nextcloud / nextcloud/server

[Bug]: Default share creation rate limit breaks typical human usage, e.g. in 429 in Talk app

Open
#57,665 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage 31-feedback bug
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

⚠️ This issue respects the following points: ⚠️
Bug description

Typical usage creates 429 errors in Talk app, e.g. after sending 20 chat messages with attachments, no further such messages can be sent.
The bug in the app is merely the misleading "You are not allowed to share files" message displayed. The root of the problem appears to be in core - the default rate limits being too low, by about a factor of 10.

See #50905 (backports: v30 #52205 v31 #52206)

Steps to reproduce
  1. Enter Room in Nextcloud Talk
  2. Send a message with 20 image attachments
  3. Send another attachment within 10 minutes
  4. Observe (unclear) error
Expected behavior

Sending another message should work. Typical human interaction via the web interface should not be hampered by mitigations against misuse or broken apps.

Nextcloud Server version
  • actually reproduced on: 31.0.13
  • earliest v31 that has blamed patch: v31.0.4
  • earliest v30 that has blamed patch: v30.0.10
What user-backends are you using?
  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other
Additional info

Note that in the example of the Talk app occurs after the expensive PUT has been processed.
Its only later when cheaply POSTing the image to the Chatroom that the rate limit kicks in.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the related issue #50905 and the core share-creation rate-limit changes for the affected Nextcloud versions. Reproduce the Talk flow by sending 20 image attachments, then another within 10 minutes, and compare the rate-limit behavior before and after the expensive PUT. Done means typical attachment sharing succeeds without a 429 while the misuse mitigation remains effective.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.