nextcloud / nextcloud/server

[Bug]: Workflowengine don't follow the rules with app files_accesscontrol and workflow_script together

Open
#59,994 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage 32-feedback bug feature: workflows
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

⚠️ This issue respects the following points: ⚠️
Bug description

We have some flow rules, one of them is a rule using the app files_accesscontrol to block access to a file with a tag name "LOCK", the rule is:
When "File is accessed" and "File system tag" "is tagged with" "LOCK " -> then Block access to a file.

And we have others flow rules create with app workflow_script to execute a script when a tag is assigned by app aproval, an example of the rule is:
When "Tag assigned" and "File system tag" "is tagged with" "APROVE - DOC" -> then Run script bash to send email.

If the flow rule of app files_accesscontrol is actived, the other rules is not analyse and the job class "OCA\WorkflowScript\BackgroundJobs\Launcher" is not insert to table "oc_jobs".
If the flow rule of app files_accesscontrol is disabled, the system analyse the other rules of app workflow_script and the job is add correctly into table "oc_jobs".

Flow example with app files_accesscontrol:
Image

Flow example with app workflow_script:
Image

Steps to reproduce
  1. Create a flow with app files_accesscontrol that block access to a file with some tag;
  2. Create a flow with app workflow_script that run script when a tag is assigned to a file;
  3. the job class "OCA\WorkflowScript\BackgroundJobs\Launcher" is not insert to table "oc_jobs";
Expected behavior

We expected that the all flow rules will be analysed by the system.

Nextcloud Server version

32

Operating system

RHEL/CentOS

PHP engine version

PHP 8.4

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?
  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other
Configuration report
{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nextcloud.almg.gov.br"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "32.0.6.1",
        "overwrite.cli.url": "https:\/\/nextcloud.almg.gov.br",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "default_language": "pt_BR",
        "default_locale": "pt_BR",
        "default_phone_region": "BR",
        "skeletondirectory": "",
        "defaultapp": "dashboard,files",
        "lookup_server": "",
        "login_form_autocomplete": false,
        "lost_password_link": "disabled",
        "auth.webauthn.enabled": false,
        "quota_include_external_storage": false,
        "enable_previews": true,
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "trashbin_retention_obligation": "7, 8",
        "versions_retention_obligation": "30, auto",
        "tempdirectory": "\/data\/tmp",
        "logtimezone": "America\/Sao_Paulo",
        "log_type": "file",
        "logfile": "",
        "loglevel": 2,
        "syslog_tag": "Nextcloud",
        "logdateformat": "Y-m-d H:i:s",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "mail_sendmailmode": "smtp",
        "maintenance": false,
        "app_install_overwrite": [
            "impersonate",
            "issuetemplate",
            "files_scripts",
            "mailnotifier"
        ]
    }
}
List of activated Apps
Enabled:
  - activity: 5.0.0
  - app_api: 32.0.0
  - approval: 2.8.0
  - bruteforcesettings: 5.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - dav: 1.34.2
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_accesscontrol: 3.0.2
  - files_automatedtagging: 3.0.3
  - files_downloadlimit: 5.0.0-dev.0
  - files_external: 1.24.1
  - files_pdfviewer: 5.0.0
  - files_reminders: 1.5.0
  - files_scripts: 4.1.0
  - files_sharing: 1.24.1
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - flow_notifications: 3.0.0
  - group_everyone: 0.1.19
  - impersonate: 3.0.1
  - logreader: 5.0.0
  - lookup_server_connector: 1.20.0
  - notifications: 5.0.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0
  - privacy: 4.0.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0
  - related_resources: 3.0.0
  - richdocuments: 9.0.5
  - serverinfo: 4.0.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - support: 4.0.0
  - survey_client: 4.0.0
  - systemtags: 1.22.0
  - text: 6.0.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - updatenotification: 1.22.0
  - user_ldap: 1.23.0
  - user_status: 1.12.0
  - viewer: 5.0.0
  - webhook_listeners: 1.3.0
  - workflow_pdf_converter: 3.0.0
  - workflow_script: 3.0.0
  - workflowengine: 2.14.0
Disabled:
  - admin_audit: 1.22.0
  - circles: 32.0.0 (installed 25.0.0)
  - contactsinteraction: 1.13.1 (installed 1.6.0)
  - dashboard: 7.12.0 (installed 7.5.0)
  - encryption: 2.20.0
  - firstrunwizard: 5.0.0 (installed 2.14.0)
  - mailnotifier: 0.0.3 (installed 0.0.3)
  - nextcloud_announcements: 4.0.0 (installed 1.14.0)
  - photos: 5.0.0 (installed 2.0.1)
  - suspicious_login: 10.0.0
  - twofactor_nextcloud_notification: 6.0.0
  - twofactor_totp: 14.0.0
  - weather_status: 1.12.0 (installed 1.5.0)
Nextcloud Signing status
Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.

