Sharing content via link broke on NC28

swindhab · December 18, 2023, 9:45am

It works again if you allow “Allow users on this server to send shares to other servers (this option also allows WebDAV access to public shares)” (First option) in Federated-Cloud-Sharing options.

There are already issues in github:

github.com/nextcloud/server

[Bug]: Public share link not working when OutgoingServer2serverShare is disabled

opened 05:06PM - 15 Dec 23 UTC

AsamK

bug 0. Needs triage 28-feedback

### ⚠️ This issue respects the following points: ⚠️ - [X] This is a **bug**, no…t a question or a configuration/webserver/proxy issue. - [X] This issue is **not** already reported on [Github](https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3Abug) OR [Nextcloud Community Forum](https://help.nextcloud.com/) _(I've searched it)_. - [X] Nextcloud Server **is** up to date. See [Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) for supported versions. - [X] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/). ### Bug description Opening a public share link leads to a reload loop, because the `/public.php/webdav/` endpoint returns a status `401`. The issue occurs with a link created with an older NC version and also with a link created in the NC 28. Bug only occurs when OutgoingServer2serverShare is disabled. I've debugged this and it seems the ajax check in [apps/dav/appinfo/v1/publicwebdav.php](https://github.com/nextcloud/server/blob/master/apps/dav/appinfo/v1/publicwebdav.php#L76) isn't working correctly, leading to a NotAuthenticated exception. The headers sent by the browser to `/public.php/webdav/` contain `X-Requested-With: XMLHttpRequest, XMLHttpRequest`, but the ajax check in publicwebdav.php only checks `$_SERVER['HTTP_X_REQUESTED_WITH'] === 'XMLHttpRequest'`. ### Steps to reproduce 1. Create a public share link for a folder 2. Disable OutgoingServer2serverShare option in admin settings 3. Open share link in browser (tested in latest firefox and chromium) -> Continuous reload of the page in the browser ### Expected behavior The shared folder should be shown after opening the link. ### Installation method Community Manual installation with Archive ### Nextcloud Server version 28 ### Operating system Debian/Ubuntu ### PHP engine version PHP 8.2 ### Web server Apache (supported) ### Database engine version MariaDB ### Is this bug present after an update or on a fresh install? Upgraded to a MAJOR version (ex. 22 to 23) ### Are you using the Nextcloud Server Encryption module? Encryption is Disabled ### What user-backends are you using? - [X] Default user-backend _(database)_ - [ ] LDAP/ Active Directory - [ ] SSO - SAML - [ ] Other ### Configuration report ```shell { "system": { "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "***REMOVED SENSITIVE VALUE***" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "28.0.0.11", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "instanceid": "***REMOVED SENSITIVE VALUE***", "theme": "", "loglevel": 2, "maintenance": false, "app_install_overwrite": [ "gallery" ], "mysql.utf8mb4": true, "memcache.local": "\\OC\\Memcache\\APCu", "default_phone_region": "DE", "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_smtpmode": "smtp", "mail_sendmailmode": "smtp", "mail_domain": "***REMOVED SENSITIVE VALUE***", "preview_max_memory": 1024, "preview_max_filesize_image": 100 } ``` ### List of activated Apps ```shell Enabled: - admin_audit: 1.18.0 - circles: 28.0.0-dev - cloud_federation_api: 1.11.0 - dav: 1.29.1 - federatedfilesharing: 1.18.0 - files: 2.0.0 - files_pdfviewer: 2.9.0 - files_reminders: 1.1.0 - files_sharing: 1.20.0 - files_trashbin: 1.18.0 - files_versions: 1.21.0 - lookup_server_connector: 1.16.0 - oauth2: 1.16.3 - photos: 2.4.0 - provisioning_api: 1.18.0 - related_resources: 1.3.0 - settings: 1.10.0 - sharebymail: 1.18.0 - theming: 2.3.0 - twofactor_backupcodes: 1.17.0 - updatenotification: 1.18.0 - viewer: 2.2.0 - workflowengine: 2.10.0 Disabled: - accessibility: 1.10.0 - activity: 2.20.0 (installed 2.6.1) - bruteforcesettings: 2.8.0 - comments: 1.18.0 (installed 1.8.0) - contactsinteraction: 1.9.0 (installed 1.1.0) - dashboard: 7.8.0 (installed 7.0.0) - encryption: 2.16.0 - federation: 1.18.0 (installed 1.3.0) - files_external: 1.20.0 - files_rightclick: 1.6.0 (installed 1.6.0) - files_videoplayer: 1.13.0 - firstrunwizard: 2.17.0 (installed 2.7.0) - groupfolders: 16.0.1 (installed 16.0.1) - logreader: 2.13.0 (installed 2.0.0) - metadata: 0.19.0 (installed 0.19.0) - nextcloud_announcements: 1.17.0 (installed 1.9.0) - notifications: 2.16.0 (installed 2.1.2) - password_policy: 1.18.0 (installed 1.3.0) - privacy: 1.12.0 (installed 1.4.0) - recommendations: 2.0.0 (installed 0.4.0) - serverinfo: 1.18.0 (installed 1.3.0) - support: 1.11.0 (installed 1.1.0) - survey_client: 1.16.0 (installed 1.1.0) - suspicious_login: 6.0.0 - systemtags: 1.18.0 (installed 1.3.0) - text: 3.9.1 (installed 2.0.0) - twofactor_totp: 10.0.0-beta.2 - user_ldap: 1.19.0 - user_status: 1.8.1 (installed 1.0.0) - weather_status: 1.8.0 (installed 1.0.0) ``` ### Nextcloud Signing status ```shell No errors have been found. ``` ### Nextcloud Logs _No response_ ### Additional info _No response_

