Hide Version from https://domain.com//owncloud/status.php

jmdeking · December 4, 2017, 11:35am

Hi there,

My company did an security audit and they manage to get the following informatie including version number from URL https://domain.com//owncloud/status.php

{"installed":true,"maintenance":false,"version":"9.1.6.2","versionstring":"9.1.6","edition":""}

How can i hide this information?

domenek · December 4, 2017, 5:27pm

It's required for the sync client. It's a feature and if you keep your system up to date doesn't really mean anything.

guruz · December 5, 2017, 8:26am

github.com

owncloud/core/blob/master/config/config.sample.php#L83


*/
'datadirectory' => '/var/www/owncloud/data',


/**
* The current version number of your ownCloud installation. This is set up
* during installation and update, so you shouldn't need to change it.
*/
'version' => '',


/**
* While hardening an ownCloud instance hiding the version information in status.php
* can be a legitimate step. Please consult the documentation before enabling this.
*/
'version.hide' => false,


/**
* Optionally, show the hostname of the server in status.php. Defaults to hidden
*/
'show_server_hostname' => false,


/**

jmdeking · December 5, 2017, 9:10am

Thanks and i looked in the documentation and couldn't find anything saying about version and what impact it will have in changing.