[Bug]: External Storage UI is broken: "wrong password" loop, JS toLowerCaseTypeError, andlazy AppConfig exception

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When attempting to add or save any external storage configuration, the admin UI incorrectly reports "wrong password". On a second attempt, the password dialog hangs indefinitely on "Checking password...". This appears to be caused by a fatal JavaScript TypeError in the app's frontend (Cannot read properties of undefined (reading 'toLowerCase')), which crashes the UI. This is correlated with a 422 Unprocessable Entity network error and a RuntimeException in the server logs, making it impossible to manage external storage via the web interface.

Steps to reproduce

1. On a fresh, up-to-date Nextcloud instance (32.0.0.13), ensure the "External storage support" (files_external) app is enabled.

2. Navigate to Administration settings > External storage.

3. Attempt to add any new storage (e.g., Local or SMB) or modify an existing one.

4. Click the checkmark icon to save the configuration.

5. A "Confirm password" dialog appears as expected.

6. Enter the correct administrator password and press Enter or click Confirm.

Expected behavior

The settings should be saved, or a valid error message (e.g., "Connection failed") should be displayed.

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "nc.atglabshq.com"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "32.0.0.13",
        "overwrite.cli.url": "http:\/\/localhost",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0
        },
        "filelocking.enabled": true,
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "log_type": "file",
        "logfile": "\/var\/www\/nextcloud-data\/nextcloud.log",
        "loglevel": 0,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "theme": "",
        "updater.secret": "***REMOVED SENSITIVE VALUE***",
        "maintenance_window_start": 3,
        "default_phone_region": "US",
        "memories.db.triggers.fcu": true,
        "memories.exiftool": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/exiftool-amd64-glibc",
        "memories.vod.path": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/go-vod-amd64",
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
        "enabledPreviewProviders": [
            "OC\\Preview\\Image",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\TIFF",
            "OC\\Preview\\Movie"
        ],
        "memories.gis_type": 1,
        "app_install_overwrite": []
    }
}

List of activated Apps

Enabled:
  - activity: 5.0.0-dev.0
  - admin_audit: 1.22.0
  - announcementcenter: 7.2.2
  - bruteforcesettings: 5.0.0-dev.0
  - calendar: 6.0.2
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contacts: 8.0.4
  - contactsinteraction: 1.13.1
  - cookbook: 0.11.4
  - dashboard: 7.12.0
  - dav: 1.34.2
  - deck: 1.16.0
  - event_update_notification: 2.7.0
  - external: 7.0.0
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_external: 1.24.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.0
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0-dev.0
  - forms: 5.2.2
  - google_synchronization: 4.0.1
  - groupfolders: 20.1.2
  - integration_giphy: 2.1.0
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - mail: 5.5.11
  - memories: 7.7.0
  - music: 2.4.1
  - news: 27.0.1
  - nextcloud_announcements: 4.0.0-dev.0
  - notes: 4.12.3
  - notifications: 5.0.0-dev.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - previewgenerator: 5.10.0
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recognize: 10.0.4
  - recommendations: 5.0.0-dev.0
  - related_resources: 3.0.0-dev.0
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - support: 4.0.0-dev.0
  - survey_client: 4.0.0-dev.0
  - suspicious_login: 10.0.0-dev.0
  - systemtags: 1.22.0
  - tables: 1.0.0
  - text: 6.0.0-dev.0
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - viewer: 5.0.0-dev.0
  - weather_status: 1.12.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - app_api: 32.0.0 (installed 32.0.0)
  - breezedark: 29.0.0 (installed 29.0.0)
  - encryption: 2.20.0
  - onlyoffice: 9.11.0 (installed 9.11.0)
  - spreed: 22.0.0 (installed 22.0.0)
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - twofactor_totp: 14.0.0
  - user_ldap: 1.23.0
  - whiteboard: 1.3.0 (installed 1.3.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{
  "reqId": "aPlEGK9SFzyPYS_GE9hlsgAAAAE",
  "level": 0,
  "time": "2025-10-22T20:52:40+00:00",
  "remoteAddr": "192.168.0.55",
  "user": "admin",
  "app": "files_external",
  "method": "PUT",
  "url": "/index.php/apps/logreader/api/settings",
  "message": "The loading of lazy AppConfig values have been triggered by app \"files_external\"",
  "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36",
  "version": "32.0.0.13",
  "exception": {
    "Exception": "RuntimeException",
    "Message": "The loading of lazy AppConfig values have been triggered by app \"files_external\"",
    "Code": 0,
    "Trace": "[...]",
    "File": "/var/www/nextcloud/lib/private/AppConfig.php",
    "Line": 1326
  },
  "message": "The loading of lazy AppConfig values have been triggered by app \"files_external\"",
  "exception": [],
  "CustomMessage": "The loading of lazy AppConfig values have been triggered by app \"files_external\""
}

