Nextcloud upgrade to 17.0.0 from 16.0.5
Note the problems that having headers configured in both .htaccess and the apache conf files: https://help.nextcloud.com/t/nextcloud-17-false-warnings/61024
9/29/2019: Found that I now could enable the 5 apps that had been disabled during the install.
The new collaborative Text editor does not handle markdown satisfactorily, or LaTeX at all. So after getting frustrated with it*, I tried this: copied the 16.0.5 apps/files_texteditor folder over to the v17 apps folder (it was not available from the v17 apps menu); logged in as admin and disabled the new Text editor app, then enabled the 16.0.5 files_texteditor app. Now both LaTeX and markdown editing with the split screen works as it did in 16.0.5 (reminder: you get the split editor only from the Files menu, not Notes; in Notes, you can only click ... menu to do a Preview, and LaTeX does not render in that Preview).
Note: I'll need to follow files_texteditor on github in case it gets an upgrade, in case Nextcloud doesn't show an update as available, since it isn't in the v17 apps catalog.
* New rich text editor problems: though bold and italic syntax works, displaying a link with []() does not work; you have to use the link icon and you cannot customize the text display for the link as you can with markdown syntax. I then tried copying over the 16.0.5 files_markdown editor to v17 but it did not work with the new Text editor, no split screen and LaTeX didn't work in preview or on shared web pages (though it did render in the files Details screen – strange!).
9/28/2019: Version 17.0.0 is now available, so did a manual upgrade: see nextcloud admin doc: upgrade.html
sudo systemctl stop apache2
sudo mv nextcloud nextcloud-05
sudo cp -rP nextcloud-05/config /var/www/html/config
sudo cp -rP nextcloud-05/data /var/www/html/data
wget https://download.nextcloud.com/server/releases/nextcloud-16.0.5.zip
Downloaded the md5 check file and confirmed md5sum matched it
sudo unzip nextcloud-17.0.0.zip nextcloud
sudo chown -R www-data nextcloud
sudo cp -rP config/config.php nextcloud/config
Verified that config/config.php and data directory have www-data ownership (apache web server).
sudo systemctl start apache2
In browser, login to nextcloud as admin. Got message that Nextcloud apps will be updated to 17.0.0, giving the list of apps. After this update, message that the following apps are disabled as incompatible: apporder, bruteforcesettings, carnet, files_markdown, files_texteditor, notes. These are all the custom apps I installed in v16. Bummer! I liked the files_markdown editor much better than the new 17.0 text editor.
In admin panel got these Warnings (note that v16.0.5 was configured such that these warnings no longer appeared):
The "X-Content-Type-Options" HTTP header is not set to "nosniff".
The "X-Robots-Tag" HTTP header is not set to "none".
The "X-Frame-Options" HTTP header is not set to "SAMEORIGIN".
The "X-Permitted-Cross-Domain-Policies" HTTP header is not set to "none".
The "Referrer-Policy" HTTP header is not set to "no-referrer", "no-referrer-when-downgrade", "strict-origin", "strict-origin-when-cross-origin" or "same-origin".
A diff of the 17.0 version of nextcloud/.htaccess vs 16.0.5 found that 17.0 used always in the header statements where 16.0.5 omitted it. So revised nextcloud/.htaccess as follows and that worked – the warnings went away:
<IfModule mod_env.c>
# Add security and privacy related headers
#Header always set Referrer-Policy "no-referrer"
#Header always set X-Content-Type-Options "nosniff"
#Header always set X-Download-Options "noopen"
#Header always set X-Frame-Options "SAMEORIGIN"
#Header always set X-Permitted-Cross-Domain-Policies "none"
#Header always set X-Robots-Tag "none"
#Header always set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"
Header set X-Robots-Tag "none"
Header set X-Download-Options "noopen"
Header set X-Permitted-Cross-Domain-Policies "none"
Header set Referrer-Policy "no-referrer"
Header set X-Frame-Options "SAMEORIGIN"
SetEnv modHeadersAvailable true
</IfModule>