nextcloud / nextcloud/richdocuments
fix(secure-view): ZIP download silently broken when folder contains watermarked files
@elzody is already working on this.
Since Apr 23, 2026.
- Dominant language
- JavaScript
- Stars
- 453
- Forks
- 147
- Avg merge
- 14h 54m
- Merged PRs (30d)
- 83
Description
Describe the bug
When downloading a folder as ZIP that contains at least one Office file subject to Secure View watermarking, the resulting archive is silently corrupted. The server responds 200 OK and begins streaming the ZIP, but SecureViewWrapper::checkFileAccess() throws a ForbiddenException mid-stream once a secured file is reached. Because the HTTP response is already committed at that point, no error is surfaced to the user — they receive a broken, unextractable archive.
This bug was discovered while working on #5577 and #5587.
To Reproduce
- Enable Secure View watermarking (any rule:
watermark_shareAll, tag-based, or group-based) - Place at least one eligible Office file (
.docx,.odt, etc.) inside a folder alongside other files - Select the folder in the Files UI and choose "Download"
- Attempt to extract the downloaded ZIP → extraction fails with a corrupt archive error
Expected behavior
Either the download is blocked before it starts with a clear user-visible error, or secured files are excluded from the archive with a human-readable explanation.
Screenshots
N/A
Server details
Operating system: any
Web server: any
Database: any
PHP version: any
Nextcloud version: any
Version of the richdocuments app: any
Version of Collabora Online: any
Configuration of the richdocuments app
Any configuration with watermark_enabled = yes and at least one watermark rule active.
Notes for implementors
Three fix strategies:
A — Block before ZIP creation (BeforeZipCreatedEvent listener): scan the folder tree and reject the download if any watermarked file is found. Main concern: fully recursive tree walk with per-file shouldWatermark() calls degenerates into one getTagIdsForObjects() DB query per file when tag-based rules are active — O(n) queries before a single byte is written. Requires batched tag lookups and a rule-level pre-flight check to be safe for large folders.
B — Graceful degradation during streaming: catch the ForbiddenException at the ZIP-assembly layer in core, skip the secured file, and inject a DOWNLOAD_INCOMPLETE.txt into the archive. User gets a usable partial ZIP with a clear explanation. Requires a Nextcloud core change.
C — Verify existing error surfacing: confirm whether Nextcloud core already checks BeforeZipCreatedEvent::getErrorMessage() and aborts with a user-visible response before any ZIP data is written. If so, strategy A (with the performance fixes above) may be sufficient.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.