TOS breaks collabora #260

joergmschulz · 2019-11-06T09:41:46Z

see issue nextcloud/richdocuments#681 : when TOS is activated, Collabora is broken.

(unchanged with Version 1.3.1)

nickvergessen · 2019-11-21T10:15:21Z

Did you accept the tos on a neighbour file before?

joergmschulz · 2019-11-21T12:59:02Z

I don't understand your question, I'm afraid. But, yes, the TOS have been accepted on that specific machine by that specific user.
Possibly, TOS expects the collabora app to accept the TOS (which will not happen)?

brunt82 · 2020-02-28T09:53:25Z

I can confirm the described behaviour for collabora and onlyoffice. As soon as I enable the app, documents cannot be opened anymore. When I disable the app, editing documents by using collabora / onlyoffice works again.

nickvergessen · 2020-03-02T11:03:48Z

does it happen for all files, or just shared files, etc?

joergmschulz · 2020-03-02T12:25:49Z

in my environmen, it happened for all files. I suspect that the 'ok' dialog that comes up when you login to a TOS-enabled cloud comes up as well for the connection that the lool server initiates to the nextcloud server after the file-open request from the user

brunt82 · 2020-03-02T12:30:53Z

Yes, it makes no difference between shared / unshared documents. Here are the log lines which are produced afterwards the file could not be opened:

OnlyOffice
{"reqId":"EKyrrJVwJFfVI6ntjk0T","level":4,"time":"2020-03-02T13:24:32+01:00","remoteAddr":"192.168.210.253","user":"gtest1","app":"onlyoffice","method":"GET","url":"/apps/onlyoffice/download?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmaWxlSWQiOjc3NDIyLCJ1c2VySWQiOiJzdG1lbnplbCIsInNoYXJlVG9rZW4iOm51bGwsImFjdGlvbiI6ImRvd25sb2FkIn0.Mh4kaArJW5_Dwu4eomcI8ONuKF1SXzwcRal2FKvzPe8","message":"Download without access right","userAgent":"--","version":"18.0.1.3"}
Collabora
{"reqId":"hQs7ajxfjsJkcAFnfoeS","level":3,"time":"2020-03-02T13:17:27+01:00","remoteAddr":"192.168.210.253","user":"--","app":"richdocuments","method":"GET","url":"/index.php/apps/richdocuments/wopi/files/79542_ocm2qn8y3fs4/contents?access_token=Oc4qhMlP1wX62QPcSuJX929XwlLnGa0R&access_token_ttl=0&reuse_cookies=experimentation_subject_id%3DIjM5MDdjZjc5LWVkNjQtNDJiYi04YTI0LTczZDA2NWQxZTI4MCI%3D--302185d7919a2db7cb33bc2d29a17fb956c96856&permission=edit","message":{"Exception":"OCP\\Files\\NotPermittedException","Message":"","Code":0,"Trace":[{"file":"/var/www/nextcloud/apps/richdocuments/lib/Controller/WopiController.php","line":360,"function":"fopen","class":"OC\\Files\\Node\\File","type":"->","args":["rb"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"getFile","class":"OCA\\Richdocuments\\Controller\\WopiController","type":"->","args":["79542","Oc4qhMlP1wX62QPcSuJX929XwlLnGa0R"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":99,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Richdocuments\\Controller\\WopiController"},"getFile"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":125,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Richdocuments\\Controller\\WopiController"},"getFile"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OCA\\Richdocuments\\Controller\\WopiController","getFile",{"__class__":"OC\\AppFramework\\DependencyInjection\\DIContainer"},{"fileId":"79542_ocm2qn8y3fs4","_route":"richdocuments.wopi.getFile"}]},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->","args":[{"fileId":"79542_ocm2qn8y3fs4","_route":"richdocuments.wopi.getFile"}]},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":299,"function":"call_user_func","args":[{"__class__":"OC\\AppFramework\\Routing\\RouteActionHandler"},{"fileId":"79542_ocm2qn8y3fs4","_route":"richdocuments.wopi.getFile"}]},{"file":"/var/www/nextcloud/lib/base.php","line":1008,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/apps/richdocuments/wopi/files/79542_ocm2qn8y3fs4/contents"]},{"file":"/var/www/nextcloud/index.php","line":38,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/nextcloud/lib/private/Files/Node/File.php","Line":118,"CustomMessage":"getFile failed"},"userAgent":"LOOLWSD WOPI Agent 4.0.9","version":"18.0.1.3"}

brunt82 · 2020-03-04T10:09:58Z

The new commit 0b7fcd2 does not change the behavior: Opening documents with Onlyoffice or Collabora is still not possible.

