusted-domains.config.php
and add this file to your config folder.

It is not a real wildcard, but effectively disables the trusted domain check by feeding the current $_SERVER['HTTP_HOST'] into the Config.

[jnweiger]

Closing this inactive issue. The offered workaround appears acceptable in many cases.

Please open a follow up issue if link generation still depends on trusted domains settings. There should not be such a dependency.

[linuxaos]

Cursewords: Dude I feel your pain! WTF owncloud??? I may want the security feature but dammit give me the option to disable it. Why, why , why do I have to search Google for an hour before I get here? Come on already !
Cursewords, you have the patience of a God. Also, your comment was exactly what I was feeling. Thank you my brother !

[ha11oga11o]

Cursewords: Dude I feel your pain! WTF owncloud??? I may want the security feature but dammit give me the option to disable it. Why, why , why do I have to search Google for an hour before I get here? Come on already !
Cursewords, you have the patience of a God. Also, your comment was exactly what I was feeling. Thank you my brother !

After all this years,... frustration and everything im upvoting this because im full of it! (trying to stay polite here)

Cheers!

[bastiOo]

yeah, frustrating when you realize you cannot print the one important document in your local copyshop. ... seems like the private cloud users have to look around for alternatives soon.