.htaccess whitelist missing .json/.ftl → files_pdfviewer locale 404s, PDF viewer stuck in English
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
Bug description
The .htaccess template generated by occ maintenance:update:htaccess
does not allow direct Apache delivery of .json (and .ftl) files.
This breaks locale loading for files_pdfviewer's bundled PDF.js, because
requests for apps/files_pdfviewer/js/pdfjs/web/l10n/locale.json (or the
equivalent locale path, depending on PDF.js version) are routed through
index.php instead of being served as a static file, and return 404.
As a result, the PDF viewer UI always falls back to English, regardless
of the instance's configured language.
This appears to be a template/whitelist gap rather than a config error:
occ maintenance:update:htaccess regenerates the exact same
RewriteCond endings list on every run, so the missing .json/.ftl
extensions are the current shipped default, not a one-off mistake in a
specific install.
Related reports (symptom only, root cause not previously identified):
- https://github.com/nextcloud/files_pdfviewer/issues/1191
- https://github.com/nextcloud/files_pdfviewer/issues/89
- https://github.com/nextcloud/files_pdfviewer/issues/139
Steps to reproduce
- Fresh or updated Nextcloud instance running on Apache with the
auto-generated.htaccess. - Open any PDF via the Files app (content of the PDF is irrelevant —
reproduces even with a 2-line plain-text PDF). - Open browser DevTools → Network tab.
- Observe a 404 request to
apps/files_pdfviewer/js/pdfjs/web/l10n/locale.json?v=<version>
(or the corresponding locale path for the bundled PDF.js version). - Response body is Nextcloud's own "page not found" HTML — confirms
the request is routed throughindex.php, not served statically. - Confirm root cause:
sudo -u www-data php occ maintenance:update:htaccess, then diff the file — the
RewriteCond %{REQUEST_FILENAME} !\.(css|js|mjs|svg|gif|ico|jpg| jpeg|png|webp|html|otf|ttf|woff2?|map|webm|mp4|mp3|ogg|wav|flac| wasm|tflite)$line is regenerated identically, i.e..json/.ftl
are simply not in the extension whitelist.
Expected behavior
The PDF viewer UI is displayed in the instance's configured language;
locale files for bundled apps like files_pdfviewer are served directly
by Apache (200) instead of falling through to index.php (404).
Actual behavior
Locale file request 404s via index.php; viewer UI always falls back
to English.
Workaround currently in use
Manually adding an extra RewriteCond exception for the pdfjs locale
path in .htaccess, e.g.:
RewriteCond %{REQUEST_FILENAME} !/apps/files_pdfviewer/js/pdfjs/web/locale/
This is lost on every occ maintenance:update:htaccess run / every
Nextcloud update and must be re-applied manually.
Suggested fix
Add .json and .ftl (or a files_pdfviewer-specific path exception)
to the extension whitelist in the .htaccess template generated by
occ maintenance:update:htaccess, or provide a mechanism for
bundled/first-party apps to register additional static-asset
exceptions in that template.
Environment
- Nextcloud Server version: 34.0.3
- files_pdfviewer version: 7.0.0-dev.0
- PDF.js version (bundled): 4.10.38
- Web server: Apache 2.4, ISPConfig-managed vhost,
.htaccess-based rewriting - OS: Ubuntu 24.04
- Browser: Chrome (reproduces regardless of browser, per the response body test)
- Is this bug present after an update or on a fresh install? Reproducible after
occ maintenance:update:htaccessregeneration — appears to be present in shipped default template, not update-specific
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the code that generates the .htaccess file for occ maintenance:update:htaccess, then find the RewriteCond extension whitelist described in the issue. Reproduce the generation command and inspect the generated rule. Done means the relevant locale request is served by Apache with HTTP 200 instead of routed to index.php and returning 404.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- apache, php
- Domain
- backend, infrastructure
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100