[Bug]: Default share creation rate limit breaks typical human usage, e.g. in 429 in Talk app
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
⚠️ This issue respects the following points: ⚠️
- This is a bug, not a question or a configuration/webserver/proxy issue.
- This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
- Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
- I agree to follow Nextcloud's Code of Conduct.
Bug description
Typical usage creates 429 errors in Talk app, e.g. after sending 20 chat messages with attachments, no further such messages can be sent.
The bug in the app is merely the misleading "You are not allowed to share files" message displayed. The root of the problem appears to be in core - the default rate limits being too low, by about a factor of 10.
See #50905 (backports: v30 #52205 v31 #52206)
Steps to reproduce
- Enter Room in Nextcloud Talk
- Send a message with 20 image attachments
- Send another attachment within 10 minutes
- Observe (unclear) error
Expected behavior
Sending another message should work. Typical human interaction via the web interface should not be hampered by mitigations against misuse or broken apps.
Nextcloud Server version
- actually reproduced on: 31.0.13
- earliest v31 that has blamed patch: v31.0.4
- earliest v30 that has blamed patch: v30.0.10
What user-backends are you using?
- Default user-backend (database)
- LDAP/ Active Directory
- SSO - SAML
- Other
Additional info
Note that in the example of the Talk app occurs after the expensive PUT has been processed.
Its only later when cheaply POSTing the image to the Chatroom that the rate limit kicks in.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the related issue #50905 and the core share-creation rate-limit changes for the affected Nextcloud versions. Reproduce the Talk flow by sending 20 image attachments, then another within 10 minutes, and compare the rate-limit behavior before and after the expensive PUT. Done means typical attachment sharing succeeds without a 429 while the misuse mitigation remains effective.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100