Hello everyone,
I’m sharing the solution to a problem I ran into, in case it helps someone else. The symptom is very clear: everything works fine, but when you try to upload a file larger than a certain size (e.g., 40 or 50 MB), Nextcloud shows the frustrating message: Operation is blocked by access control.
After a lot of digging, I discovered that the problem is not in the Nextcloud or PHP configuration, but in a web server security layer called ModSecurity.
The Simple Explanation (The Cause of the Problem)
To make it easy to understand, imagine your server has two “security guards” at the gate where your uploaded files pass through:
- Guard 1 (The Web Server - Nginx): You’ve already told this guard in his configuration to allow very large “packages” (files), for example, up to 10 GB.
- Guard 2 (The Security Inspector - ModSecurity): This is a stricter guard who inspects everything that passes. The problem is that he has his own rulebook and wasn’t told about the new limit. His rulebook still says that nothing over 12 MB can pass.
So, when you try to upload your 40 MB file, the first guard (Nginx) lets it through, but the second guard (ModSecurity) sees it, checks his rulebook, sees it’s too big, and blocks it.
The message you see in Nextcloud, “Operation is blocked by access control,” is just the platform’s way of saying, “Hey, the security inspector didn’t let this file through!”
How to Fix It Step-by-Step
The solution is to simply update the rulebook of the “strict guard” (ModSecurity) so it will allow large files to pass.
Step 1: Open the ModSecurity configuration file
You need to edit the main ModSecurity file. Open a terminal on your server and run the following command:
Bashsudo nano /etc/nginx/modsecurity.conf
(If you don’t use nano, you can use vim or your preferred text editor).
Step 2: Find the size limit rule
Inside this file, look for the following line. It’s usually in the “Request body handling” section.
Ini, TOMLSecRequestBodyLimit 13107200
That number, 13107200, is the size limit in bytes, which is about 12.5 MB. There’s our problem!
Step 3: Increase the limit
Now, simply replace that number with a much larger one. If you allowed up to 10 GB in your Nginx configuration, we can use that same value here. The number in bytes for 10 GB is 10737418240.
The line should now look like this:
Ini, TOMLSecRequestBodyLimit 10737418240
Step 4: Save the changes
Save the file and exit the editor. (In the nano editor, you do this by pressing Ctrl + O, then Enter to confirm, and finally Ctrl + X to exit).
Step 5: Restart the web server (Nginx)
The final step is to tell Nginx to reload its rules, including the one we just changed in ModSecurity.
Bashsudo systemctl restart nginx
And that’s it! With this change, the ModSecurity “guard” will now have the same permission as Nginx, and your large files should upload to Nextcloud without any issues.
I hope this guide helps anyone who runs into this frustrating error.
Cheers!