Edited documents cannot be saved when using encryption (server-side) #833
Comments
|
Could you share some retails about the external storage you are using and the config of that? |
|
I've mounted a couple of local drives read-only for music and movies, but I can't imagine this is touching that. Other than that, I have no external storage. To be honest, I'm not entirely clear how the Nextcloud user directories interact with Collabora, but these are all files in my Nextcloud user directory. Is it possible another app is interfering here? |
|
I've got some more logs to provide. In my syslog I have the following when I try to read an "edited" file: I will try to see if I can bump up the log verboseness on my loolwsd instance. |
|
I set logging to debug and got a ton of output. I posted it on pastebin: |
|
I did some more investigating and found if I attempt to download the file from the Nextcloud web interface, it's size is zero (0). However, I can restore a previous version and it works fine. Somehow, richdocuments appears to be zeroing out the value of the file. I'll do some more experiments. |
|
What is returned if you request the url that is logged in the collabora logs from |
|
I think I cleaned up my other versions, here's the output using test file created for this. Entering the URL, I get a JSON (?) page with the following information. There's a "Raw Data" tab that has the same info. and a Response Headers tab |
|
Same problem here. Downgrade of richdocuments app to 3.5.0 fixed the problem for me. |
|
The output looks pretty normal. Could you check if downloading the file manually by appending myserver.org/index.php/apps/richdocuments/wopi/files/103684_5127bcd54d75c/contents?access_token=a8NCCjkTkxanB9XeL0ZJ8dnnSa5yAfJ3&access_token_ttl=0 |
|
And could you also provide a system report from the support app as well as a list of configured external storages for completeness, so we don't miss anything there. |
This just took me to my main Files folder view. No errors on the web page. Web server logs show a 302 response (redirect it looks like): It looks like access_token changes every time I try to do something. I'm not sure if this is significant, but I also found the following entiries in my syslog: Does this mean I've misconfigured some SSL statements somewhere (perhaps likely after the recent changes to the storage section in loolwsd.xml)? After moving to collaboraonline 6.2 with the corresponding loolwsd update, the storage section had it's own ssl section that I left alone. When I started having this problem, one thing I did was to add my ssl settings from the main section (cert file locations and the like) to the storage section, but I got the same error. I assumed this has nothing to do with the current issue. Here's the system report. I zipped it up since it wont let me paste an ".md" file in. Thank you for your help on this. |
|
/contents not /content 😉 |
D'oh The web page says File Not Found. Response 400 from the Apache logs. |
Would you be so kind and tell how to downgrade? I can not from nextcloud... |
Deactivated first and uninstalled app using nextcloud web interface. Afterwards ssh to Server, downloaded version 3.5.0 from GitHub releases and extracted to apps directory. Installed and activated then using nextcloud web interface. |
OK, following this, I can now edit my documents again. Thank you. I'm not sure what I did differently before where it didn't work to downgrade richdocuments. |
|
Maybe wsomeone helps. |
|
I just installed NC19 and latest Collabora CODE and am getting |
|
