Update 2.1.0 on 27.1.6 makes all office files unusable...

[Dennis1993]

Describe the bug
I'm using NextCloud 27.1.6 and in the app store an update for this app was offered. After the update I can't open a document. All files are shown this error:

To Reproduce
Steps to reproduce the behavior:

1. Update the App to the latest version
2. Open an office file (xlsx, docx...)
3. Nothing is working anymore

Expected behavior
Opens the document to edit it

Screenshots

Client details:

• OS: Windows 10
• Browser: Microsoft Edge
• Version: 121.0.2277.112

Server details

Operating system:
Ubuntu 20.04

Web server:
Apache 2.4.58

Database:
MariaDB 10

PHP version:
PHP 8.2

Nextcloud version:
27.1.6

Version of the officeonline app
2.1.0

Version of Office Online server
latest

Logs

Nextcloud log (data/nextcloud.log)

{"reqId":"2cp28s7Nyin0S1XzLGLM","level":3,"time":"2024-02-16T14:02:42+00:00","remoteAddr":"XX.XX.XX.XX","user":"--","app":"PHP","method":"GET","url":"/index.php/apps/officeonline/public?shareToken=kjddET7BcZn2Lds&fileName=test.docx","message":"Undefined array key \"urlsrc\" at /var/www/html/apps/officeonline/templates/documents.php#6","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0","version":"27.1.6.2","data":{"app":"PHP"},"id":"65cfc4ewb7614"}

{"reqId":"2cp28s7Nyin0S1XzLGLM","level":3,"time":"2024-02-16T14:02:42+00:00","remoteAddr":"XX.XX.XX.XX","user":"--","app":"PHP","method":"GET","url":"/index.php/apps/officeonline/public?shareToken=kjddET7BcZn2Lds&fileName=test.docx","message":"Undefined array key \"token\" at /var/www/html/apps/officeonline/templates/documents.php#5","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0","version":"27.1.6.2","data":{"app":"PHP"},"id":"65cfc4ewb7614"}

Browser log

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' blob:". Either the 'unsafe-inline' keyword, a hash ('sha256-PB66qjjzQ+aHxDwre34rw49qQh7Nms3AfvueD2Z2Y='), or a nonce ('nonce-...') is required to enable inline execution.

Proxying an event bus of version 3.1.0 with 1.1.4

POST /index.php/apps/officeonline/undefinedWOPISrc=https%3A%2F%2Fcloud.mydomain.de%2Findex.php%2Fapps%2Fofficeonline%2Fwopi%2Ffiles%2Fundefined&title=undefined&lang=de&closebutton=1&revisionhistory=1 404 (Not Found)

[irfancyp]

Same here

[truetonepb]

Same here! App is broken after the update 🙉

[juliusknorr]

I cannot reproduce that. Could you check your configured office server url and try to save it again to see if that makes a difference?

[irfancyp]

I already tried that. Even removed the app and reinstalled it

…

On Mon, Feb 19, 2024, 13:20 Julius Härtl ***@***.***> wrote: I cannot reproduce that. Could you check your configured office server url and try to save it again to see if that makes a difference? — Reply to this email directly, view it on GitHub <#521 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A4IOFPTHNNIN4OZ6ZVDKLLTYUMYQNAVCNFSM6AAAAABDMTUE32VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNJSGIZTQNJRHA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[Dennis1993]

Same problem. The config has a green check and says all is ok.
But if I try to open a file the 404 is there.
I downgraded the app and now it is working. After updating again the error appears again.

in the browser log I see the undefined again:
POST /index.php/apps/officeonline/undefinedWOPISrc=https%3A%2F%

[Phaere]

Same problem here
Docs cannot be opened if shared by public link
Docs shared to user internally opens with no problem

Downgrade to 2.0.3 resolved issue for us

[irfancyp]

