[Bug]: Deck fails to open internal Office file links with OnlyOffice, embedded preview causes error

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Hello there,

I hope I'm in the correct section for reporting an issue of which I believe it's a bug.

Environment:

• Nextcloud version: 30.0.10 (managed instance at Hetzner datacenter)
• Deck version: 1.14.5
• OnlyOffice: 9.9.0
• Community Document Server: 0.2.0
• Browser: Safari 18.5
• User role: regular user

Steps to reproduce

• Create or open a Deck board.
• Add a card.
• In the card description, add a link to an internal Office document (e.g., .xlsx) using the internal file link (e.g., https://nextcloud.example.com/f/12345).
• Click the link directly inside the card.

Expected behavior

Expected behavior:

• The Office document opens using OnlyOffice in the same tab or embedded viewer.
• Alternatively, if embedded preview is not supported, the link should open in a new browser tab/window and use OnlyOffice as the handler.

Actual behavior:

• Clicking the link inside the Deck card results in an error message: “Failed to open the requested file.”
• The Deck app attempts to open the Office file inside its internal previewer iframe, which does not support Office file formats.
• Right-clicking the link and choosing “Open in new tab” opens the file successfully with OnlyOffice.

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

## Server configuration detail

**Operating system:** Linux 6.8.0-60-generic nextcloud/server#63-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 19:04:15 UTC 2025 x86_64

**Webserver:** nginx/1.27.1 (fpm-fcgi)

**Database:** mysql 10.11.13

**PHP version:** 8.3.20

Modules loaded: Core, date, libxml, openssl, pcre, sqlite3, zlib, ctype, curl, dom, fileinfo, filter, hash, iconv, json, mbstring, SPL, session, PDO, pdo_sqlite, bz2, posix, random, readline, Reflection, standard, SimpleXML, tokenizer, xml, xmlreader, xmlwriter, mysqlnd, cgi-fcgi, apcu, bcmath, Phar, exif, ftp, gd, gmp, imagick, imap, intl, ldap, maxminddb, memcached, mysqli, pcntl, pdo_mysql, pdo_pgsql, redis, smbclient, soap, sodium, sysvsem, zip, libsmbclient, Zend OPcache

**Nextcloud version:** 30.0.10 - 30.0.10.1

**Updated from an older Nextcloud/ownCloud or fresh install:** 

**Where did you install Nextcloud from:** unknown

<details><summary>Signing status</summary>

[]
</details>

<details><summary>List of activated apps</summary>


Enabled:
 - activity: 3.0.0
 - bruteforcesettings: 3.0.0
 - calendar: 5.3.4
 - circles: 30.0.0
 - cloud_federation_api: 1.13.0
 - comments: 1.20.1
 - contactsinteraction: 1.11.0
 - dashboard: 7.10.0
 - dav: 1.31.1
 - deck: 1.14.5
 - documentserver_community: 0.2.0
 - federatedfilesharing: 1.20.0
 - federation: 1.20.0
 - files: 2.2.0
 - files_downloadlimit: 3.0.0
 - files_mindmap: 0.0.33
 - files_pdfviewer: 3.0.0
 - files_reminders: 1.3.0
 - files_sharing: 1.22.0
 - files_trashbin: 1.20.1
 - files_versions: 1.23.0
 - firstrunwizard: 3.0.0
 - groupfolders: 18.1.3
 - lookup_server_connector: 1.18.0
 - memories: 7.5.2
 - nextcloud_announcements: 2.0.0
 - notifications: 3.0.0
 - notify_push: 1.0.0
 - oauth2: 1.18.1
 - officeonline: 3.0.2
 - onlyoffice: 9.9.0
 - password_policy: 2.0.0
 - photos: 3.0.2
 - privacy: 2.0.0
 - provisioning_api: 1.20.0
 - recommendations: 3.0.0
 - related_resources: 1.5.0
 - richdocuments: 8.5.7
 - serverinfo: 2.0.0
 - settings: 1.13.0
 - sharebymail: 1.20.0
 - support: 2.0.0
 - systemtags: 1.20.0
 - tasks: 0.16.1
 - text: 4.1.0
 - theming: 2.6.0
 - twofactor_backupcodes: 1.19.0
 - updatenotification: 1.20.0
 - user_status: 1.10.0
 - viewer: 3.0.0
 - weather_status: 1.10.0
 - webhook_listeners: 1.1.0-dev
 - whiteboard: 1.1.2
 - workflowengine: 2.12.0
Disabled:
 - admin_audit
 - app_api: 4.0.6
 - encryption
 - files_accesscontrol: 1.20.1
 - files_external
 - logreader: 3.0.0
 - survey_client: 2.0.0
 - suspicious_login
 - twofactor_nextcloud_notification
 - twofactor_totp
 - user_ldap


