[Bug]: Movie preview generation affected by 5mb limit when using encryption

[Vislike]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I am using per user encryption and started having problem generating preview images for videos some time ago, it was working fine during the winter.

I am pretty sure i tracked it down to this commit.

Problem is isLocal() returns false for encryption.php

So i guess only first 5mb of video is decrypted, and it can fail to generate a preview.

I tried to manually edit Movie.php and reverted the commit above, and all previews started generating again.

But as a Java developer i feel i don't know the product nor php well enough to think up a good solution aka what is the intention of isLocal(), should it return true for encrypted local also, or is the intention something else so it should return false for encrypted local, and if so then the case in Movie.php maybe should use some other condition to check if the storage is not local, but encrypted local etc.

Steps to reproduce

1. Use encryption
2. Setup ffmpeg for movie preview
3. Upload a movie larger than 5mb with movie atom at the end
4. Preview is not generating and a info log is generated

Expected behavior

Movie is decrypted into temp and preview is generated. This was work during the winter.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

{"reqId":"cl3LhiXe8J3l9K26VFab","level":1,"time":"2025-09-04T06:42:13+00:00","remoteAddr":"-","user":"-","app":"core","method":"GET","url":"/core/preview?fileId=9956&x=32&y=32&mimeFallback=true&v=e287ac&a=0","message":"Movie preview generation failed Output: ffmpeg version n7.1.1-56-gc2184b65d2-20250806 Copyright (c) 2000-2025 the FFmpeg developers\n  built with gcc 15.1.0 (crosstool-NG 1.27.0.42_35c1e72)\n  configuration: --prefix=/ffbuild/prefix --pkg-config-flags=--static --pkg-config=pkg-config --cross-prefix=x86_64-ffbuild-linux-gnu- --arch=x86_64 --target-os=linux --enable-gpl --enable-version3 --disable-debug --enable-iconv --enable-zlib --enable-libfribidi --enable-gmp --enable-libxml2 --enable-openssl --enable-lzma --enable-fontconfig --enable-libharfbuzz --enable-libfreetype --enable-libvorbis --enable-opencl --enable-libpulse --enable-libvmaf --enable-libxcb --enable-xlib --enable-amf --enable-libaom --enable-libaribb24 --enable-avisynth --enable-chromaprint --enable-libdav1d --enable-libdavs2 --enable-libdvdread --enable-libdvdnav --disable-libfdk-aac --enable-ffnvcodec --enable-cuda-llvm --enable-frei0r --enable-libgme --enable-libkvazaar --enable-libaribcaption --enable-libass --enable-libbluray --enable-libjxl --enable-libmp3lame --enable-libopus --enable-librist --enable-libssh --enable-libtheora --enable-libvpx --enable-libwebp --enable-libzmq --enable-lv2 --enable-libvpl --enable-openal --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libopenh264 --enable-libopenjpeg --enable-libopenmpt --enable-librav1e --enable-librubberband --disable-schannel --enable-sdl2 --enable-libsnappy --enable-libsoxr --enable-libsrt --enable-libsvtav1 --enable-libtwolame --enable-libuavs3d --enable-libdrm --enable-vaapi --enable-libvidstab --enable-vulkan --enable-libshaderc --enable-libplacebo --enable-libvvenc --enable-libx264 --enable-libx265 --enable-libxavs2 --enable-libxvid --enable-libzimg --enable-libzvbi --extra-cflags=-DLIBTWOLAME_STATIC --extra-cxxflags= --extra-libs='-ldl -lgomp' --extra-ldflags=-pthread --extra-ldexeflags=-pie --cc=x86_64-ffbuild-linux-gnu-gcc --cxx=x86_64-ffbuild-linux-gnu-g++ --ar=x86_64-ffbuild-linux-gnu-gcc-ar --ranlib=x86_64-ffbuild-linux-gnu-gcc-ranlib --nm=x86_64-ffbuild-linux-gnu-gcc-nm --extra-version=20250806\n  libavutil      59. 39.100 / 59. 39.100\n  libavcodec     61. 19.101 / 61. 19.101\n  libavformat    61.  7.100 / 61.  7.100\n  libavdevice    61.  3.100 / 61.  3.100\n  libavfilter    10.  4.100 / 10.  4.100\n  libswscale      8.  3.100 /  8.  3.100\n  libswresample   5.  3.100 /  5.  3.100\n  libpostproc    58.  3.100 / 58.  3.100\n[mov,mp4,m4a,3gp,3g2,mj2 @ 0x56021fa5f640] moov atom not found\n[in#0 @ 0x56021fa5f380] Error opening input: Invalid data found when processing input\nError opening input file /tmp/oc_tmp_VEhFWenNyS5phNQBZCeyO1OzKnaF74w1.\nError opening input files: Invalid data found when processing input","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"core"},"id":"68b94954bd429"}

Additional info

No response

[Vislike]

For reference i also voiced my concern about testing with encryption in this pull request:
#53952

[invario]

For reference i also voiced my concern about testing with encryption in this pull request: #53952

Have you had a chance to use #53952 which was merged? I did some testing and it appears on my end the getSparseFile method does work with encrypted files.

[Vislike]

No not yet, running in docker container so don't really know of a easy way to test a commit, was hoping it would show up automatically within a few days/weeks. But that might be naive, don't know how the release cycle looks like, but it looks like 31 is not getting any new code, so i guess it might not show up before v32 or even later. So might need to manually login to container and try updating the file with your changes.

[invario]

No not yet, running in docker container so don't really know of a easy way to test a commit, was hoping it would show up automatically within a few days/weeks. But that might be naive, don't know how the release cycle looks like, but it looks like 31 is not getting any new code, so i guess it might not show up before v32 or even later. So might need to manually login to container and try updating the file with your changes.

@Vislike You can always just go into the running container and manually replace Movie.php with the one from my commit that I made and that will work. 4 files were changed in my commit, but (3) of them are just for running tests with PHPUnit.