Autoload path not allowed

[HolgerHees]

Since I update Nextcloud from Version 26.0.2 to Version 27.0.0 I get the following error message

Autoload path not allowed: /dataDisk/htdocs/nextcloud-27.0.0/apps/keeweb/controller/pagecontroller.php

Trace:
{
"file":"/dataDisk/htdocs/nextcloud-27.0.0/lib/autoloader.php",
"line":166,
"function":"isValidPath",
"class":"OC\Autoloader",
"type":"->"
},
{
"file":"/dataDisk/htdocs/nextcloud-27.0.0/apps/keeweb/appinfo/app.php",
"line":23,
"function":"load",
"class":"OC\Autoloader",
"type":"->"
},

has anyone an Idea how to fix?

for now I had to revert back to Version 26.0.2

[arnowelzel]

Nextcloud 27 removed the PSR-0 class loader. We need to upgrade the structure to PSR-4 or implement a custom class loader. Also see:

https://docs.nextcloud.com/server/latest/developer_manual/app_publishing_maintenance/app_upgrade_guide/upgrade_to_27.html

[saschabrockel]

I just want to contribute a full log:

[index] Fehler: OCP\AutoloadNotAllowedException: Autoload path not allowed: /var/www/html/custom_apps/keeweb/controller/pagecontroller.php at <<closure>>

 0. /var/www/html/lib/autoloader.php line 166
    OC\Autoloader->isValidPath("/var/www/html/c ... p")
 1. /var/www/html/custom_apps/keeweb/appinfo/app.php line 25
    OC\Autoloader->load("OCA\\Keeweb\\Controller\\PageController")
 2. /var/www/html/lib/private/AppFramework/Utility/SimpleContainer.php line 171
    OCA\Keeweb\AppInfo\Application->OCA\Keeweb\AppInfo\{closure}("*** sensitive parameters replaced ***")
 3. /var/www/html/3rdparty/pimple/pimple/src/Pimple/Container.php line 122
    OC\AppFramework\Utility\SimpleContainer->OC\AppFramework\Utility\{closure}("*** sensitive parameters replaced ***")
 4. /var/www/html/lib/private/AppFramework/Utility/SimpleContainer.php line 138
    Pimple\Container->offsetGet("PageController")
 5. /var/www/html/lib/private/AppFramework/DependencyInjection/DIContainer.php line 488
    OC\AppFramework\Utility\SimpleContainer->query("PageController")
 6. /var/www/html/lib/private/AppFramework/DependencyInjection/DIContainer.php line 466
    OC\AppFramework\DependencyInjection\DIContainer->queryNoFallback("PageController")
 7. /var/www/html/lib/private/AppFramework/Utility/SimpleContainer.php line 65
    OC\AppFramework\DependencyInjection\DIContainer->query("PageController")
 8. /var/www/html/lib/private/AppFramework/App.php line 148
    OC\AppFramework\Utility\SimpleContainer->get("PageController")
 9. /var/www/html/lib/private/Route/Router.php line 315
    OC\AppFramework\App::main("PageController", "index", "*** sensitive parameters replaced ***", ["keeweb.page.index"])
10. /var/www/html/lib/base.php line 1064
    OC\Route\Router->match("/apps/keeweb/")
11. /var/www/html/index.php line 36
    OC::handleRequest()

GET /apps/keeweb/?open=%2FPasswords.kdbx
from xxx.xx.x.xx by 9a84365c-8fa9-103d-820a-6d4e0dd12d6c at 2023-06-16T03:31:50+00:00

[arnowelzel]

The documentation does not really help to fix the problem.

If anyone knows how to do this - help is welcome.

[burned42]

I agree that the documentation alone is not that helpful for fixing this problem but I found https://help.nextcloud.com/t/breaking-removal-of-psr-0-class-loader-in-nextcloud-27/153916 on this topic and gave it a try, please see #222

[arnowelzel]

Unfortunately after merging #222 there is no error any longer but the app still does not work. It now looks as it will not even be loaded any longer.

[burned42]

That's interesting. I'm running the docker image nextcloud and after applying the changes from #222 and restarting the container keeweb is loading for me and I can open keepass dbs.

I also just set my loglevel in nextcloud config.php to 0 (debug) and I also don't see any errors from keeweb in the log. Any idea why it works for me but not for you?

[arnowelzel]

No, no idea at all. KeeWeb is just not used, eventhough it is active. And about logs: yes, you are right. Indeed the error messag is caused by the encryption app and not KeeWeb.

[arnowelzel]

My last comment was a mistake - since KeeWeb is not even used, it will of course not create any log message.