I have some updates on this for my side. I was going to change a user's password, but I couldn't since I found the encryption to be messed up. The thread I read mentioned messing with encryption to get things to work. I believe that is all a part of this issue. I've had my server files encrypted or for some time and I haven't really touched it since then. Since things kept working fine, I didn't think anything of it until my issues with Collabora and attempting to change passwords. I haven't taken a thorough look at the release notes, but if you've had encryption enabled for an extended period of time with a recovery key, it might be a good idea to take some down time to decrypt your servers files and re-encrypt them if you've had encryption enabled for a very long time as I have. I think the infrastructure has changed enough things that something probably got missed, especially with the breakneck speed of development. I don't really have any proof of this, but richdocuments 3.7.0 started working after I decrypted my server's files. Since I don't have anything critically private and I'm the only user, I may just leave my files unencrypted. I realize for larger installations, this could be a giant hassle, but it may be worth looking into, or at least testing in a development or test environment if you have that luxury. |
|
I'm having this exact same issue. I'm on Nextcloud 18.0.6 which I updated yesterday from NC15 with PHP 7.0 all the way up to NC18 with PHP7.3 (like @jimbolaya I haven't used it for a while and I have server side encryption enabled). I downgraded to richdocuments 3.5.0 as @milkomeda said and now everything works fine. I tried almost all versions of richdocuments until 3.5.0, it seems to me that 3.5.1 introduced an encryption-related bug somewhere. Something not backward compatible maybe ? As both @jimbolaya and I had an old instance we haven't used for a while. When I try to open a document in Collabora, the following exception is thrown :
Did the path of the private key changed in 3.5.1 ? Full log : {"reqId":"dASEtKg87Z7Ci5z4Z0xY","level":3,"time":"2020-07-07T18:35:29+00:00","remoteAddr":"192.168.1.1","user":"shellcode","app":"richdocuments","method":"POST","url":"/index.php/apps/richdocuments/wopi/files/24042_ocf0sndqo3s8/contents?access_token=XXXXXXXX&access_token_ttl=0","message":{"Exception":"OCA\\Encryption\\Exceptions\\PrivateKeyMissingException","Message":"Private Key missing for user: please try to log-out and log-in again","Code":0,"Trace":[{"file":"/var/www/html/apps/encryption/lib/KeyManager.php","line":444,"function":"getPrivateKey","class":"OCA\\Encryption\\Session","type":"->","args":[]},{"file":"/var/www/html/apps/encryption/lib/Crypto/Encryption.php","line":202,"function":"getFileKey","class":"OCA\\Encryption\\KeyManager","type":"->","args":["/shellcode/files/Somewhere \u00e9t\u00e9 2020/test.ods","shellcode"]},{"file":"/var/www/html/lib/private/Files/Stream/Encryption.php","line":269,"function":"begin","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->","args":["/shellcode/files/Somewhere \u00e9t\u00e9 2020/test.ods","shellcode","w",{"oc_encryption_module":"OC_DEFAULT_MODULE","cipher":"AES-256-CTR","signed":"true"},{"users":["shellcode"],"public":false}]},{"function":"stream_open","class":"OC\\Files\\Stream\\Encryption","type":"->","args":["ocencryption://","w",0,null]},{"file":"/var/www/html/lib/private/Files/Stream/Encryption.php","line":207,"function":"fopen","args":["ocencryption://","w",false,null]},{"file":"/var/www/html/lib/private/Files/Stream/Encryption.php","line":187,"function":"wrapSource","class":"OC\\Files\\Stream\\Encryption","type":"::","args":[null,null,"ocencryption","OC\\Files\\Stream\\Encryption","w"]},{"file":"/var/www/html/lib/private/Files/Storage/Wrapper/Encryption.php","line":469,"function":"wrap","class":"OC\\Files\\Stream\\Encryption","type":"::","args":[null,"files/Somewhere \u00e9t\u00e9 2020/test.ods","/shellcode/files/Somewhere \u00e9t\u00e9 2020/test.ods",{"oc_encryption_module":"OC_DEFAULT_MODULE","cipher":"AES-256-CTR","signed":"true"},"shellcode",{"__class__":"OCA\\Encryption\\Crypto\\Encryption"},{"__class__":"OC\\Files\\Storage\\Home"},{"cache":null,"scanner":null,"watcher":null,"propagator":null,"updater":null,"__class__":"OC\\Files\\Storage\\Wrapper\\Encryption"},{"__class__":"OC\\Encryption\\Util"},{"__class__":"OC\\Encryption\\File"},"w",8304,10,8192,true]},{"file":"/var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php","line":299,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Encryption","type":"->","args":["files/Somewhere \u00e9t\u00e9 2020/test.ods","w"]},{"file":"/var/www/html/lib/private/Files/View.php","line":670,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["files/Somewhere \u00e9t\u00e9 2020/test.ods","w"]},{"file":"/var/www/html/lib/private/Files/Node/File.php","line":71,"function":"file_put_contents","class":"OC\\Files\\View","type":"->","args":["/shellcode/files/Somewhere \u00e9t\u00e9 2020/test.ods",null]},{"file":"/var/www/html/apps/richdocuments/lib/Controller/WopiController.php","line":453,"function":"putContent","class":"OC\\Files\\Node\\File","type":"->","args":[null]},{"file":"/var/www/html/apps/richdocuments/lib/Controller/WopiController.php","line":623,"function":"OCA\\Richdocuments\\Controller\\{closure}","class":"OCA\\Richdocuments\\Controller\\WopiController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/apps/richdocuments/lib/Controller/WopiController.php","line":454,"function":"retryOperation","class":"OCA\\Richdocuments\\Controller\\WopiController","type":"->","args":[{"__class__":"Closure"}]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"putFile","class":"OCA\\Richdocuments\\Controller\\WopiController","type":"->","args":["24042","bP0Q6APsvik6S4hDru81GGFMBP17xXbR"]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":99,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Richdocuments\\Controller\\WopiController"},"putFile"]},{"file":"/var/www/html/lib/private/AppFramework/App.php","line":125,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Richdocuments\\Controller\\WopiController"},"putFile"]},{"file":"/var/www/html/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OCA\\Richdocuments\\Controller\\WopiController","putFile",{"__class__":"OC\\AppFramework\\DependencyInjection\\DIContainer"},{"fileId":"24042_ocf0sndqo3s8","_route":"richdocuments.wopi.putFile"}]},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->","args":[{"fileId":"24042_ocf0sndqo3s8","_route":"richdocuments.wopi.putFile"}]},{"file":"/var/www/html/lib/private/Route/Router.php","line":299,"function":"call_user_func","args":[{"__class__":"OC\\AppFramework\\Routing\\RouteActionHandler"},{"fileId":"24042_ocf0sndqo3s8","_route":"richdocuments.wopi.putFile"}]},{"file":"/var/www/html/lib/base.php","line":1008,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/apps/richdocuments/wopi/files/24042_ocf0sndqo3s8/contents"]},{"file":"/var/www/html/index.php","line":38,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/html/apps/encryption/lib/Session.php","Line":90,"Hint":"Private Key missing for user: please try to log-out and log-in again","CustomMessage":"getFile failed"},"userAgent":"LOOLWSD WOPI Agent 4.2.5","version":"18.0.6.0"} |
|
If it's possible, I would recommend
I've done step 1 and 2, but I haven't re-encrypted my data yet, but I'll probably do that at some point in the future. |
|
TBH I really don't want to go through that, I've had enough trouble with the upgrade this last 48 hours, I will just stick with 3.5.0 until a fix is released. Hopefuly this old version isn't vulnerable to any kind of RCE. |
|
Now I'm having that issue... |
joshtrichards
added
the
integration: encryption (server-side)
joshtrichards
changed the title
This seems similar to #781 but I'm still having issues and that's listed as closed. I'm currently running 16.0.8 with php 7.3 on apache2 on Debian 9 with collaboraonline packages v6.2.10 and loolwsd 4.2.0. This has worked fine until recently. I don't know which update broke the functionality.
If I open a file that I've created before, it opens and I can see it. If I make any change at all and attempt to save it I get "Failed to read document from storage. Please contact your storage server (<mydomain>) administrator."
I can also create a file and open it fine, and can edit it, but again, it fails to save with the same error.
Any time thereafter, I cannot open any file I attempted to edit as it fails with the same message. I attempted to rollback to 3.5.0 with no success.
I've duplicated this behavior on Vivaldi (Chrome) and Firefox.
Here's the nextcloud logs from opening a file I can see (haven't edited):
Here's the nextcloud log for a file I cannot open:
This seems significant:
but I don't really know.
The text was updated successfully, but these errors were encountered: