From c9f01c37c15d84509e565dc13a1fc58c3ac82406 Mon Sep 17 00:00:00 2001 From: Josh Date: Sat, 9 May 2026 10:47:40 -0400 Subject: [PATCH] fix(coolwsd): listen on loopback only --- proxy.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/proxy.php b/proxy.php index a54da56..1eb5b89 100644 --- a/proxy.php +++ b/proxy.php @@ -86,6 +86,8 @@ function startCoolwsd() $remoteFontConfig = "--o:remote_font_config.url=" . $remoteFontConfigUrl; } + $loopback = "--o:net.listen=loopback"; + // Check if IPv6 has been disabled $IPv4only = ""; $launchCmd = "ip -6 addr"; @@ -102,7 +104,7 @@ function startCoolwsd() // when lok_allow does not contain the Nextcloud host, it is not possible to insert image from Nextcloud // we have to set explicitly, because storage.wopi.alias_groups[@mode] is 'first' in case of richdocumentscode $lok_allow = "--o:net.lok_allow.host[14]=" . escapeshellarg($_SERVER['HTTP_HOST']); - $launchCmd = "bash -c \"( $appImage $remoteFontConfig $IPv4only $lok_allow --pidfile=$pidfile || $appImage --appimage-extract-and-run $remoteFontConfig $IPv4only $lok_allow --pidfile=$pidfile) >/dev/null & disown\""; + $launchCmd = "bash -c \"( $appImage $remoteFontConfig $IPv4only $loopback $lok_allow --pidfile=$pidfile || $appImage --appimage-extract-and-run $remoteFontConfig $IPv4only $loopback $lok_allow --pidfile=$pidfile) >/dev/null & disown\""; // Remove stale lock file (just in case) if (file_exists("$lockfile"))