[Bug]: When deleting a group with characters "&" breaking Nextcloud!

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

If I delete a group with an "&" character, I get an "Internal Server" error. Nextcloud can no longer be used or repaired. The group with an "&" character must have existed for some time. A new group containing the "&" character will not generate an error.

Steps to reproduce

1. Upgrade from 30.0.6 to 30.0.8
2. There is a group called "PM&E".
3. Delete this group.
4. Refresh the Site and you get an "Internal Server Error".

Expected behavior

No errors

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Delete the group:

{"reqId":"i7U7ndKbOAjjy8vV9Zw0","level":0,"time":"2025-03-26T17:15:42+00:00","remoteAddr":"185.xxx.xxxx.xxxx","user":"nc-user","app":"no app in context","method":"DELETE","url":"/ocs/v2.php/cloud/groups/PM%2526E","message":"dirty table reads: SELECT `j`.`single_id`, `j`.`circle_id`, `j`.`level`, `j`.`inheritance_first`, `j`.`inheritance_last`, `j`.`inheritance_path`, `j`.`inheritance_depth`, `j_k`.`config` AS `circle_config` FROM `*PREFIX*circles_membership` `j` LEFT JOIN `*PREFIX*circles_circle` `j_k` ON `j`.`circle_id` = `j_k`.`unique_id` WHERE `j`.`single_id` = :dcValue1","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"30.0.8.1","exception":{"Exception":"Exception","Message":"dirty table reads: SELECT `j`.`single_id`, `j`.`circle_id`, `j`.`level`, `j`.`inheritance_first`, `j`.`inheritance_last`, `j`.`inheritance_path`, `j`.`inheritance_depth`, `j_k`.`config` AS `circle_config` FROM `*PREFIX*circles_membership` `j` LEFT JOIN `*PREFIX*circles_circle` `j_k` ON `j`.`circle_id` = `j_k`.`unique_id` WHERE `j`.`single_id` = :dcValue1","Code":0,"Trace":[{"file":"/var/customers/webs/web2/nextcloud/lib/private/DB/ConnectionAdapter.php","line":50,"function":"executeQuery","class":"OC\\DB\\Connection","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","line":289,"function":"executeQuery","class":"OC\\DB\\ConnectionAdapter","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","line":266,"function":"executeQuery","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/circles/lib/Tools/Db/ExtendedQueryBuilder.php","line":1031,"function":"execute","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/circles/lib/Tools/Db/ExtendedQueryBuilder.php","line":927,"function":"getRows","class":"OCA\\Circles\\Tools\\Db\\ExtendedQueryBuilder","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/circles/lib/Db/MembershipRequestBuilder.php","line":98,"function":"asItems","class":"OCA\\Circles\\Tools\\Db\\ExtendedQueryBuilder","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/circles/lib/Db/MembershipRequest.php","line":93,"function":"getItemsFromRequest","class":"OCA\\Circles\\Db\\MembershipRequestBuilder","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/circles/lib/Service/MembershipService.php","line":220,"function":"getMemberships","class":"OCA\\Circles\\Db\\MembershipRequest","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/circles/lib/Service/MembershipService.php","line":121,"function":"updateMembershipsDatabase","class":"OCA\\Circles\\Service\\MembershipService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/customers/webs/web2/nextcloud/apps/circles/lib/Service/MembershipService.php","line":107,"function":"manageMemberships","class":"OCA\\Circles\\Service\\MembershipService","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/circles/lib/Service/SyncService.php","line":379,"function":"onUpdate","class":"OCA\\Circles\\Service\\MembershipService","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/circles/lib/Listeners/GroupDeleted.php","line":42,"function":"groupDeleted","class":"OCA\\Circles\\Service\\SyncService","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php","line":68,"function":"handle","class":"OCA\\Circles\\Listeners\\GroupDeleted","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":220,"function":"__invoke","class":"OC\\EventDispatcher\\ServiceEventListener","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":56,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":67,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":79,"function":"dispatch","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Group/Group.php","line":324,"function":"dispatchTyped","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/provisioning_api/lib/Controller/GroupsController.php","line":314,"function":"delete","class":"OC\\Group\\Group","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":208,"function":"deleteGroup","class":"OCA\\Provisioning_API\\Controller\\GroupsController","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":114,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/AppFramework/App.php","line":161,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Route/Router.php","line":303,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/customers/webs/web2/nextcloud/ocs/v1.php","line":43,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/ocs/v2.php","line":7,"args":["/var/customers/webs/web2/nextcloud/ocs/v1.php"],"function":"require_once"}],"File":"/var/customers/webs/web2/nextcloud/lib/private/DB/Connection.php","Line":402,"message":"dirty table reads: SELECT `j`.`single_id`, `j`.`circle_id`, `j`.`level`, `j`.`inheritance_first`, `j`.`inheritance_last`, `j`.`inheritance_path`, `j`.`inheritance_depth`, `j_k`.`config` AS `circle_config` FROM `*PREFIX*circles_membership` `j` LEFT JOIN `*PREFIX*circles_circle` `j_k` ON `j`.`circle_id` = `j_k`.`unique_id` WHERE `j`.`single_id` = :dcValue1","tables":["oc_authtoken","oc_collres_accesscache","oc_groups","oc_group_user","oc_group_admin","oc_calresources_restricts","oc_circles_circle","oc_circles_member","oc_circles_membership"],"reads":["oc_circles_membership","oc_circles_circle"],"exception":{},"CustomMessage":"dirty table reads: SELECT `j`.`single_id`, `j`.`circle_id`, `j`.`level`, `j`.`inheritance_first`, `j`.`inheritance_last`, `j`.`inheritance_path`, `j`.`inheritance_depth`, `j_k`.`config` AS `circle_config` FROM `*PREFIX*circles_membership` `j` LEFT JOIN `*PREFIX*circles_circle` `j_k` ON `j`.`circle_id` = `j_k`.`unique_id` WHERE `j`.`single_id` = :dcValue1"}}


