[Bug]: Movie preview generation affected by 5mb limit when using encryption

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I am using per user encryption and started having problem generating preview images for videos some time ago, it was working fine during the winter.

I am pretty sure i tracked it down to this commit.

Problem is isLocal() returns false for encryption.php

So i guess only first 5mb of video is decrypted, and it can fail to generate a preview.

I tried to manually edit Movie.php and reverted the commit above, and all previews started generating again.

But as a Java developer i feel i don't know the product nor php well enough to think up a good solution aka what is the intention of isLocal(), should it return true for encrypted local also, or is the intention something else so it should return false for encrypted local, and if so then the case in Movie.php maybe should use some other condition to check if the storage is not local, but encrypted local etc.

Steps to reproduce

1. Use encryption
2. Setup ffmpeg for movie preview
3. Upload a movie larger than 5mb with movie atom at the end
4. Preview is not generating and a info log is generated

Expected behavior

Movie is decrypted into temp and preview is generated. This was work during the winter.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

{"reqId":"cl3LhiXe8J3l9K26VFab","level":1,"time":"2025-09-04T06:42:13+00:00","remoteAddr":"-","user":"-","app":"core","method":"GET","url":"/core/preview?fileId=9956&x=32&y=32&mimeFallback=true&v=e287ac&a=0","message":"Movie preview generation failed Output: ffmpeg version n7.1.1-56-gc2184b65d2-20250806 Copyright (c) 2000-2025 the FFmpeg developers\n  built with gcc 15.1.0 (crosstool-NG 1.27.0.42_35c1e72)\n  configuration: --prefix=/ffbuild/prefix --pkg-config-flags=--static --pkg-config=pkg-config --cross-prefix=x86_64-ffbuild-linux-gnu- --arch=x86_64 --target-os=linux --enable-gpl --enable-version3 --disable-debug --enable-iconv --enable-zlib --enable-libfribidi --enable-gmp --enable-libxml2 --enable-openssl --enable-lzma --enable-fontconfig --enable-libharfbuzz --enable-libfreetype --enable-libvorbis --enable-opencl --enable-libpulse --enable-libvmaf --enable-libxcb --enable-xlib --enable-amf --enable-libaom --enable-libaribb24 --enable-avisynth --enable-chromaprint --enable-libdav1d --enable-libdavs2 --enable-libdvdread --enable-libdvdnav --disable-libfdk-aac --enable-ffnvcodec --enable-cuda-llvm --enable-frei0r --enable-libgme --enable-libkvazaar --enable-libaribcaption --enable-libass --enable-libbluray --enable-libjxl --enable-libmp3lame --enable-libopus --enable-librist --enable-libssh --enable-libtheora --enable-libvpx --enable-libwebp --enable-libzmq --enable-lv2 --enable-libvpl --enable-openal --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libopenh264 --enable-libopenjpeg --enable-libopenmpt --enable-librav1e --enable-librubberband --disable-schannel --enable-sdl2 --enable-libsnappy --enable-libsoxr --enable-libsrt --enable-libsvtav1 --enable-libtwolame --enable-libuavs3d --enable-libdrm --enable-vaapi --enable-libvidstab --enable-vulkan --enable-libshaderc --enable-libplacebo --enable-libvvenc --enable-libx264 --enable-libx265 --enable-libxavs2 --enable-libxvid --enable-libzimg --enable-libzvbi --extra-cflags=-DLIBTWOLAME_STATIC --extra-cxxflags= --extra-libs='-ldl -lgomp' --extra-ldflags=-pthread --extra-ldexeflags=-pie --cc=x86_64-ffbuild-linux-gnu-gcc --cxx=x86_64-ffbuild-linux-gnu-g++ --ar=x86_64-ffbuild-linux-gnu-gcc-ar --ranlib=x86_64-ffbuild-linux-gnu-gcc-ranlib --nm=x86_64-ffbuild-linux-gnu-gcc-nm --extra-version=20250806\n  libavutil      59. 39.100 / 59. 39.100\n  libavcodec     61. 19.101 / 61. 19.101\n  libavformat    61.  7.100 / 61.  7.100\n  libavdevice    61.  3.100 / 61.  3.100\n  libavfilter    10.  4.100 / 10.  4.100\n  libswscale      8.  3.100 /  8.  3.100\n  libswresample   5.  3.100 /  5.  3.100\n  libpostproc    58.  3.100 / 58.  3.100\n[mov,mp4,m4a,3gp,3g2,mj2 @ 0x56021fa5f640] moov atom not found\n[in#0 @ 0x56021fa5f380] Error opening input: Invalid data found when processing input\nError opening input file /tmp/oc_tmp_VEhFWenNyS5phNQBZCeyO1OzKnaF74w1.\nError opening input files: Invalid data found when processing input","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","version":"31.0.8.1","data":{"app":"core"},"id":"68b94954bd429"}

Additional info

No response

The relevant entry points are Movie.php and lib/private/Files/Storage/Wrapper/Encryption.php, especially isLocal() and the linked commit 4a924bf400c7015bb337188fc14e1a0cb77a8d0a. Start by tracing how encrypted local storage is handled when Movie.php creates the temporary input for ffmpeg. Done means a movie over 5 MB with its moov atom at the end produces a preview under per-user encryption.