Results
=======
- core
	- INVALID_HASH
		- core/templates/layout.guest.php
		- lib/private/Files/Storage/Wrapper/Quota.php
		- lib/private/legacy/OC_Defaults.php
- files_trashbin
	- INVALID_HASH
		- lib/Trashbin.php
- activity
	- INVALID_HASH
		- lib/MailQueueHandler.php

Raw output
==========
Array
(
    [core] => Array
        (
            [INVALID_HASH] => Array
                (
                    [core/templates/layout.guest.php] => Array
                        (
                            [expected] => 9e05da01c96d71b4d75609b6dafab3d8b570e7c678bd9eb404fcc84c39bb503154f669cfba467c0fbd86d72af52416fbc79a23bacc5152c96670feb883ed5458
                            [current] => ab03c6c91126abff9a60457b6e4e5c0d4e04852583ffa9d774d81eb85895140a0a9a1f5a9a5e4520bba65a271345888995a7bc132728247ac2cf0605e5acd616
                        )

                    [lib/private/Files/Storage/Wrapper/Quota.php] => Array
                        (
                            [expected] => 248b7a08954ae58b961abd9a4e67d7e1a9f024a5ccded149c6443bb1c58505c0dfae4c60db78b057183df5f7fc7449b3d16b1185724abec95875ccfd866aea5d
                            [current] => 2da414816de6d016ba77de529f3291dcbbe32e1c64549a7a70911fbf4a7e6d171bb44458f66b335dcef65bf400c0678735c26a7d451135be9cc6a821a8c67fa1
                        )

                    [lib/private/legacy/OC_Defaults.php] => Array
                        (
                            [expected] => bda9bdae273b2a5f0792d71a5b459f482454eab60d3b429f71dcae1daa85d15b22570949d81debf5201832d6b054b21e92bbd68c92344adf83f13568da88da35
                            [current] => e8dff503ffea7fe03523dfd9a84d3b595533397398168dc8951b084a08a7f770aae133102b9c20d06b063452c46dcea038d6b4774998913a72e472e12cf0f6af
                        )

                )

        )

    [files_trashbin] => Array
        (
            [INVALID_HASH] => Array
                (
                    [lib/Trashbin.php] => Array
                        (
                            [expected] => 3d0ff8b7fad8f6d34350aede0ec30da7ba50473e974be30fe08424279781f9ccc2d68f9c6d9aadeece1ac70d745e716cda3b91563f71455b85378940427fbc30
                            [current] => c1b1cca5b6d3257c454bde3eb72a664f6c4019f206008dd9f7178330a83ada29ef463ae0d0bdc03999f688efa4a45017cc9bd46abac12ab68e60029965672146
                        )

                )

        )

    [activity] => Array
        (
            [INVALID_HASH] => Array
                (
                    [lib/MailQueueHandler.php] => Array
                        (
                            [expected] => 42c6cfa1600a56f6062bd9406d74eaf3e9ab8052b161569cfd8bac2b68d89a956f4ff7a960201844c5e37664c36860a1a9f539bba7d9d9b1e70c393c0bfa7c82
                            [current] => bd36e4ebfe837270d38d49720f7d73ca046b50d34635a890e9e8709b9895e54d971d94ca6e88e84b69348a1254ff571171f6f3df4c64090bdbeee79797bab426
                        )

                )

        )

)
Nextcloud Logs

Additional info

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the two flows on Nextcloud Server 32 and inspect whether OCA\WorkflowScript\BackgroundJobs\Launcher is inserted into oc_jobs. Trace the workflow evaluation involving files_accesscontrol, workflow_script, and workflowengine, starting with that job class. Done means both rules are analysed, the launcher job is queued, and access blocking still works.

Written by the indexing model from the issue text.

Assessment

Tech stack
bash, mysql, php
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.