Encrypted Collective pages become inaccessible to sh... | nextcloud/collectives

Nobody has claimed this yet.

Describe the bug
On an instance with server-side encryption enabled and several users editing in a collective over the last weeks, several pages became unaccessable to some users. The calls to webdav and text API to fetch the page content resulted in server errors:

"Exception": "OC\Encryption\Exceptions\DecryptionFailedException",
"Message": "Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.",

JSON Trace

{
  "Exception": "OC\\Encryption\\Exceptions\\DecryptionFailedException",
  "Message": "Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.",
  "Code": 0,
  "Trace": [
    {
      "file": "/var/www/cloud.example.org/nextcloud-25.0.7/lib/private/Files/Stream/Encryption.php",
      "line": 519,
      "function": "decrypt",
      "class": "OCA\\Encryption\\Crypto\\Encryption",
      "type": "->",
      "args": [
        "*** sensitive parameters replaced ***"
      ]
    },
    {
      "file": "/var/www/cloud.example.org/nextcloud-25.0.7/lib/private/Files/Stream/Encryption.php",
      "line": 317,
      "function": "readCache",
      "class": "OC\\Files\\Stream\\Encryption",
      "type": "->",
      "args": []
    },
    {
      "function": "stream_read",
      "class": "OC\\Files\\Stream\\Encryption",
      "type": "->",
      "args": [
        626
      ]
    },
    {
      "file": "/var/www/cloud.exampl.org/nextcloud-25.0.7/3rdparty/icewind/streams/src/Wrapper.php",
      "line": 55,
      "function": "fread",
      "args": [
        null,
        8192
      ]
    },
    {
      "file": "/var/www/cloud.example.org/nextcloud-25.0.7/3rdparty/icewind/streams/src/CallbackWrapper.php",
      "line": 96,
      "function": "stream_read",
      "class": "Icewind\\Streams\\Wrapper",
      "type": "->",
      "args": [
        8192
      ]
    },
    {
      "function": "stream_read",
      "class": "Icewind\\Streams\\CallbackWrapper",
      "type": "->",
      "args": [
        8192
      ]
    },
    {
      "file": "/var/www/cloud.example.org/nextcloud-25.0.7/3rdparty/sabre/http/lib/Sapi.php",
      "line": 110,
      "function": "stream_copy_to_stream",
      "args": [
        null,
        null,
        626
      ]
    },
    {
      "file": "/var/www/cloud.example.org/nextcloud-25.0.7/3rdparty/sabre/dav/lib/DAV/Server.php",
      "line": 490,
      "function": "sendResponse",
      "class": "Sabre\\HTTP\\Sapi",
      "type": "0:0:0:0:0:0:0:0",
      "args": [
        [
          "Sabre\\HTTP\\Response"
        ]
      ]
    },
    {
      "file": "/var/www/cloud.example.org/nextcloud-25.0.7/3rdparty/sabre/dav/lib/DAV/Server.php",
      "line": 253,
      "function": "invokeMethod",
      "class": "Sabre\\DAV\\Server",
      "type": "->",
      "args": [
        [
          "Sabre\\HTTP\\Request"
        ],
        [
          "Sabre\\HTTP\\Response"
        ]
      ]
    },
    {
      "file": "/var/www/cloud.example.org/nextcloud-25.0.7/3rdparty/sabre/dav/lib/DAV/Server.php",
      "line": 321,
      "function": "start",
      "class": "Sabre\\DAV\\Server",
      "type": "->",
      "args": []
    },
    {
      "file": "/var/www/cloud.example.org/nextcloud-25.0.7/apps/dav/lib/Server.php",
      "line": 360,
      "function": "exec",
      "class": "Sabre\\DAV\\Server",
      "type": "->",
      "args": []
    },
    {
      "file": "/var/www/cloud.example.org/nextcloud-25.0.7/apps/dav/appinfo/v2/remote.php",
      "line": 35,
      "function": "exec",
      "class": "OCA\\DAV\\Server",
      "type": "->",
      "args": []
    },
    {
      "file": "/var/www/cloud.example.org/nextcloud-25.0.7/remote.php",
      "line": 172,
      "args": [
        "/var/www/cloud.example.org/nextcloud-25.0.7/apps/dav/appinfo/v2/remote.php"
      ],
      "function": "require_once"
    }
  ],
  "File": "/var/www/cloud.example.org/nextcloud-25.0.7/apps/encryption/lib/Crypto/Encryption.php",
  "Line": 382,
  "Hint": "Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.",
  "message": "Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.",
  "exception": {},
  "CustomMessage": "Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you."
}

Server details

Collectives app version: 2.5.0
Operating system: Debian Bullseye
Nextcloud version: 25.0.7

Start with apps/encryption/lib/Crypto/Encryption.php and lib/private/Files/Stream/Encryption.php, then trace the WebDAV entry point in apps/dav/appinfo/v2/remote.php. Reproduce access to an encrypted collective page through WebDAV or the text API and identify why shared members receive DecryptionFailedException. Done means affected shared pages are accessible to those members without the decryption error.

Written by the indexing model from the issue text.

Encrypted Collective pages become inaccessible to shared members

Description

Contributor guide

First steps

Research direction

Assessment