nextcloud / nextcloud/richdocuments

When Richdocuments is enabled, OnlyOffice documents can't share its files with external shares

Open
#5,250 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage
Dominant language
JavaScript
Stars
453
Forks
147
Avg merge
14h 54m
Merged PRs (30d)
83

Description

Describe the bug
We have Richdocuments and OnlyOffice installed in the same NextCloud. We just updated to NextCloud 31.0.6 and both apps also, Richdocuments 8.7.7 and OnlyOffice 9.12.0. Before the update we had Nextcloud 30.0.7, Richdocuments 8.5.13 and OnlyOffice 9.11.0.

After updating, if you share a file from Microsoft (docx, pptx, xslx, etc) with edit permissions with external shares by a link, you only get the download option.
If I disable Richdocuments, then it works ok.

If the user is logged, you can open the files without a problem.

I have downgraded (disabling the app) to all Richdocuments versions that work with NextCloud 31.0.6 without success to solve the problem :(

Sorry for my bad English :)

To Reproduce
Steps to reproduce the behavior:

  1. Have both apps enabled and working
  2. Create a .docx document and in the file sharing tab, create a External share and give to it edit options.
  3. Copy the link and in a browser where you are not logged in, paste and go. Link example: https://test.test/index.php/s/b7imH5CaykkEzsq?openfile=true
  4. The file opens as downladble file without option to edit (not in OnlyOffice to edit).
  5. Disable Richdocuments in the apps page.
  6. Reload the document in the browser where you were not logged in. The document is opened in OnlyOffice and the person can edit it, as it is expected.

Expected behavior
OnlyOffice opens the file and the person can edit it.

Screenshots
In files, the document with a External share and edit options
Image
Image opening the link without been logged in (only download, but not edit with OnlyOffice
Image

Client details:

  • OS: Ubuntu 22.04.5 LTS
  • Browsers: LibreWolf 146.0-2, Vivaldi 7.7.3851.66 , Chromium 108.0.5359.40

Server details

Operating system:
Debian GNU/Linux 12 (bookworm)
Web server:
Apache/2.4.65 (Debian)
Database:
mariadb Ver 15.1 Distrib 10.11.14-MariaDB, for debian-linux-gnu (x86_64) using EditLine wrapper
PHP version:
PHP 8.2.30
Nextcloud version:
31.0.6
Version of the richdocuments app
8.7.7
Version of Collabora Online
Collabora Online Development Edition 25.04.8.1 278cb3481b
Configuration of the richdocuments app

{
    "apps": {
        "richdocuments": {
            "canonical_webroot": "",
            "disable_certificate_verification": "",
            "enabled": "yes",
            "external_apps": "",
            "installed_version": "8.7.7",
            "public_wopi_url": "https:\/\/test.test",
            "types": "filesystem,prevent_group_restriction",
            "wopi_allowlist": "",
            "wopi_url": "https:\/\/test.test"
        }
    }
}

Logs
Nextcloud log (data/nextcloud.log)
No logs about Richdocuments or OnlyOffice
Browser log
Insert your browser log here, this could for example include:

a) The javascript console log
Content-Security-Policy: The page’s settings blocked the loading of a resource (media-src) at data: because it violates the following directive: “media-src 'self'” [b7imH5CaykkEzsq](https://test.test/index.php/s/b7imH5CaykkEzsq?openfile=true)
[WARN] viewer: Some mimes were ignored because they are not enabled in the server previews config 
Object { app: "viewer", level: 2, ignoredMimes: (3) […] }
[index.mjs:51:17](https://test.test/apps/viewer/node_modules/@nextcloud/logger/dist/index.mjs)
OCA.Files.Settings initialized [Settings.js:12:11](webpack:///nextcloud/apps/files/src/services/Settings.js)
session heartbeat polling started [session-heartbeat.js:83:10](webpack:///nextcloud/core/src/session-heartbeat.js)
[ERROR] files: SW registration failed:  
Object { app: "files", level: 2, error: DOMException }
[index.mjs:54:17](webpack:///nextcloud/node_modules/@nextcloud/logger/dist/index.mjs)
Content-Security-Policy: The page’s settings blocked a worker script (worker-src) at https://test.test/index.php/apps/files/preview-service-worker.js from being executed because it violates the following directive: “script-src 'nonce-xPh3M1+YGKfR0M3ih3ohTGakFu89seJx7eHo9KMCXsk='” [ServiceWorker.js:22:56](webpack:///nextcloud/apps/files/src/services/ServiceWorker.js)
Mounted note-to-recipient [FilesListHeader.vue:40:17](webpack:///nextcloud/apps/files/src/components/FilesListHeader.vue)
[ERROR] files: Failed to open sidebar on file 629484, file isn't cached yet ! 
Object { app: "files", level: 2, fileId: 629484, node: {…} }
[index.mjs:54:17](webpack:///nextcloud/node_modules/@nextcloud/logger/dist/index.mjs)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the public-share flow at the documented /index.php/s/...?...openfile=true entry point with Richdocuments and OnlyOffice enabled, then compare it after disabling Richdocuments. Trace how anonymous external-share requests select the document editor; done means an external user with edit permission is opened in OnlyOffice rather than being offered only a download.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.