</details>

<details><summary>Configuration (config/config.php)</summary>


{
    "upgrade.disable-web": true,
    "simpleSignUpLink.shown": false,
    "skeletondirectory": "\/var\/www\/html\/themes\/hetzner\/skeleton",
    "theme": "hetzner",
    "templatedirectory": "\/var\/www\/html\/core\/skeleton\/Templates\/",
    "davstorage.request_timeout": 10800,
    "activity_expire_days": "31",
    "enabledPreviewProviders": [
        "OC\\Preview\\PNG",
        "OC\\Preview\\JPEG",
        "OC\\Preview\\GIF",
        "OC\\Preview\\BMP",
        "OC\\Preview\\XBitmap",
        "OC\\Preview\\MP3",
        "OC\\Preview\\TXT",
        "OC\\Preview\\MarkDown",
        "OC\\Preview\\OpenDocument",
        "OC\\Preview\\Krita",
        "OC\\Preview\\HEIC"
    ],
    "forbidden_filenames": [],
    "memcache.local": "\\OC\\Memcache\\APCu",
    "appstoreurl": "https:\/\/apps.your-storageshare.de",
    "allow_local_remote_servers": true,
    "apps_paths": [
        {
            "path": "\/var\/www\/html\/apps",
            "url": "\/apps",
            "writable": false
        },
        {
            "path": "\/var\/www\/html\/custom_apps",
            "url": "\/custom_apps",
            "writable": true
        }
    ],
    "files_external_allow_create_new_local": false,
    "loglevel": 2,
    "log_type": "syslog",
    "updatechecker": false,
    "updater.server.url": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "dbtype": "mysql",
    "version": "30.0.10.1",
    "overwrite.cli.url": "https:\/\/nx72209.your-storageshare.de",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "default_language": "en",
    "default_locale": "en",
    "default_phone_region": "US",
    "mail_smtpmode": "smtp",
    "mail_smtpauthtype": "LOGIN",
    "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "syslog_tag": "nextcloud-nx72209",
    "maintenance_window_start": 21,
    "bulkupload.enabled": true,
    "redis": {
        "host": "***REMOVED SENSITIVE VALUE***",
        "port": "6379",
        "timeout": "1.5",
        "dbindex": "0"
    },
    "filelocking.enabled": true,
    "memcache.locking": "\\OC\\Memcache\\Redis",
    "memcache.distributed": "\\OC\\Memcache\\Redis",
    "maintenance": false,
    "trusted_domains": [
        "nx72209.your-storageshare.de",
        "nextcloud.trv-fidelia.de"
    ],
    "app_install_overwrite": [
        "twofactor_reminder"
    ],
    "memories.exiftool": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/exiftool-amd64-glibc",
    "memories.vod.path": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/go-vod-amd64",
    "twofactor_enforced": "false",
    "twofactor_enforced_groups": [],
    "twofactor_enforced_excluded_groups": []
}

</details>

**Cron Configuration:** Array
(
    [backgroundjobs_mode] => cron
    [lastcron] => 1751379071
)


**External storages:** files_external is disabled

**Encryption:** no

**User-backends:** 
 * OC\User\Database


**Subscription:** 
 * No valid subscription key set


**Browser:** Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15

List of activated Apps

Enabled:
 - activity: 3.0.0
 - bruteforcesettings: 3.0.0
 - calendar: 5.3.4
 - circles: 30.0.0
 - cloud_federation_api: 1.13.0
 - comments: 1.20.1
 - contactsinteraction: 1.11.0
 - dashboard: 7.10.0
 - dav: 1.31.1
 - deck: 1.14.5
 - documentserver_community: 0.2.0
 - federatedfilesharing: 1.20.0
 - federation: 1.20.0
 - files: 2.2.0
 - files_downloadlimit: 3.0.0
 - files_mindmap: 0.0.33
 - files_pdfviewer: 3.0.0
 - files_reminders: 1.3.0
 - files_sharing: 1.22.0
 - files_trashbin: 1.20.1
 - files_versions: 1.23.0
 - firstrunwizard: 3.0.0
 - groupfolders: 18.1.3
 - lookup_server_connector: 1.18.0
 - memories: 7.5.2
 - nextcloud_announcements: 2.0.0
 - notifications: 3.0.0
 - notify_push: 1.0.0
 - oauth2: 1.18.1
 - officeonline: 3.0.2
 - onlyoffice: 9.9.0
 - password_policy: 2.0.0
 - photos: 3.0.2
 - privacy: 2.0.0
 - provisioning_api: 1.20.0
 - recommendations: 3.0.0
 - related_resources: 1.5.0
 - richdocuments: 8.5.7
 - serverinfo: 2.0.0
 - settings: 1.13.0
 - sharebymail: 1.20.0
 - support: 2.0.0
 - systemtags: 1.20.0
 - tasks: 0.16.1
 - text: 4.1.0
 - theming: 2.6.0
 - twofactor_backupcodes: 1.19.0
 - updatenotification: 1.20.0
 - user_status: 1.10.0
 - viewer: 3.0.0
 - weather_status: 1.10.0
 - webhook_listeners: 1.1.0-dev
 - whiteboard: 1.1.2
 - workflowengine: 2.12.0
Disabled:
 - admin_audit
 - app_api: 4.0.6
 - encryption
 - files_accesscontrol: 1.20.1
 - files_external
 - logreader: 3.0.0
 - survey_client: 2.0.0
 - suspicious_login
 - twofactor_nextcloud_notification
 - twofactor_totp
 - user_ldap

Nextcloud Signing status

index.php/settings/integrity/failed

Nextcloud Logs

no logs available as I have no access to the config.php to set the file handler

Additional info

No response

No source file or test is named in the report. Reproduce the Deck card-description link flow with an internal .xlsx link, compare the failing in-card click with opening in a new tab, and trace the embedded preview behavior. Done means the Office link opens through OnlyOffice without the internal previewer error, either in the supported embedded context or a new tab.