search

nextcloud / server

☁️ Nextcloud server, a safe home for all your data
https://nextcloud.com
GNU Affero General Public License v3.0
27.23k stars 4.05k forks source link

Replace Imagick with something better #13099

Closed enoch85 closed 2 years ago

enoch85 commented 5 years ago

EDIT (SEO): The PHP module "imagick" is not enabled although the theming app is. For favicon generation to work correctly, you need to install and enable this module.

A few days ago it was brought up to my attention that using Imagick could have very negative effects on security. The Nextcloud snap decided to not using it due to that fact, and I've now mitigated the same threat(s) as well by not using it in the Nextcloud VM.

Here are the discussion regarding the decision in the Nextcloud snap, and I think it totally makes sense not to use it in the Nextcloud Server as well.

The situation now though is that it's recomended and the setup checks will inform the user that the package is missing. As Nextcloud is advertising it's secure, then why use a package that is prune to a lot of CVEs in the past?

Regarding alternatives I think this post sums it up quite well.

Please consider removing the recommendation in future versions, and please also consider replacing the use of Imagick with something better and more secure.

EDIT 2: We now install Imaginary as a replacement for this in the Nextcloud VM.

tianon commented 3 years ago

My experience with it was in the context of Ghost via "sharp" requiring too new of a libvips (Debian Buster has 8.7 and they required 8.9+) which caused a host of issues for getting it successfully installed, so I'd suggest surveying what version of libvips is available in the expected target environments and ensuring the lowest common denominator meets the needs of the project before committing (but that's just my 2c; no real stake here :innocent:).

enoch85 commented 3 years ago

I still think this is an ongoing discussion though.

Mainly this issue exist due to the security concerns, and whatever replacing Imagick needs to be better OR not produce a warning.

PVince81 commented 3 years ago

also note: some research done with an external preview generator: https://github.com/nextcloud/server/pull/24166 (note: I don't have time right now to continue this, feel free to take over)

adripo commented 2 years ago

While someone will continue developing this feature, what do you think if we proceed by marking the warning as INFO in the Administration Overview as suggested by @kerberizer in nextcloud/docker/1414#issuecomment-945842317?

solracsf commented 2 years ago

Closing as per https://github.com/nextcloud/server/pull/24166

Fuseteam commented 2 years ago

oh man, that's awesome