[arnowelzel]

It seems, removing appinfo/autoload.php will cause KeeWeb to stop working at all. Nextcloud will then not use it any longer as nothing is loaded at all.

[burned42]

Oh, that's unfortunate. I still don't understand why it works for me without the autoload file then, but I can take a look at this later and submit a follow-up PR to re-add the file. I just can't test if that will fix the issue for you if I don't know why it doesn't break for me at the moment :D

[burned42]

I took another look at the documentation and I didn't find any reference to an autoload.php, but I noticed that the app.php was explicitly mentioned and being deprecated and there's now a new concept that I tried applying in #223

[arnowelzel]

Thanks for your help. Now I get a new error...

Could not resolve OCA\Keeweb\Controller\PageController! Class "OCA\Keeweb\Controller\PageController" does not exist

I'll check what is going on.

[arnowelzel]

In addition the MIME type registration also does not work. When I click a kdbx file it will only be offered for download and not opend in Keeweb. Did you test it with NC27?

[burned42]

Yes, I am running latest nextcloud docker image, the admin overview reports version 27.0.0. I also explicitly checked if the js/viewer.js gets downloaded and clicking on a keepass db opens it in keepass for me. I'm a bit confused why it still doesn't work for you 🤔 If I could reproduce the issue, it'd probably be easier to fix it :D

[arnowelzel]

Well - I don't have a Docker version, just NC 27 installed manually with PHP-FPM 8.1 and Apache 2.4.

[arnowelzel]

Just to be sure I tested in again on a vanilla new setup of NC27 - fresh install with a new database. Same result: Keeweb will not be loaded. Now I don't get an error message but it still does not work. kdbx files will only be offered for download and clicking the Keeweb icon in the toolbar will only create a blank page.

[burned42]

Ok, now it gets really interesting. 🤯
I guess we had the same idea, because I also clicked a new server, set up a fresh nextcloud instance (also with a fresh DB) and keeweb still behaves as expected for me (it appears in the menu, clicking a kdbx file opens it in keeweb).
One thing I did notice however is that it wasn't working until I setup certbot to have https/ssl (not sure if that was keeweb's fault). So if you maybe don't have ssl on your instance then that might be worth taking a closer look at.

edit: I used ubuntu 22.04, with php-fpm, apache, mysql, a freshly built keeweb app from master and nextcloud 27.0.0 for the test

[burned42]

Update: ok the ssl issue must've been something else, it also works via http, without ssl.

I now also tested different browsers (firefox, chromium) and can't get it to break :(

[arnowelzel]

Good news. I moved to another server which is more or less identical to my production system and there everything works fine. Seems the development box is a bit flaky. Anyway - I'll do some tests and after that I think we are good to go.

And #205 is also closed by your changes - thanks!

[burned42]

Awesome, thank you, too 🥳

[flyinva]

Hi,

I've got this error in servers's logs too.

 "Exception": "OC\\AppFramework\\Utility\\QueryNotFoundException",
 "Message": "Could not resolve OCA\\Keeweb\\Controller\\PageController! Class \"OCA\\Keeweb\\Controller\\PageController\" does not exist",

Debian 12, PHP 8.2.7, Nextcloud 27.0.0.8

[arnowelzel]

Sorry, I can not reproduce this error any longer, therefore I also don't know how to fix it.

[arnowelzel]

Do you use NC 26? This seems to broken :-( Also see #224

[flyinva]

Hi,

I've got this error in servers's logs too.

 "Exception": "OC\\AppFramework\\Utility\\QueryNotFoundException",
 "Message": "Could not resolve OCA\\Keeweb\\Controller\\PageController! Class \"OCA\\Keeweb\\Controller\\PageController\" does not exist",

Debian 12, PHP 8.2.7, Nextcloud 27.0.0.8

OK after restarting php8-fpm 👍

[arnowelzel]

OK after restarting php8-fpm 👍

Hmm... maybe the OPCache of PHP still contained the old code. Can you paste the OPcache configuration of your PHP setup? Depending on your setup you may find this in /etc/php/8.0/fpm/php.ini:

[opcache]
opcache.enable=1
...

The interesting part is the modification check settings like opcache.validation_timestamps or opcache.revalidate_freq. If these options are configured in the way that files will never check for modifications, this may explain why a new version of Keeweb did not work any longer, because old code in the OPCache was still used instead of the new one.

If you follwed some "optimization tips" and disabled the OPCache validation - the perfomance gain is often neglectable and not worth the trouble. By default the validation is enabled, so if neither of the mention options is set, then the OPCache should automatically reload new versions of the source files if needed.

[burned42]

nextcloud/server#38797 may be related, also mentioning a caching issue due to recent changes in nextcloud itself