[Bug]: Timeout with unauthenticated File drop

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Hello,
I'm running latest Nextcloud 30.0.4 and when I upload even small file of 91ko for example, the loading bar is full and stay blocked until timeout. Yet, the file is uploaded correctly but I can't move it because it looks like it's in a locked state.
It only happens with the filedrop function when unauthenticated, the uploads works correctly when a user is logged, even for large files like 3GB.

Steps to reproduce

1. Make a file drop link
2. Upload any file, even a small one
3. Upload bar is blocked at 100% until server timeout

Expected behavior

FIle upload should indicate that the file is uplaoded and unlock this fie, in order to move it

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 28.0.1 to 28.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "defaultapp": "files",
        "default_phone_region": "FR",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "dbtype": "mysql",
        "version": "30.0.4.1",
        "logtimezone": "Europe\/Paris",
        "installed": true,
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "ssl",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "loglevel": 2,
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "maintenance": false,
        "theme": "",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "simpleSignUpLink.shown": false,
        "appstore.experimental.enabled": true,
        "filelocking.enabled": "true",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "mysql.utf8mb4": true,
        "mail_sendmailmode": "smtp",
        "app_install_overwrite": [
            "forms",
            "keeweb",
            "flow_notifications"
        ],
        "maintenance_window_start": "3",
        "updater.release.channel": "stable",
        "encryption.legacy_format_support": false,
        "encryption.key_storage_migrated": false,
        "trashbin_retention_obligation": "30, 60"
    }
}

List of activated Apps

Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - announcementcenter: 7.0.1
  - app_api: 4.0.3
  - audioplayer: 3.4.1
  - bookmarks: 15.0.4
  - bruteforcesettings: 3.0.0
  - calendar: 5.0.8
  - circles: 30.0.0
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - dashboard: 7.10.0
  - dav: 1.31.1
  - external: 5.5.2
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_downloadlimit: 3.0.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - firstrunwizard: 3.0.0
  - flow_notifications: 1.10.0
  - forms: 4.3.4
  - guests: 4.0.1
  - keeweb: 0.6.20
  - lookup_server_connector: 1.18.0
  - nextcloud_announcements: 2.0.0
  - notes: 4.11.0
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - onlyoffice: 9.5.0
  - password_policy: 2.0.0
  - photos: 3.0.2
  - polls: 7.2.5
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - quota_warning: 1.20.0
  - recognize: 8.2.0
  - registration: 2.5.0
  - related_resources: 1.5.0
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - support: 2.0.0
  - survey_client: 2.0.0
  - systemtags: 1.20.0
  - tasks: 0.16.1
  - text: 4.1.0
  - theming: 2.5.0
  - twofactor_backupcodes: 1.19.0
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - updatenotification: 1.20.0
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - collectives: 2.15.2 (installed 2.15.2)
  - contactsinteraction: 1.11.0 (installed 1.5.0)
  - encryption: 2.18.0 (installed 2.16.0)
  - end_to_end_encryption: 1.16.1 (installed 1.16.1)
  - files_external: 1.22.0 (installed 1.20.0)
  - logreader: 3.0.0 (installed 2.14.0)
  - recommendations: 3.0.0 (installed 2.0.0)
  - suspicious_login: 8.0.0 (installed 6.0.0)
  - user_ldap: 1.21.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"4pG3eEIpnM1kzwyylt1B","level":2,"time":"2024-12-23T16:52:39+01:00","remoteAddr":"192.168.0.254","user":"--","app":"no app in context","method":"PUT","url":"/public.php/dav/files/dropbox/IMG_20160514_124940.jpg","message":"Icon of notification is not an absolute URL and does not work in mobile and desktop clients [app: flow_notifications, subject: \\OCP\\Files::postCreate]","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0","version":"30.0.4.1","data":[]}
2024/12/23 16:52:39 [error] 2907112#2907112: *62 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.168.0.254, server: cloud.xxx.xxx, request: "PUT /public.php/dav/files/dropbox/Snapchat-2101685118728354079.jpg HTTP/2.0", upstream: "fastcgi://unix:/run/php/php8.3-fpm.sock", host: "cloud.xxx.xxx"
192.168.0.254 - - [23/Dec/2024:16:52:39 +0100] "PUT /public.php/dav/files/dropbox/Snapchat-2101685118728354079.jpg HTTP/2.0" 504 160 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"
{"reqId":"WH46SSeK0J7OVyN6BpTi","level":2,"time":"2024-12-23T16:52:39+01:00","remoteAddr":"192.168.0.254","user":"--","app":"no app in context","method":"PUT","url":"/public.php/dav/files/dropbox/Snapchat-2101685118728354079.jpg","message":"Icon of notification is not an absolute URL and does not work in mobile and desktop clients [app: flow_notifications, subject: \\OCP\\Files::postCreate]","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0","version":"30.0.4.1","data":[]}
{"reqId":"4pG3eEIpnM1kzwyylt1B","level":2,"time":"2024-12-23T16:52:39+01:00","remoteAddr":"192.168.0.254","user":"--","app":"no app in context","method":"PUT","url":"/public.php/dav/files/dropbox/IMG_20160514_124940.jpg","message":"Icon of notification is not an absolute URL and does not work in mobile and desktop clients [app: flow_notifications, subject: \\OCP\\Files::postCreate]","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0","version":"30.0.4.1","data":[]}
{"reqId":"WH46SSeK0J7OVyN6BpTi","level":2,"time":"2024-12-23T16:52:39+01:00","remoteAddr":"192.168.0.254","user":"--","app":"no app in context","method":"PUT","url":"/public.php/dav/files/dropbox/Snapchat-2101685118728354079.jpg","message":"Icon of notification is not an absolute URL and does not work in mobile and desktop clients [app: flow_notifications, subject: \\OCP\\Files::postCreate]","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0","version":"30.0.4.1","data":[]}

Additional info

No response

Start with the unauthenticated PUT request to /public.php/dav/files/dropbox/... and reproduce the timeout using a file drop link, then inspect the Nextcloud and Nginx/PHP-FPM logs shown in the report. Done means the upload request returns before the server timeout, the uploaded file is no longer locked, and authenticated uploads remain working.