From 754adeac1df3736ff572ef9332740a31477a78ab Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 5 Jan 2021 22:35:24 +0100
Subject: [PATCH 1/2] nixos/nextcloud: recommend to use latest version (v20)

As suggested in #108419
---
 nixos/modules/services/web-apps/nextcloud.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 519bb433e098..4940b8ae10e2 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -360,6 +360,10 @@ in {
           nextcloud19. If not, please upgrade to nextcloud18 first since Nextcloud doesn't
           support upgrades that skip multiple versions (i.e. an upgrade from 17 to 19 isn't
           possible, but an upgrade from 18 to 19).
+        '')
+        ++ (optional (versionOlder cfg.package.version "20") ''
+          The latest Nextcloud release is v20 which can be installed by setting
+          `services.nextcloud.package` to `pkgs.nextcloud20`.
         '');
 
       services.nextcloud.package = with pkgs;

From 1b7dd8a7e9ea1cecedb6cb8617262c66d92a708b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 5 Jan 2021 22:31:06 +0100
Subject: [PATCH 2/2] nextcloud: improve documentation on defaults

* It should be made explicit in the eval-error that the CVE only affects
  a component which is turned off by default.
* For more clarity, the default version used by the module is noted in
  the manual.

Closes #108419

(cherry picked from commit 78f022e79133c514c3da3a220713451722284b54)
---
 nixos/modules/services/web-apps/nextcloud.xml | 6 +++++-
 pkgs/servers/nextcloud/default.nix            | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/nextcloud.xml b/nixos/modules/services/web-apps/nextcloud.xml
index 02e4dba28610..a0a55e4a8475 100644
--- a/nixos/modules/services/web-apps/nextcloud.xml
+++ b/nixos/modules/services/web-apps/nextcloud.xml
@@ -10,6 +10,10 @@
   <link linkend="opt-services.nextcloud.enable">services.nextcloud</link>. A
   desktop client is packaged at <literal>pkgs.nextcloud-client</literal>.
  </para>
+ <para>
+  The current default by NixOS is <package>nextcloud19</package> though it's recommended
+  to upgrade to the latest version, <package>nextcloud20</package>.
+ </para>
  <section xml:id="module-services-nextcloud-basic-usage">
   <title>Basic usage</title>
 
@@ -210,7 +214,7 @@
   nextcloud17 = generic {
     version = "17.0.x";
     sha256 = "0000000000000000000000000000000000000000000000000000";
-    insecure = true;
+    eol = true;
   };
 }</programlisting>
   </para>
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 8d4b52a01593..a1c38cdbe28d 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -53,7 +53,7 @@ in {
     version = "19.0.6";
     sha256 = "sha256-pqqIayE0OyTailtd2zeYi+G1APjv/YHqyO8jCpq7KJg=";
     extraVulnerabilities = [
-      "Nextcloud 19 is still supported, but CVE-2020-8259 & CVE-2020-8152 are unfixed!"
+      "Nextcloud 19 is still supported, but CVE-2020-8259 & CVE-2020-8152 are unfixed! Please note that both CVEs only affect the file encryption module which is turned off by default. Alternatively, `pkgs.nextcloud20` can be used."
     ];
   };