[Bug]: Device points request uses limit=100000, rejected by Nextcloud 34

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• Maps app is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When opening the Maps app and loading device location history, Maps sends a request with limit=100000.

Example request:

GET /index.php/apps/maps/devices/1?limit=100000&offset=0

On Nextcloud 34 this request is rejected with:

Parameter limit must be between 1 and 500

As a result, device location points cannot be loaded correctly and the following error is repeatedly written to the Nextcloud log.

I verified that the request originates from the Maps app itself and is not caused by the reverse proxy or web server configuration.

Environment:

• Nextcloud Server: 34.0.3
• Maps: 1.8.0
• Docker installation
• MariaDB
• Redis
• nginx reverse proxy

The installed Maps backend contains:

public function getDevicePoints(
$id,
?int $pruneBefore = 0,
?int $limit = 10000,
?int $offset = 0,
?array $tokens = null
): DataResponse

However, the compiled Maps frontend (js/maps-main.js) requests device points using a limit of 100000 (1e5).

The relevant frontend code contains:

get(...)(e.id,this.myMapId,1e5,e.points?.length||0,e.tokens)

and subsequently checks:

i.data.length>=1e5

So the value 100000 appears to be intentionally used as the pagination/page size for device points, but this exceeds the maximum request parameter value accepted by Nextcloud 34.

Expected behavior:
Maps should request device points using a limit compatible with the current Nextcloud server parameter validation and paginate the results as necessary.

Actual behavior:
Maps requests limit=100000, Nextcloud rejects the request, and device location history fails to load.

Steps to reproduce

1. Install/enable Maps 1.8.0 on Nextcloud 34.
2. Enable device location tracking and have location points stored for a device.
3. Open Maps.
4. Open the device/location history.
5. Check the Nextcloud log.

Maps sends:

GET /index.php/apps/maps/devices/1?limit=100000&offset=0

Nextcloud rejects the request with:

Parameter limit must be between 1 and 500

Expected behavior

Maps should load device location points successfully.

The frontend should use a request limit accepted by the current Nextcloud server and use pagination when more points need to be retrieved.

Installation method

None

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install of the server?

None

Is this bug present after an update or on a fresh install of the app?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

sudo docker exec -u www-data nextcloud-app php occ config:list system
{
    "system": {
        "auth.session.enforce": false,
        "auth.session.lifetime": 86400,
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": "***REMOVED SENSITIVE VALUE***",
        },
        "upgrade.disable-web": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "allow_local_remote_servers": true,
        "onlyoffice": {
            "verify_peer_off": true
        },
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***",
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "overwritehost": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "overwritewebroot": "\/",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.3.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": true,
                "verify_peer": false,
                "verify_peer_name": false
            }
        },
        "config_preset": 2,
        "defaultapp": "dashboard,files,photos,activity,mail,contacts,calendar,office",
        "maintenance_window_start": 1,
        "default_phone_region": "CZ",
        "enable_previews": true,
        "preview_max_x": 2048,
        "preview_max_y": 2048,
        "app_install_overwrite": [],
        "loglevel": 2,
        "log_rotate_size": 104857600,
        "log_max_history": 5,
        "memories.db.triggers.fcu": true,
        "memories.exiftool": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/exiftool-amd64-glibc",
        "memories.vod.path": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/go-vod-amd64",
        "enabledPreviewProviders": [
            "OC\\Preview\\JPEG",
            "OC\\Preview\\PNG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\BMP",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\TIFF",
            "OC\\Preview\\Movie"
        ],
        "memories.gis_type": 1,
        "memories.vod.disable": false,
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "davstorage.request_timeout": 300,
        "preview_max_memory": 512
    }
}

List of activated Apps

sudo docker exec -u www-data nextcloud-app php occ app:list
Enabled:
  - activity: 7.0.0
  - app_api: 34.0.0
  - appstore: 1.0.0
  - bookmarks: 16.2.6
  - bruteforcesettings: 7.0.0
  - calendar: 6.5.4
  - circles: 34.0.0
  - cloud_federation_api: 1.18.0
  - collectives: 4.5.0
  - comments: 1.24.0
  - contacts: 8.7.6
  - contactsinteraction: 1.15.0
  - cookbook: 0.11.9
  - dashboard: 7.14.0
  - dav: 1.40.0
  - deck: 1.18.3
  - federatedfilesharing: 1.24.0
  - federation: 1.24.0
  - files: 2.6.0
  - files_downloadlimit: 5.2.0
  - files_external: 1.26.0
  - files_lock: 34.0.1
  - files_pdfviewer: 7.0.0-dev.0
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - firstrunwizard: 7.0.0-dev.0
  - gpxpod: 8.3.1
  - journalnotes: 0.2.0
  - logcleaner: 1.5.8
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - mail: 5.11.2
  - maps: 1.8.0
  - memories: 8.1.0
  - music: 3.1.1
  - nextcloud_announcements: 6.0.0
  - notes: 6.0.2
  - notifications: 7.0.0-dev.1
  - notify_push: 1.4.0
  - oauth2: 1.22.0
  - onlyoffice: 10.1.2
  - password_policy: 6.0.0-dev.0
  - previewgenerator: 5.14.0
  - privacy: 6.0.0-dev.1
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - recommendations: 7.0.0
  - related_resources: 5.0.0-dev.0
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - side_menu: 6.0.1
  - socialsharing_facebook: 4.1.0
  - spreed: 24.0.4
  - support: 6.0.0
  - survey_client: 6.0.0-dev.0
  - tables: 2.2.2
  - tasks: 0.18.1
  - text: 8.0.0
  - theming: 2.9.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - user_status: 1.14.0
  - viewer: 7.0.0-dev.0
  - weather_status: 1.14.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0
Disabled:
  - admin_audit: 1.24.0
  - context_chat: 5.4.0 (installed 5.4.0)
  - encryption: 2.22.0
  - office: 1.0.0 (installed 1.0.0)
  - photos: 7.0.0 (installed 7.0.0)
  - suspicious_login: 12.0.0-dev.0
  - systemtags: 1.24.0 (installed 1.24.0)
  - twofactor_nextcloud_notification: 8.0.0
  - user_ldap: 1.25.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Browser Console

Additional info

No response

Start with the frontend source corresponding to the call shown in js/maps-main.js and the backend getDevicePoints method. Reproduce device history loading against Nextcloud 34, then verify the request stays within the server's 500-point limit and paginates when needed. Done means stored device location history loads without the parameter-validation error.