[Bug]: WEBUI File uploads fail into "InvalidArgumentException X-OC-MTime header must be a valid positive integer" errors

[Dehydrated0Water]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Good day,
I am trying to upload files via http webgui on android phones via chrome over WLAN with a VPN as well as over internal WLAN, no proxies included. no dns configured for nextcloud, accessing via IP:PORT
Nextcloud runs on Docker with the official v30.0.6 image and docker on v. 20.10.24+dfsg1
Its also a fresh install, freshly configured and tested to work with files via wired connections over LAN and VPN.
WIFI AP is right next to the devices and pings on nextcloud stable. (3-30ms, depending if LAN or VPN and external)

Steps to reproduce

1. open webgui via ip in google chrome app
2. login with any nextcloud account
3. upload a file bigger than 10-20MB (limit is random) from anywhere on the phone, in any network

Expected behavior

Upload proceeds and concludes with the uploaded file(s) showing up in the coresponding location

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

[
    {
        "Id": "59b0e3cf68c1e068da66293e8eb8df895bf0594a86b0da00247623b5f582f3a6",
        "Created": "2025-02-18T17:00:19.48413695Z",
        "Path": "/entrypoint.sh",
        "Args": [
            "apache2-foreground"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 4675,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2025-02-18T17:00:20.320646433Z",
            "FinishedAt": "0001-01-01T00:00:00Z"
        },
        "Image": "sha256:c10492ea7344620490a7552b4f8829ffb8eb49dec13b07c7e31fb232fa534aff",
        "ResolvConfPath": "/mnt/nextcloud-disk/containers/59b0e3cf68c1e068da66293e8eb8df895bf0594a86b0da00247623b5f582f3a6/resolv.conf",
        "HostnamePath": "/mnt/nextcloud-disk/containers/59b0e3cf68c1e068da66293e8eb8df895bf0594a86b0da00247623b5f582f3a6/hostname",
        "HostsPath": "/mnt/nextcloud-disk/containers/59b0e3cf68c1e068da66293e8eb8df895bf0594a86b0da00247623b5f582f3a6/hosts",
        "LogPath": "/mnt/nextcloud-disk/containers/59b0e3cf68c1e068da66293e8eb8df895bf0594a86b0da00247623b5f582f3a6/59b0e3cf68c1e068da66293e8eb8df895bf0594a86b0da00247623b5f582f3a6-json.log",
        "Name": "/nextcloud-docker_app_1",
        "RestartCount": 0,
        "Driver": "overlay2",
        "Platform": "linux",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "docker-default",
        "ExecIDs": [
            "31d28ac7698ea8ec27ad1882a28bc7bcfbf0c5cf275877db274981decbe1042c"
        ],
        "HostConfig": {
            "Binds": [
                "nextcloud-docker_nextcloud:/var/www/html:rw"
            ],
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "nextcloud-docker_default",
            "PortBindings": {
                "80/tcp": [
                    {
                        "HostIp": "",
                        "HostPort": "8080"
                    }
                ]
            },
            "RestartPolicy": {
                "Name": "always",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": [],
            "CapAdd": null,
            "CapDrop": null,
            "CgroupnsMode": "private",
            "Dns": null,
            "DnsOptions": null,
            "DnsSearch": null,
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "private",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 67108864,
            "Runtime": "runc",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": null,
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": null,
            "DeviceCgroupRules": null,
            "DeviceRequests": null,
            "KernelMemory": 0,
            "KernelMemoryTCP": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": null,
            "OomKillDisable": null,
            "PidsLimit": null,
            "Ulimits": null,
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0,
            "MaskedPaths": [
                "/proc/asound",
                "/proc/acpi",
                "/proc/kcore",
                "/proc/keys",
                "/proc/latency_stats",
                "/proc/timer_list",
                "/proc/timer_stats",
                "/proc/sched_debug",
                "/proc/scsi",
                "/sys/firmware"
            ],
            "ReadonlyPaths": [
                "/proc/bus",
                "/proc/fs",
                "/proc/irq",
                "/proc/sys",
                "/proc/sysrq-trigger"
            ]
        },
        "GraphDriver": {
            "Data": {
                "LowerDir": "/mnt/nextcloud-disk/overlay2/8e6ad252015a169407dd3e61be7b5f40489da88966115c1c41e714020fd9e158-init/diff:/mnt/nextcloud-disk/overlay2/15fb11c5f0f1fbb549c891ecc4ef7ac5a74ad774e93b5da9c653e34bb7e10042/diff:/mnt/nextcloud-disk/overlay2/1ce6474a3fd7da97a3ccba756ba4019f2133d0d3006c8a04e8c92db936caac4e/diff:/mnt/nextcloud-disk/overlay2/90fb6ab389fc63cdef51e7149042264f900c5144fe1da3e5db23596f8aa47c9b/diff:/mnt/nextcloud-disk/overlay2/012d89e2255987a0ff3f70288e2ef5265436470251323152a20d9fcd8fbc3c91/diff:/mnt/nextcloud-disk/overlay2/4a56f4acd1d43c6009635ba2333a1e0121edab12394eabba3b58999d442ac061/diff:/mnt/nextcloud-disk/overlay2/d9ae54b3df78ee74ee817b0f3151222534608166fa3ec17f42e4d3c7307c2394/diff:/mnt/nextcloud-disk/overlay2/d09775f292a3746fd181d506f511aee3e20b0df79af30d810094cb94f8b90375/diff:/mnt/nextcloud-disk/overlay2/606ca1caace0bce8e6af818ad6adab1e9144f782fd41bf64f6e838f1922276bd/diff:/mnt/nextcloud-disk/overlay2/ad15a43bf6a36b3a4f38411e171a5d61e39b01156a7e4aa1c869e2cb6112ff7a/diff:/mnt/nextcloud-disk/overlay2/2ac7512a1da1dab93cd81519f07d1b3b9bf32d15344bdaf05274a072141d1fcb/diff:/mnt/nextcloud-disk/overlay2/19d5643a4101b3f86ac03d51d8caaa87a90a7878748e1113de90e8a4ca3819c7/diff:/mnt/nextcloud-disk/overlay2/1af132592db376e9a574178c86a8e2d8f7283e0ebff23b63ec65ca82040115ec/diff:/mnt/nextcloud-disk/overlay2/fcb4215f3a0f88e2b8944911f599c968cc1d5670fadff882110e580920c0564a/diff:/mnt/nextcloud-disk/overlay2/1019c515e3466ecbec2df4250fc80258105b517397194b044c78f561a6c414ce/diff:/mnt/nextcloud-disk/overlay2/b37603424bab727777db4755ce6aa916b6b9b68b358d28b106cdc95507cd0966/diff:/mnt/nextcloud-disk/overlay2/7be4c639206666613e51b0590c301f65c40e3c00cde046640312db857e2c1815/diff:/mnt/nextcloud-disk/overlay2/892fff02914faf2d44c49d65a15b38522448adebdc5ff2a997b92dfaba51fb4b/diff:/mnt/nextcloud-disk/overlay2/90416bddff10675426913742fcee5fce1ed1f5e1f11a79f7509bd327dc91d8d0/diff:/mnt/nextcloud-disk/overlay2/f5172c12ddce67ace528d8b3aa5598aa06de24060f27ceb3fc9f8eaee7855d3f/diff:/mnt/nextcloud-disk/overlay2/b94e5656ee30207d02341cf0cd3a29a6021281fa300efa7e2d0c1c85d2691e90/diff:/mnt/nextcloud-disk/overlay2/044225dcbb3b8f943e7480b9e45a7d4eb971f3f601a520cee67b64f53cbb4b22/diff:/mnt/nextcloud-disk/overlay2/951b4d1a4e8b55031a8782fda3f088ed11f9c0d2b0d7c8351119c0b827be436a/diff",
                "MergedDir": "/mnt/nextcloud-disk/overlay2/8e6ad252015a169407dd3e61be7b5f40489da88966115c1c41e714020fd9e158/merged",
                "UpperDir": "/mnt/nextcloud-disk/overlay2/8e6ad252015a169407dd3e61be7b5f40489da88966115c1c41e714020fd9e158/diff",
                "WorkDir": "/mnt/nextcloud-disk/overlay2/8e6ad252015a169407dd3e61be7b5f40489da88966115c1c41e714020fd9e158/work"
            },
            "Name": "overlay2"
        },
        "Mounts": [
            {
                "Type": "volume",
                "Name": "nextcloud-docker_nextcloud",
                "Source": "/mnt/nextcloud-disk/volumes/nextcloud-docker_nextcloud/_data",
                "Destination": "/var/www/html",
                "Driver": "local",
                "Mode": "rw",
                "RW": true,
                "Propagation": ""
            }
        ],
        "Config": {
            "Hostname": "59b0e3cf68c1",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "80/tcp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "MYSQL_PASSWORD=REDACTED",
                "MYSQL_DATABASE=nextcloud",
                "MYSQL_USER=REDACTED",
                "MYSQL_HOST=db",
                "PHP_UPLOAD_LIMIT=20G",
                "PHP_POST_MAX_SIZE=20G",
                "PHP_MEMORY_LIMIT=2200M",
                "PHP_MAX_EXECUTION_TIME=7200",
                "PHP_MAX_INPUT_TIME=7200",
                "PHP_MAX_INPUT_VARS=200",
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "PHPIZE_DEPS=autoconf \t\tdpkg-dev \t\tfile \t\tg++ \t\tgcc \t\tlibc-dev \t\tmake \t\tpkg-config \t\tre2c",
                "PHP_INI_DIR=/usr/local/etc/php",
                "APACHE_CONFDIR=/etc/apache2",
                "APACHE_ENVVARS=/etc/apache2/envvars",
                "PHP_CFLAGS=-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64",
                "PHP_CPPFLAGS=-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64",
                "PHP_LDFLAGS=-Wl,-O1 -pie",
                "GPG_KEYS=39B641343D8C104B2B146DC3F9C39DC0B9698544 E60913E4DF209907D8E30D96659A97C9CF2A795A 1198C0117593497A5EC5C199286AF1F9897469DC",
                "PHP_VERSION=8.2.27",
                "PHP_URL=https://www.php.net/distributions/php-8.2.27.tar.xz",
                "PHP_ASC_URL=https://www.php.net/distributions/php-8.2.27.tar.xz.asc",
                "PHP_SHA256=3eec91294d8c09b3df80b39ec36d574ed9b05de4c8afcb25fa215d48f9ecbc6b",
                "PHP_OPCACHE_MEMORY_CONSUMPTION=128",
                "APACHE_BODY_LIMIT=1073741824",
                "NEXTCLOUD_VERSION=30.0.6"
            ],
            "Cmd": [
                "apache2-foreground"
            ],
            "Image": "nextcloud",
            "Volumes": {
                "/var/www/html": {}
            },
            "WorkingDir": "/var/www/html",
            "Entrypoint": [
                "/entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {
                "com.docker.compose.config-hash": "9747fa9f42ef408c8b6d2c9fe5f145aa65744a1ae0be2e8857ed75690a457094",
                "com.docker.compose.container-number": "1",
                "com.docker.compose.oneoff": "False",
                "com.docker.compose.project": "nextcloud-docker",
                "com.docker.compose.project.config_files": "docker-compose.yml",
                "com.docker.compose.project.working_dir": "/root/nextcloud-docker",
                "com.docker.compose.service": "app",
                "com.docker.compose.version": "1.29.2"
            },
            "StopSignal": "SIGWINCH"
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "11fb10ab6bc76ed212b06c2b838022863304c7537a9c19ac808035914610bd8d",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "80/tcp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "8080"
                    },
                    {
                        "HostIp": "::",
                        "HostPort": "8080"
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/11fb10ab6bc7",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "",
            "Gateway": "",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "",
            "IPPrefixLen": 0,
            "IPv6Gateway": "",
            "MacAddress": "",
            "Networks": {
                "nextcloud-docker_default": {
                    "IPAMConfig": null,
                    "Links": [
                        "nextcloud-docker_db_1:db",
                        "nextcloud-docker_db_1:db_1",
                        "nextcloud-docker_db_1:nextcloud-docker_db_1"
                    ],
                    "Aliases": [
                        "app",
                        "59b0e3cf68c1"
                    ],
                    "NetworkID": "8026ce965dae15970653fc24c94a24f91a538b7061e66014bb5783decbd687c5",
                    "EndpointID": "fa36ba62f4271f27912e88bc203ba121c65b178294ae1c71e45d6b9ef3ce21a0",
                    "Gateway": "172.19.0.1",
                    "IPAddress": "172.19.0.3",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:13:00:03",
                    "DriverOpts": null
                }
            }
        }
    }
]

List of activated Apps

All optional apps such as calender and such were deselected upon setup, the only current purpose of nextcloud is for filesharing.

Nextcloud Signing status

Unnecessary, since using unsigned config -> http only

Nextcloud Logs

{
  "reqId": "LeFPbqZMQeabqx5x2Nxm",
  "level": 3,
  "time": "2025-02-18T19:46:10+00:00",
  "remoteAddr": "10.147.17.119",
  "user": "admin",
  "app": "webdav",
  "method": "PUT",
  "url": "/remote.php/dav/uploads/admin/web-file-upload-d97cb9f4dd512235/1",
  "message": "X-OC-MTime header must be a valid positive integer",
  "userAgent": "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Mobile Safari/537.36",
  "version": "30.0.6.2",
  "exception": {
    "Exception": "InvalidArgumentException",
    "Message": "X-OC-MTime header must be a valid positive integer",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/html/apps/dav/lib/Connector/Sabre/Node.php",
        "line": 396,
        "function": "sanitizeMtime",
        "class": "OCA\\DAV\\Connector\\Sabre\\MtimeSanitizer",
        "type": "::",
        "args": [
          "-11644473600"
        ]
      },
      {
        "file": "/var/www/html/apps/dav/lib/Connector/Sabre/File.php",
        "line": 341,
        "function": "sanitizeMtime",
        "class": "OCA\\DAV\\Connector\\Sabre\\Node",
        "type": "->",
        "args": [
          "-11644473600"
        ]
      },
      {
        "file": "/var/www/html/apps/dav/lib/Connector/Sabre/Directory.php",
        "line": 110,
        "function": "put",
        "class": "OCA\\DAV\\Connector\\Sabre\\File",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/html/apps/dav/lib/Upload/UploadFolder.php",
        "line": 34,
        "function": "createFile",
        "class": "OCA\\DAV\\Connector\\Sabre\\Directory",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 1098,
        "function": "createFile",
        "class": "OCA\\DAV\\Upload\\UploadFolder",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/CorePlugin.php",
        "line": 504,
        "function": "createFile",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
        "line": 89,
        "function": "httpPut",
        "class": "Sabre\\DAV\\CorePlugin",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 472,
        "function": "emit",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          "method:PUT",
          [
            {
              "__class__": "Sabre\\HTTP\\Request"
            },
            {
              "__class__": "Sabre\\HTTP\\Response"
            }
          ]
        ]
      },
      {
        "file": "/var/www/html/apps/dav/lib/Connector/Sabre/Server.php",
        "line": 43,
        "function": "invokeMethod",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/var/www/html/apps/dav/lib/Server.php",
        "line": 371,
        "function": "start",
        "class": "OCA\\DAV\\Connector\\Sabre\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/html/apps/dav/appinfo/v2/remote.php",
        "line": 19,
        "function": "exec",
        "class": "OCA\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/html/remote.php",
        "line": 146,
        "args": [
          "/var/www/html/apps/dav/appinfo/v2/remote.php"
        ],
        "function": "require_once"
      }
    ],
    "File": "/var/www/html/apps/dav/lib/Connector/Sabre/MtimeSanitizer.php",
    "Line": 21,
    "message": "X-OC-MTime header must be a valid positive integer",
    "exception": [],
    "CustomMessage": "X-OC-MTime header must be a valid positive integer"
  },
  "id": "67b4e66835614"
}

Additional info

No response

[skjnldsv]

-11644473600 is indeed an invalid mtime

@Dehydrated0Water on your device file explorer, what "last modified" info do you have?
You can also try it manually here: https://developer.mozilla.org/en-US/docs/Web/API/File/lastModified#result

[skjnldsv]

@susnux nextcloud-libraries/nextcloud-upload#1368
I guess we should maybe drop the header if we have invalid data

server/apps/dav/lib/Connector/Sabre/MtimeSanitizer.php

Lines 10 to 24 in ff86bac

	public static function sanitizeMtime(string $mtimeFromRequest): int {
	// In PHP 5.X "is_numeric" returns true for strings in hexadecimal
	// notation. This is no longer the case in PHP 7.X, so this check
	// ensures that strings with hexadecimal notations fail too in PHP 5.X.
	$isHexadecimal = preg_match('/^\s*0[xX]/', $mtimeFromRequest);
	if ($isHexadecimal || !is_numeric($mtimeFromRequest)) {
	throw new \InvalidArgumentException('X-OC-MTime header must be an integer (unix timestamp).');
	}
	// Prevent writing invalid mtime (timezone-proof)
	if ((int)$mtimeFromRequest <= 24 * 60 * 60) {
	throw new \InvalidArgumentException('X-OC-MTime header must be a valid positive integer');
	}
	return (int)$mtimeFromRequest;

[joshtrichards]

I can reproduce this on Android via Chrome with a file that has a sane date on it (i.e. within the past six months)

-11644473600

11644473600 is suspiciously the exact difference between Unix epoch and Windows epoch. It's essentially equivalent to 0 there.

The only thing I can think of on Android that this might arise in, is some filesystem types it supports. It's almost like the file mtime is getting dropped before the file gets to the browser for upload...

[susnux]

I guess we should maybe drop the header if we have invalid data

yes makes sense

[blizzz]

Seems to be a dup of nextcloud/android#14718

[susnux]

@blizzz but in this case it would mean that webui and clients have the same bug

[blizzz]

@susnux yes, and why not? Josh was pointing it out here as well (#50889 (comment)). I understand it's an issue with the source image and the timestamp taken from it.

The header can be dropped on each client side, handled more gracefully on the server side, or both.