Our system is PHP Version: 8.1.23 Memory limit: 1 GB Max execution time: 3600 Upload max size: 10 GB Extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, json, Reflection, SPL, session, standard, sodium, cgi-fcgi, mysqlnd, PDO, xml, apcu, bcmath, bz2, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, gettext, gmp, iconv, igbinary, imagick, intl, ldap, exif, mysqli, pdo_mysql, Phar, posix, readline, redis, shmop, SimpleXML, smbclient, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, xmlreader, xmlwriter, xsl, zip, libsmbclient, Zend OPcache Database Type: mysql Version: 10.11.1 Size: 3 GB Operating System: Linux 5.15.0-94-generic x86_64 may be this helps you to replicate problem and here ih. config.php <?php $CONFIG = array ( 'passwordsalt' => 'XXX', 'secret' => 'XXX', 'trusted_domains' => array ( 0 => 'XXX', 1 => 'XXX', ), 'datadirectory' => '/home/data', 'dbtype' => 'mysql', 'version' => '27.1.6.2', 'overwrite.cli.url' => 'https://XXX', 'dbname' => 'XXX', 'dbhost' => 'localhost', 'dbport' => '', 'dbtableprefix' => 'oc_', 'mysql.utf8mb4' => true, 'dbuser' => 'XXX', 'dbpassword' => 'XXX', 'installed' => true, 'instanceid' => 'XXX', 'activity_expire_days' => 14, 'auth.bruteforce.protection.enabled' => true, 'blacklisted_files' => array ( 0 => '.htaccess', 1 => 'Thumbs.db', 2 => 'thumbs.db', ), 'cron_log' => true, 'default_phone_region' => 'TR', 'enable_previews' => true, 'enabledPreviewProviders' => array ( 0 => 'OC\\Preview\\PNG', 1 => 'OC\\Preview\\JPEG', 2 => 'OC\\Preview\\GIF', 3 => 'OC\\Preview\\BMP', 4 => 'OC\\Preview\\XBitmap', 5 => 'OC\\Preview\\Movie', 6 => 'OC\\Preview\\PDF', 7 => 'OC\\Preview\\MP3', 8 => 'OC\\Preview\\TXT', 9 => 'OC\\Preview\\MarkDown', 10 => 'OC\\Preview\\Image', 11 => 'OC\\Preview\\HEIC', 12 => 'OC\\Preview\\TIFF', ), 'filesystem_check_changes' => 1, 'filelocking.enabled' => 'true', 'htaccess.RewriteBase' => '/', 'integrity.check.disabled' => false, 'knowledgebaseenabled' => false, 'log_rotate_size' => 104857600, 'logfile' => '/var/log/nextcloud/nextcloud.log', 'loglevel' => 2, 'logtimezone' => 'Europe/Helsinki', 'memcache.local' => '\\OC\\Memcache\\APCu', 'memcache.locking' => '\\OC\\Memcache\\Redis', 'overwriteprotocol' => 'https', 'preview_max_x' => 1024, 'preview_max_y' => 768, 'preview_max_scale_factor' => 1, 'redis' => array ( 'host' => '/var/run/redis/redis-server.sock', 'port' => 0, 'timeout' => 0.0, ), 'quota_include_external_storage' => false, 'share_folder' => '/Releases', 'skeletondirectory' => '', 'trashbin_retention_obligation' => 'auto, 7', 'mail_from_address' => 'dr', 'mail_smtpdebug' => false, 'mail_smtpmode' => 'smtp', 'mail_sendmailmode' => 'smtp', 'mail_domain' => 'XXX', 'mail_smtphost' => 'XXX', 'mail_smtpport' => 'XXX', 'maintenance' => false, 'theme' => '', 'updater.release.channel' => 'stable', 'app_install_overwrite' => array ( 0 => 'scanner', 1 => 'impersonate', 6 => 'cms_pico', 7 => 'files_downloadactivity', ), 'mail_smtpauth' => 1, 'mail_smtpname' => 'XXX', 'mail_smtppassword' => 'XXX', 'ldapProviderFactory' => 'OCA\\User_LDAP\\LDAPProviderFactory', 'memories.exiftool' => '/var/www/nextcloud/apps/memories/bin-ext/exiftool-amd64-glibc', 'memories.vod.path' => '/var/www/nextcloud/apps/memories/bin-ext/go-vod-amd64', 'memories.vod.ffmpeg' => '/usr/bin/ffmpeg', 'memories.vod.ffprobe' => '/usr/bin/ffprobe', 'memories.gis_type' => 1, ); 2 => 'files_archive', 3 => 'transfer', 4 => 'files_fulltextsearch', 5 => 'talk_matterbridge',

…

On Mon, Feb 19, 2024 at 1:53 PM Phaere ***@***.***> wrote: Same problem here Docs cannot be opened if shared by public link Docs shared to user internally opens with no problem Downgrade to 2.0.3 resolved issue for us — Reply to this email directly, view it on GitHub <#521 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A4IOFPS44C4YR5VW2UEGQBTYUM4M7AVCNFSM6AAAAABDMTUE32VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNJSGI4TCNRWHE> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[numenos]

Same problem, but only in edge.
In firefox & chrome works great.

In edge i see this in "inspect" - "console" tab:
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' blob:". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.

[kvmalakhov]

Some problem with Edge,Opera
Please fix it faster!

[Dennis1993]

You can downgrade to the old version.
Uninstall and delete the app (via web interface) and manually put the old version in the apps folder. Then simply activate it via the web interface. In my 27.1.6 it’s working with this trick. Now I wait for an update.

Are you also using v27.1.6? :)

[muhyal]

It seems that the issue persists in Nextcloud version 28.0.2, and you are unable to downgrade the version of the 'officeonline' app. The problem specifically occurs with external public shares, while internal links & shares are functioning correctly.

[Orchal]

Hi,

It seems that commenting line 384 in lib/Controller/DocumentController.php, which is allowInlineScripts(true) (all by memory, sorry) concerning the "public" function removes the error. The method does not exists anymore. I did not need to comment the other similar lines but this one "helps" for the public issue.

[muhyal]

Hi,

It seems that commenting line 384 in lib/Controller/DocumentController.php, which is allowInlineScripts(true) (all by memory, sorry) concerning the "public" function removes the error. The method does not exists anymore. I did not need to comment the other similar lines but this one "helps" for the public issue.

Thank you for your support. I completely removed this part on line 384 and the problem with public links was solved 👏

$policy->allowInlineScript(true);