github.com/nextcloud/server

[Bug]: public shared links keep refreshing since v28 upgrade

opened 10:02AM - 13 Dec 23 UTC

psy0rz

bug 0. Needs triage 28-feedback

### ⚠️ This issue respects the following points: ⚠️ - [X] This is a **bug**, no…t a question or a configuration/webserver/proxy issue. - [X] This issue is **not** already reported on [Github](https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3Abug) OR [Nextcloud Community Forum](https://help.nextcloud.com/) _(I've searched it)_. - [X] Nextcloud Server **is** up to date. See [Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) for supported versions. - [X] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/). ### Bug description Demo url: https://cloud.datux.nl/s/qokf5AXDKN2S4E8 It keeps refreshing, nothing to see in the logs and nextcloud.log. I'm running the official docker images behind a reverse proxy. (nextcloud:fpm-alpine) ### Steps to reproduce 1. Share public link 2. Try to open it 3. Browser keeps refreshing. ### Expected behavior should show the shared folder in the browser, without a reload loop. ### Installation method Community Docker image ### Nextcloud Server version 28 ### Operating system Other ### PHP engine version PHP 8.2 ### Web server Nginx ### Database engine version MariaDB ### Is this bug present after an update or on a fresh install? Upgraded to a MAJOR version (ex. 22 to 23) ### Are you using the Nextcloud Server Encryption module? None ### What user-backends are you using? - [X] Default user-backend _(database)_ - [ ] LDAP/ Active Directory - [ ] SSO - SAML - [ ] Other ### Configuration report ```shell { "system": { "memcache.local": "\\OC\\Memcache\\APCu", "apps_paths": [ { "path": "\/var\/www\/html\/apps", "url": "\/apps", "writable": false }, { "path": "\/var\/www\/html\/custom_apps", "url": "\/custom_apps", "writable": true } ], "memcache.distributed": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "password": "***REMOVED SENSITIVE VALUE***", "port": 6379 }, "instanceid": "***REMOVED SENSITIVE VALUE***", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "cloud.datux.nl" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "28.0.0.11", "overwrite.cli.url": "https:\/\/cloud.datux.nl", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "mysql.utf8mb4": true, "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_smtpmode": "smtp", "mail_sendmailmode": "smtp", "mail_domain": "***REMOVED SENSITIVE VALUE***", "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "mail_smtpport": "25", "overwriteprotocol": "https", "overwritehost": "cloud.datux.nl", "trusted_proxies": "***REMOVED SENSITIVE VALUE***", "loglevel": 2, "maintenance": false, "theme": "", "app_install_overwrite": [ "epubreader" ] } } ``` ### List of activated Apps ```shell Enabled: - activity: 2.20.0 - bruteforcesettings: 2.8.0 - cloud_federation_api: 1.11.0 - dashboard: 7.8.0 - dav: 1.29.1 - federatedfilesharing: 1.18.0 - files: 2.0.0 - files_external: 1.20.0 - files_pdfviewer: 2.9.0 - files_reminders: 1.1.0 - files_sharing: 1.20.0 - files_trashbin: 1.18.0 - files_versions: 1.21.0 - firstrunwizard: 2.17.0 - logreader: 2.13.0 - lookup_server_connector: 1.16.0 - notes: 4.9.0 - notifications: 2.16.0 - oauth2: 1.16.3 - password_policy: 1.18.0 - photos: 2.4.0 - privacy: 1.12.0 - provisioning_api: 1.18.0 - related_resources: 1.3.0 - settings: 1.10.0 - sharebymail: 1.18.0 - support: 1.11.0 - suspicious_login: 6.0.0 - systemtags: 1.18.0 - text: 3.9.1 - theming: 2.3.0 - twofactor_backupcodes: 1.17.0 - twofactor_totp: 10.0.0-beta.2 - updatenotification: 1.18.0 - user_status: 1.8.1 - viewer: 2.2.0 - workflowengine: 2.10.0 Disabled: - admin_audit: 1.18.0 - circles: 28.0.0-dev (installed 27.0.1) - comments: 1.18.0 (installed 1.17.0) - contactsinteraction: 1.9.0 (installed 1.8.0) - encryption: 2.16.0 - federation: 1.18.0 (installed 1.17.0) - files_rightclick: 0.15.1 (installed 1.6.0) - nextcloud_announcements: 1.17.0 (installed 1.16.0) - recommendations: 2.0.0 (installed 1.6.0) - serverinfo: 1.18.0 (installed 1.17.0) - survey_client: 1.16.0 (installed 1.15.0) - theming_customcss: 1.15.0 (installed 1.15.0) - user_ldap: 1.19.0 - weather_status: 1.8.0 (installed 1.7.0) ``` ### Nextcloud Signing status ```shell No errors have been found. ``` ### Nextcloud Logs ```shell (empty log, only contained old entries) ``` ### Additional info _No response_