fix(logger): Prevent infinite recursion with log.condition => matchesbackport/50026/stable29

When we need to check the log condition for a user matches,
there is a risk that something on the way checks the log level
and would result in an infinite loop.
So we simply check if it's a nested call and use the default
warning level in that case.

Signed-off-by: Joas Schilling <coding@schilljs.com>

2 files changed, 49 insertions, 0 deletions

diff --git a/build/integration/features/log-condition.feature b/build/integration/features/log-condition.feature
new file mode 100644
index 00000000000..4059db1ebf3
--- /dev/null
+++ b/build/integration/features/log-condition.feature
@@ -0,0 +1,39 @@
+# SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+Feature: log-condition
+
+  Background:
+    Given invoking occ with "config:system:set log.condition matches 0 users 0 --value admin"
+    Then the command was successful
+
+  Scenario: Accessing /status.php with log.condition
+    When requesting "/status.php" with "GET"
+    Then the HTTP status code should be "200"
+
+  Scenario: Accessing /index.php with log.condition
+    When requesting "/index.php" with "GET"
+    Then the HTTP status code should be "200"
+
+  Scenario: Accessing /remote.php/webdav with log.condition
+    When requesting "/remote.php/webdav" with "GET"
+    Then the HTTP status code should be "401"
+
+  Scenario: Accessing /remote.php/dav with log.condition
+    When requesting "/remote.php/dav" with "GET"
+    Then the HTTP status code should be "401"
+
+  Scenario: Accessing /ocs/v1.php with log.condition
+    When requesting "/ocs/v1.php" with "GET"
+    Then the HTTP status code should be "200"
+
+  Scenario: Accessing /ocs/v2.php with log.condition
+    When requesting "/ocs/v2.php" with "GET"
+    Then the HTTP status code should be "404"
+
+  Scenario: Accessing /public.php/webdav with log.condition
+    When requesting "/public.php/webdav" with "GET"
+    Then the HTTP status code should be "401"
+
+  Scenario: Accessing /public.php/dav with log.condition
+    When requesting "/public.php/dav" with "GET"
+    Then the HTTP status code should be "503"
diff --git a/lib/private/Log.php b/lib/private/Log.php
index b8f6d268930..3787df6b018 100644
--- a/lib/private/Log.php
+++ b/lib/private/Log.php
@@ -64,6 +64,7 @@ use function strtr;
 class Log implements ILogger, IDataLogger {
 	private ?bool $logConditionSatisfied = null;
 	private ?IEventDispatcher $eventDispatcher = null;
+	private int $nestingLevel = 0;
 
 	public function __construct(
 		private IWriter $logger,
@@ -223,6 +224,11 @@ class Log implements ILogger, IDataLogger {
 	}
 
 	public function getLogLevel($context): int {
+		if ($this->nestingLevel > 1) {
+			return ILogger::WARN;
+		}
+
+		$this->nestingLevel++;
 		$logCondition = $this->config->getValue('log.condition', []);
 
 		/**
@@ -268,6 +274,7 @@ class Log implements ILogger, IDataLogger {
 
 		// if log condition is satisfied change the required log level to DEBUG
 		if ($this->logConditionSatisfied) {
+			$this->nestingLevel--;
 			return ILogger::DEBUG;
 		}
 
@@ -277,17 +284,20 @@ class Log implements ILogger, IDataLogger {
 			 * once this is met -> change the required log level to debug
 			 */
 			if (in_array($context['app'], $logCondition['apps'] ?? [], true)) {
+				$this->nestingLevel--;
 				return ILogger::DEBUG;
 			}
 		}
 
 		$configLogLevel = $this->config->getValue('loglevel', ILogger::WARN);
 		if (is_numeric($configLogLevel)) {
+			$this->nestingLevel--;
 			return min((int)$configLogLevel, ILogger::FATAL);
 		}
 
 		// Invalid configuration, warn the user and fall back to default level of WARN
 		error_log('Nextcloud configuration: "loglevel" is not a valid integer');
+		$this->nestingLevel--;
 		return ILogger::WARN;
 	}