Additional info

Actual behavior

The UI becomes completely unusable due to a cascade of errors:

1. On the first save attempt, the UI incorrectly reports "wrong password".

2. On the second save attempt, the dialog hangs indefinitely on "Checking password...".

3. The browser console shows a fatal JavaScript error, which appears to crash the page's scripts.

4. The browser's network tab shows the server is rejecting the request with a 422 Unprocessable Entity error.

5. The Nextcloud server log shows a RuntimeException, indicating the files_external app is trying to load its configuration too early in the boot process.

This combination of errors makes it impossible to add, modify, or manage any external storage mounts via the web interface.

Server configuration

Nextcloud version: 32.0.0.13 (from logs)

Client configuration

Browser: Chrome/141.0.0.0 (from logs) Operating system: Linux (from logs)

Logs

1. Browser Console (JavaScript Error)

This error appears immediately and seems to be the root cause of the UI hang.

Uncaught TypeError: Cannot read properties of undefined (reading 'toLowerCase') at l (index.mjs:53:22) at x (index.mjs:59:14) at index.mjs:472:9

2. Browser Network Log

This is the server's response to the failing request from the broken script.

Failed to load resource: the server responded with a status of 422 () URL: /index.php/apps/files_external/globalstorages/2

3. Nextcloud Log (Level 0 - Debug/Runtime Exception)

This server-side exception is the "smoking gun." It shows the app is fundamentally misbehaving at a core level.

{ "reqId": "aPlEGK9SFzyPYS_GE9hlsgAAAAE", "level": 0, "time": "2025-10-22T20:52:40+00:00", "remoteAddr": "192.168.0.55", "user": "admin", "app": "files_external", "method": "PUT", "url": "/index.php/apps/logreader/api/settings", "message": "The loading of lazy AppConfig values have been triggered by app \"files_external\"", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36", "version": "32.0.0.13", "exception": { "Exception": "RuntimeException", "Message": "The loading of lazy AppConfig values have been triggered by app \"files_external\"", "Code": 0, "Trace": "[...]", "File": "/var/www/nextcloud/lib/private/AppConfig.php", "Line": 1326 }, "message": "The loading of lazy AppConfig values have been triggered by app \"files_external\"", "exception": [], "CustomMessage": "The loading of lazy AppConfig values have been triggered by app \"files_external\"" }

4. Nextcloud Log (Debug - Deprecation Warnings)

These logs provide context, showing the app is using outdated annotations.

OCA\External\Controller\IconController uses the @NoCSRFRequired annotation and should use the #[OCP\AppFramework\Http\Attribute\NoCSRFRequired] attribute instead OCA\External\Controller\IconController uses the @NoAdminRequired annotation and should use the #[OCP\AppFramework\Http\Attribute\NoAdminRequired] attribute instead

Reproduce the Administration settings > External storage save flow, then inspect the frontend stack in index.mjs, the files_external request to /globalstorages/2, and lib/private/AppConfig.php at line 1326. Done means external storage configurations can be added or modified without the wrong-password loop, JavaScript TypeError, 422 response, or RuntimeException.