Internal Server error:

{"reqId":"2bXxwhq3WDyMmmJNOxei","level":3,"time":"2025-03-26T16:11:41+00:00","remoteAddr":"185.xxx.xxx.xxx","user":"nc-user","app":"index","method":"GET","url":"/index.php/apps/files/preview-service-worker.js","message":"array_diff(): Argument #2 must be of type array, stdClass given","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"30.0.8.1","exception":{"Exception":"TypeError","Message":"array_diff(): Argument #2 must be of type array, stdClass given","Code":0,"Trace":[{"file":"/var/customers/webs/web2/nextcloud/lib/private/Share20/ShareDisableChecker.php","line":59,"function":"array_diff"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Files/SetupManager.php","line":119,"function":"sharingDisabledForUser","class":"OC\\Share20\\ShareDisableChecker","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Files/SetupManager.php","line":327,"function":"setupBuiltinWrappers","class":"OC\\Files\\SetupManager","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Files/SetupManager.php","line":371,"function":"setupRoot","class":"OC\\Files\\SetupManager","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Files/Mount/Manager.php","line":75,"function":"setupForPath","class":"OC\\Files\\SetupManager","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Files/View.php","line":1417,"function":"find","class":"OC\\Files\\Mount\\Manager","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Files/Node/Root.php","line":183,"function":"getFileInfo","class":"OC\\Files\\View","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Files/Node/LazyFolder.php","line":141,"function":"get","class":"OC\\Files\\Node\\Root","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Files/AppData/AppData.php","line":114,"function":"get","class":"OC\\Files\\Node\\LazyFolder","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/richdocuments/lib/Service/CachedRequestService.php","line":109,"function":"getFolder","class":"OC\\Files\\AppData\\AppData","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/richdocuments/lib/Service/CachedRequestService.php","line":45,"function":"getAppDataFolder","class":"OCA\\Richdocuments\\Service\\CachedRequestService","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/richdocuments/lib/Service/CapabilitiesService.php","line":137,"function":"get","class":"OCA\\Richdocuments\\Service\\CachedRequestService","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/richdocuments/lib/Service/CapabilitiesService.php","line":46,"function":"getParsedCapabilities","class":"OCA\\Richdocuments\\Service\\CapabilitiesService","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/richdocuments/lib/Service/CapabilitiesService.php","line":85,"function":"getCapabilities","class":"OCA\\Richdocuments\\Service\\CapabilitiesService","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/apps/richdocuments/lib/Listener/AddContentSecurityPolicyListener.php","line":40,"function":"hasWASMSupport","class":"OCA\\Richdocuments\\Service\\CapabilitiesService","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php","line":68,"function":"handle","class":"OCA\\Richdocuments\\Listener\\AddContentSecurityPolicyListener","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":220,"function":"__invoke","class":"OC\\EventDispatcher\\ServiceEventListener","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":56,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":67,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":79,"function":"dispatch","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Security/CSP/ContentSecurityPolicyManager.php","line":38,"function":"dispatchTyped","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/AppFramework/Middleware/Security/CSPMiddleware.php","line":52,"function":"getDefaultPolicy","class":"OC\\Security\\CSP\\ContentSecurityPolicyManager","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php","line":119,"function":"afterController","class":"OC\\AppFramework\\Middleware\\Security\\CSPMiddleware","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":151,"function":"afterController","class":"OC\\AppFramework\\Middleware\\MiddlewareDispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/AppFramework/App.php","line":161,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/lib/private/Route/Router.php","line":303,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/customers/webs/web2/nextcloud/lib/base.php","line":1010,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/customers/webs/web2/nextcloud/index.php","line":24,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/customers/webs/web2/nextcloud/lib/private/Share20/ShareDisableChecker.php","Line":59,"message":"array_diff(): Argument #2 must be of type array, stdClass given","exception":{},"CustomMessage":"array_diff(): Argument #2 must be of type array, stdClass given"}}

Additional info

No response

Start with apps/circles/lib/Listeners/GroupDeleted.php and the related MembershipService and SyncService calls shown in the trace; compare them with the failing query in ExtendedQueryBuilder.php. Also inspect lib/private/Share20/ShareDisableChecker.php for the later array_diff() error. Done means deleting the existing PM&E group no longer produces an internal-server error and the site remains usable.