Nextclout 28.0.2 Removes "Rescan" option when integrity.check.disabled' => true

Support intro

Sorry to hear you’re facing problems :slightly_frowning_face:

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud: 28.0.2
Archlinux: 6.7.2-arch1-2
Apache: 2.4.58 (Unix)
OpenSSL: 3.2.0
PHP: 8.1.27

The issue you are facing:

On every update, the .htaccess file is flagged as not passing the security check due to adding the server directory /nextcloud to the RewriteRule for caldav and cardav. This was flagged in Administrative Settings → Overview page. To update the files and resolve the issue you use:

  1. Edit /etc/webapps/nexcloud/config/config.php and add “'integrity.check.disabled' => true,
  2. invoke the “Overview” check again, let it fail
  3. choose the “Rescan” link that will rescan the files updating the integrity hash for the .htaccess
  4. log out/in and remove the “'integrity.check.disabled' => true,” addition to config.php.

However, after updating to 28.0.2 and setting 'integrity.check.disabled' => true, in config.php, the Administrator Settings → Overview scan does NOT offer “Rescan” as an option. This prevents using this procedure to handle the .htaccess changes and rescan for a new hash.

(of course you can always save the rescan link before disabling the integrity check and run it manually even though the link isn’t’ displayed)

Is this the first time you’ve seen this error? (Y/N): Yes, the Rescan link was present when the integrity check was disabled in Nextcloud 28.0.1.

Steps to replicate it:

  1. Modify .htaccess
  2. Upgrade Nextcloud from 28.0.1 to 28.0.2
  3. Go to Administrator Settings (the Overview check will run automatically)
  4. Receive the error that some files have not passed the integrity check (verify it is .htaccess)
  5. Add 'integrity.check.disabled' => true, to config.php
  6. Rerun the Overview check
  7. The Rescan option/link is not displayed.

The output of your Nextcloud log in Admin > Logging:

Nothing but the same old module apcu already loaded that has been there since Nextcloud 25 due to some buried setting on one of the myriad config files.

{"reqId":"ewRNDy8Bxb8HyrKUSeMO","level":3,"time":"2024-02-02T02:56:24+00:00","remoteAddr":"192.168.6.104","user":"david","app":"PHP","method":"GET","url":"/nextcloud/ocs/v2.php/search/providers?from=%2Fnextcloud%2Fsettings%2Fadmin%2Flogging","message":"Module \"apcu\" is already loaded at Unknown#0","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0","version":"28.0.2.5","data":{"app":"PHP"},"id":"65bc59e2d7a78"}

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

{
    "system": {
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "default_locale": "en_US",
        "default_phone_region": "US",
        "knowledgebaseenabled": true,
        "apps_paths": [
            {
                "path": "\/usr\/share\/webapps\/nextcloud\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/lib\/nextcloud\/apps",
                "url": "\/wapps",
                "writable": true
            }
        ],
        "trusted_domains": [
            "localhost",
            "***REMOVED SENSITIVE VALUE***",
            "192.168.6.111"
        ],
        "overwrite.cli.url": "https:\/\/2pi.3111skyline.com\/nextcloud",
        "htaccess.RewriteBase": "\/nextcloud",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "28.0.2.5",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "maintenance": false,
        "maintenance_window_start": 6,
        "app_install_overwrite": [
            "issuetemplate",
            "holiday_calendars"
        ],
        "theme": "",
        "loglevel": 2,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "filelocking.enabled": true,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0
        }
    }
}

The output of your Apache/nginx/system log in /var/log/____:

No errors, just the restart on Jan 31 with reboot for kernel update. The entire 28.0.1 → 28.0.2 update did not produce a single apache error.

[Wed Jan 31 22:24:27.694060 2024] [mpm_prefork:notice] [pid 419] AH00163: Apache/2.4.58 (Unix) OpenSSL/3.2.0 PHP/8.1.27 configured -- resuming normal operations
[Wed Jan 31 22:24:27.695225 2024] [core:notice] [pid 419] AH00094: Command line: '/usr/bin/httpd -D FOREGROUND'

Output errors in nextcloud.log in /var/www/ or as admin user in top right menu, filtering for errors. Use a pastebin service if necessary.

Nothing but the same annoying apcu already loaded warning:

{"reqId":"foFTgd9ZLOIiddAakb2P","level":3,"time":"2024-02-02T02:36:11+00:00","remoteAddr":"192.168.6.104","user":"david","app":"PHP","method":"PROPFIND","url":"/nextcloud/remote.php/dav","message":"Module \"apcu\" is already loaded at Unknown#0","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0","version":"28.0.2.5","data":{"app":"PHP"}}
{"reqId":"1pKIW8Rp6sMWNl55E5JQ","level":3,"time":"2024-02-02T02:37:34+00:00","remoteAddr":"192.168.6.104","user":"david","app":"PHP","method":"GET","url":"/nextcloud/index.php/apps/files/preview-service-worker.js","message":"Module \"apcu\" is already loaded at Unknown#0","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0","version":"28.0.2.5","data":{"app":"PHP"}}
{"reqId":"KMKeKIKAPpgIDceCrcSW","level":3,"time":"2024-02-02T02:37:44+00:00","remoteAddr":"192.168.6.104","user":"david","app":"PHP","method":"GET","url":"/nextcloud/apps/theming/theme/dark-highcontrast.css?plain=0&v=c973a648","message":"Module \"apcu\" is already loaded at Unknown#0","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0","version":"28.0.2.5","data":{"app":"PHP"}}
{"reqId":"02GUNbSR8TJfDQERkTlx","level":3,"time":"2024-02-02T02:37:46+00:00","remoteAddr":"192.168.6.104","user":"david","app":"PHP","method":"PROPFIND","url":"/nextcloud/remote.php/dav","message":"Module \"apcu\" is already loaded at Unknown#0","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0","version":"28.0.2.5","data":{"app":"PHP"}}
{"reqId":"ewRNDy8Bxb8HyrKUSeMO","level":3,"time":"2024-02-02T02:56:24+00:00","remoteAddr":"192.168.6.104","user":"david","app":"PHP","method":"GET","url":"/nextcloud/ocs/v2.php/search/providers?from=%2Fnextcloud%2Fsettings%2Fadmin%2Flogging","message":"Module \"apcu\" is already loaded at Unknown#0","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0","version":"28.0.2.5","data":{"app":"PHP"}}

On every update, the .htaccess file is flagged as not passing the security check due to adding the server directory /nextcloud to the RewriteRule for caldav and cardav

If you’re running Nextcloud in a subdirectory then those rules don’t go in the Nextcloud .htaccess, but in the root of your web server.

Given your config, as long as you ran occ maintenance:update:htaccess after you set your htaccess.RewriteBase value above you should not need to be manually modifying your Nextcloud .htaccess at all.

Well, that is good to know. The changes were originally added back during the Nextcloud 25 install according to the Archlinux wiki as well as the Nextcloud docs if I recall correctly. If I can remove the modifications from the Nextcloud .htaccess that will make life much easier.

Do you know where the Rescan option went when the integrity check is disabled. I looked through the 28.0.2 change log and did not find a title having anything to do with the Admin Overview page. Did I miss something?