[Bug]: PDF viewer broken due to .json and .ftl rewrite rules

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

After updating to Nextcloud 34.0.3, the integrated PDF viewer is broken when Nextcloud is served using Apache.

PDF.js locale resources such as locale.json and viewer.ftl exist on the filesystem but return HTTP 404 when requested through Apache.

The requests are rewritten to Nextcloud's index.php front controller because .json and .ftl are missing from the static file extension exclusion in .htaccess.

As a result, PDF.js fails to initialize correctly and displays the Alt Text dialog instead of the PDF.

The relevant rule currently is:

RewriteCond %{REQUEST_FILENAME} !\.(css|js|mjs|svg|gif|ico|jpg|jpeg|png|webp|html|otf|ttf|woff2?|map|webm|mp4|mp3|ogg|wav|flac|wasm|tflite)$

Adding json|ftl to this rule immediately fixes the issue:

RewriteCond %{REQUEST_FILENAME} !\.(css|js|mjs|json|ftl|svg|gif|ico|jpg|jpeg|png|webp|html|otf|ttf|woff2?|map|webm|mp4|mp3|ogg|wav|flac|wasm|tflite)$

After this change, the PDF.js locale resources return HTTP 200 and the PDF viewer works normally again.

Steps to reproduce

1. Run Nextcloud 34.0.3 using Apache with the standard Nextcloud .htaccess configuration.

2. Open a PDF using the integrated PDF viewer.

3. The PDF does not render correctly. Instead, the PDF.js Alt Text dialog is displayed.

4. Check the browser console. The following resource returns HTTP 404:

   /apps/files_pdfviewer/js/pdfjs/web/locale/locale.json?v=7.0.0-dev.0
   

5. Verify that the locale files exist on the filesystem:

   ls -l /var/www/nextcloud/apps/files_pdfviewer/js/pdfjs/web/locale/locale.json
   ls -l /var/www/nextcloud/apps/files_pdfviewer/js/pdfjs/web/locale/de/viewer.ftl
   

6. Request the resources directly through Apache:

   curl -I http://<nextcloud-server>/apps/files_pdfviewer/js/pdfjs/web/locale/locale.json
   curl -I http://<nextcloud-server>/apps/files_pdfviewer/js/pdfjs/web/locale/de/viewer.ftl
   

   Both requests return:

   HTTP/1.1 404 Not Found
   

   The response contains Nextcloud headers such as X-Request-Id, indicating that the request was handled by the Nextcloud front controller.

7. Add json|ftl to the static file exclusion in .htaccess:

   RewriteCond %{REQUEST_FILENAME} !\.(css|js|mjs|json|ftl|svg|gif|ico|jpg|jpeg|png|webp|html|otf|ttf|woff2?|map|webm|mp4|mp3|ogg|wav|flac|wasm|tflite)$
   

8. Repeat the curl requests. Both resources now return:

   HTTP/1.1 200 OK
   

9. Reload the PDF viewer. The PDF now renders normally.

Expected behavior

PDF.js locale resources bundled with files_pdfviewer, including .json and .ftl files, should be served directly by Apache instead of being rewritten to Nextcloud’s front controller.

Opening a PDF should load all required PDF.js resources successfully and display the PDF normally without requiring manual modifications to .htaccess.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "10.0.1.4",
            "10.0.3.5",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.3.2",
        "overwrite.cli.url": "https:\/\/cloud.mark-lukas-moeller.de",
        "overwriteprotocol": "https",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "maintenance": false,
        "theme": "",
        "loglevel": 2,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_smtpsecure": "ssl",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "knowledgebaseenabled": "false",
        "mysql.utf8mb4": true,
        "skeletondirectory": "",
        "updater.release.channel": "stable",
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "htaccess.RewriteBase": "\/",
        "maintenance_window_start": 2,
        "default_language": "de",
        "default_locale": "de_DE",
        "default_phone_region": "DE",
        "allow_user_to_change_display_name": true,
        "app_install_overwrite": [
            "onlyoffice",
            "documentserver_community",
            "dicomviewer"
        ],
        "filelocking.enabled": true,
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "user": "default",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0
        },
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "admin"
        ],
        "twofactor_enforced_excluded_groups": [],
        "serverid": 1,
        "updater.secret": "***REMOVED SENSITIVE VALUE***"
    }
}

List of activated Apps

Enabled:
  - activity: 7.0.0
  - admin_audit: 1.24.0
  - appstore: 1.0.0
  - bruteforcesettings: 7.0.0
  - calendar: 6.5.4
  - cloud_federation_api: 1.18.0
  - comments: 1.24.0
  - dashboard: 7.14.0
  - dav: 1.40.0
  - dicomviewer: 2.3.3
  - federatedfilesharing: 1.24.0
  - federation: 1.24.0
  - files: 2.6.0
  - files_accesscontrol: 5.0.0
  - files_antivirus: 6.4.0
  - files_downloadlimit: 5.2.0
  - files_lock: 34.0.1
  - files_pdfviewer: 7.0.0-dev.0
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - nextcloud_announcements: 6.0.0
  - notifications: 7.0.0-dev.1
  - oauth2: 1.22.0
  - office: 1.0.0
  - password_policy: 6.0.0-dev.0
  - photos: 7.0.0
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - related_resources: 5.0.0-dev.0
  - richdocuments: 11.1.0
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - text: 8.0.0
  - theming: 2.9.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_nextcloud_notification: 8.0.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - viewer: 7.0.0-dev.0
  - weather_status: 1.14.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0
Disabled:
  - app_api: 34.0.0 (installed 32.0.0)
  - circles: 34.0.0 (installed 28.0.0-dev)
  - contactsinteraction: 1.15.0 (installed 1.4.0)
  - encryption: 2.22.0
  - files_external: 1.26.0 (installed 1.20.0)
  - firstrunwizard: 7.0.0-dev.0 (installed 2.4.0)
  - privacy: 6.0.0-dev.1 (installed 1.3.0)
  - recommendations: 7.0.0 (installed 1.2.0)
  - support: 6.0.0 (installed 1.0.0)
  - survey_client: 6.0.0-dev.0 (installed 1.4.0)
  - suspicious_login: 12.0.0-dev.0
  - systemtags: 1.24.0 (installed 1.9.0)
  - user_ldap: 1.25.0 (installed 1.11.0)
  - user_status: 1.14.0 (installed 1.0.1)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

None Occurred

Additional info

No response

Start with the static-file exclusion rule in the standard .htaccess configuration and compare it with the extensions listed in the issue. Request the PDF.js locale.json and viewer.ftl resources through Apache with curl, then confirm both return HTTP 200 and the integrated PDF viewer renders normally without manual .htaccess changes.