nextcloud / nextcloud/richdocuments

Secure View blocks WebDAV file download for file owner after upgrade from NC 30.0.14 to 31.0.8

Open
#4,944 7 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

feature: secure view
Dominant language
JavaScript
Stars
453
Forks
147
Avg merge
14h 54m
Merged PRs (30d)
83

Description

Describe the bug

After upgrading from Nextcloud 30.0.14 to 31.0.8, when the Secure View (Hide download) option is enabled for a shared file or folder, the file owner (or a user with full access) cannot download the file via WebDAV. The request returns 403 Forbidden with the message:

Download blocked due the secure view policy

This behavior did not occur in NC 30.0.14.

To Reproduce
Steps to reproduce the behavior:

  1. Log in to Nextcloud as User A (file owner).
  2. Share a folder or file with another user or via link.
  3. Enable Hide download / Secure View for that share.
  4. From the same owner account (User A), try to download the file via WebDAV:
  5. GET /remote.php/dav/files//.pdf (Or docx/xlsx or some docs file)
  6. Observe that the request fails with 403 Forbidden.

Expected behavior
The file owner (or any user with full permissions) should still be able to download their own files via WebDAV, even if Secure View is enabled for a share.

Screenshots

Image Image Image

If i disabled the Secure View:

Image Image

Client details:

  • OS: macOS 15.6
  • Browser: Chrome
  • Version: 139.0.7258.128
  • Device: Macbook

Server details

Operating system:
Debian 12
Linux 6.1.0-34-amd64 nextcloud/server#1 SMP PREEMPT_DYNAMIC Debian 6.1.135-1 (2025-04-25) x86_64 GNU/Linux

Web server:
nginx version: nginx/1.22.1

Database:
mariadb Ver 15.1 Distrib 10.11.11-MariaDB, for debian-linux-gnu (x86_64) using EditLine wrapper

PHP version:
PHP 8.2.28

Nextcloud version:
31.0.8

Version of the richdocuments app
Collabora Online - Built-in CODE Server

Version of Collabora Online
25.4.202

Configuration of the richdocuments app

Insert the output of `./occ config:list richdocuments` (or equivalent adapted for your runtime environment)

{
    "apps": {
        "richdocuments": {
            "disable_certificate_verification": "yes",
            "doc_format": "ooxml",
            "enabled": "yes",
            "external_apps": "",
            "installed_version": "8.7.3",
            "public_wopi_url": "https:\/\/*************",
            "types": "filesystem,prevent_group_restriction",
            "wopi_url": "https:\/\/*************\/apps\/richdocumentscode\/proxy.php?req="
        }
    }
}
Logs
Nextcloud log (data/nextcloud.log)
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"Flow activation: rules were requested for operation Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"No flow configurations is going to run Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"Flow activation: rules were requested for operation Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"No flow configurations is going to run Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"Flow activation: rules were requested for operation Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"No flow configurations is going to run Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"Flow activation: rules were requested for operation Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"No flow configurations is going to run Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"Flow activation: rules were requested for operation Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"No flow configurations is going to run Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"Flow activation: rules were requested for operation Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"No flow configurations is going to run Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"Flow activation: rules were requested for operation Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"No flow configurations is going to run Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"Flow activation: rules were requested for operation Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"No flow configurations is going to run Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"Flow activation: rules were requested for operation Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"workflowengine","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"No flow configurations is going to run Block access to a file","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"workflowengine","level":"0"}}
{"reqId":"ABCDEF1234567890","level":0,"time":"2025-08-18T10:34:03+00:00","remoteAddr":"aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111","user":"AAAAAA","app":"webdav","method":"GET","url":"/remote.php/dav/files/AAAAAA/Docs/Somepdf.pdf","message":"Download blocked due the secure view policy","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"31.0.8.1","exception":{"Exception":"OCA\\DAV\\Connector\\Sabre\\Exception\\Forbidden","Message":"Download blocked due the secure view policy","Code":0,"Trace":[{"file":"/var/www/<domain>/nc/apps/dav/lib/Connector/Sabre/File.php","line":462,"function":"convertToSabreException","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/var/www/<domain>/nc/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":85,"function":"get","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/var/www/<domain>/nc/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpGet","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/var/www/<domain>/nc/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/<domain>/nc/apps/dav/lib/Connector/Sabre/Server.php","line":49,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/<domain>/nc/apps/dav/lib/Server.php","line":401,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/<domain>/nc/apps/dav/appinfo/v2/remote.php","line":21,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/<domain>/nc/remote.php","line":145,"args":["/var/www/<domain>/nc/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/<domain>/nc/apps/dav/lib/Connector/Sabre/File.php","Line":570,"Previous":{"Exception":"OCP\\Files\\ForbiddenException","Message":"Download blocked due the secure view policy","Code":0,"Trace":[{"file":"/var/www/<domain>/nc/apps/richdocuments/lib/Storage/SecureViewWrapper.php","line":43,"function":"checkFileAccess","class":"OCA\\Richdocuments\\Storage\\SecureViewWrapper","type":"->"},{"file":"/var/www/<domain>/nc/apps/terms_of_service/lib/Filesystem/StorageWrapper.php","line":69,"function":"fopen","class":"OCA\\Richdocuments\\Storage\\SecureViewWrapper","type":"->"},{"file":"/var/www/<domain>/nc/lib/private/Files/View.php","line":1209,"function":"fopen","class":"OCA\\TermsOfService\\Filesystem\\StorageWrapper","type":"->"},{"file":"/var/www/<domain>/nc/lib/private/Files/View.php","line":1037,"function":"basicOperation","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/<domain>/nc/apps/dav/lib/Connector/Sabre/File.php","line":460,"function":"fopen","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/<domain>/nc/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":85,"function":"get","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/var/www/<domain>/nc/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpGet","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/var/www/<domain>/nc/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/<domain>/nc/apps/dav/lib/Connector/Sabre/Server.php","line":49,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/<domain>/nc/apps/dav/lib/Server.php","line":401,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/<domain>/nc/apps/dav/appinfo/v2/remote.php","line":21,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/<domain>/nc/remote.php","line":145,"args":["/var/www/<domain>/nc/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/<domain>/nc/apps/richdocuments/lib/Storage/SecureViewWrapper.php","Line":83},"message":"Download blocked due the secure view policy","exception":{},"CustomMessage":"Download blocked due the secure view policy"}}
Browser log
403 Forbidden

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the GET request at /remote.php/dav/files// with Secure View enabled, then inspect the secure view policy path and the provided Nextcloud logs showing the 403 response. The fix is done when owners or users with full permissions can download through WebDAV while restricted share recipients remain blocked.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.