wiswedel · 2020-03-06T14:45:22Z

I can not reproduce this with

NC 18.0.1
Terms of Service 1.4.0
Onlyoffice App 4.1.4
Onlyoffice Documentserver Integration Edition 5.5.0 (Linux installation, no Docker, no Community Server)
with secret and without
with web sockets and without

brunt82 · 2020-03-11T07:54:22Z

I can not reproduce this with

* NC 18.0.1

* Terms of Service 1.4.0

* Onlyoffice App 4.1.4

* Onlyoffice Documentserver Integration Edition 5.5.0 (Linux installation, no Docker, no Community Server)

* with secret and without

* with web sockets and without

The app and nextcloud versions are the same for me. But I uses the docker solution for OnlyOffice. Anyhow I don't believe it has any to do with the docker, because it works as soon as I disable TOS.

Where comes the "Download without access right" of above error log from?

Edit: The server certificate of the docker server is self-signed. I trust it in my browser so that the preview works.

juliusknorr · 2021-02-25T09:25:56Z

I#ve seen the same happening today with ONLYOFFICE where the TOS cache wrapper basically blocks the check if the file is readable in the download callback handler of the ONLYOFFICE app, though I cannot reproduce it locally on 1.6.1 nor master yet with the latest releases. I'll check back on the instance where this occured if there was maybe only a specific setting either tos_for_users or tos_on_public_shares enabled.

joergmschulz · 2022-09-27T20:08:34Z

long time and some versions later: This can be closed because TOS work perfectly along with COOL.

sydmund · 2022-10-10T17:02:20Z

It is still here!

Nextcloud AIO v2.0.3 (NC 24.0.5)
Terms of service v1.10.2
Collabora Online server v6.2.1
Every other app is up to date.

Possibly step to reproduce:
I added global TOS as a second to firstly added in my country language.
After that SOME users (no idea why some users) can't open documents in Collabora.

Formated Errors:
[richdocuments] Error: OCP\Files\NotPermittedException: at <>

/var/www/html/custom_apps/richdocuments/lib/Controller/WopiController.php line 425
OC\Files\Node\File->fopen("rb")
/var/www/html/lib/private/AppFramework/Http/Dispatcher.php line 225
OCA\Richdocuments\Controller\WopiController->getFile("1094491", "7rwmfwj87p5vNk6wMZmtJTZjBTN5DjJa")
/var/www/html/lib/private/AppFramework/Http/Dispatcher.php line 133
OC\AppFramework\Http\Dispatcher->executeController(OCA\Richdocument ... {}, "getFile")
/var/www/html/lib/private/AppFramework/App.php line 172
OC\AppFramework\Http\Dispatcher->dispatch(OCA\Richdocument ... {}, "getFile")
/var/www/html/lib/private/Route/Router.php line 298
OC\AppFramework\App::main("OCA\Richdocume ... r", "getFile", OC\AppFramework\ ... {}, ["1094491_oc6w0i ... "])
/var/www/html/lib/base.php line 1030
OC\Route\Router->match("/apps/richdocum ... s")
/var/www/html/index.php line 36
OC::handleRequest()

After deleting second TOS (global), broken users are starting working fine. Three days of searching info in Collabora's threads, which was wrong :/

nickvergessen · 2022-10-14T07:51:04Z

I put it on my todo list to check it again.
But I don't have a collabora setup at the moment to test this with.

nickvergessen · 2022-10-18T05:31:50Z

Can you please post the following details, that would really help me debugging this:

Output of the following command on the server: occ config:list terms_of_service
Whether you make use of one of the config options from the readme:
- https://github.com/nextcloud/terms_of_service#-display-on-public-shares
- https://github.com/nextcloud/terms_of_service#-exclude-registered-users
Screenshot of the list of rules that are defined (the actual content doesn't matter)

sydmund · 2022-10-19T13:58:49Z

Hi!
Ok, here is my configuration from NC GUI:

root@cloud:~# docker exec -it nextcloud-aio-nextcloud php occ config:list terms_of_service
{
    "apps": {
        "terms_of_service": {
            "term_uuid": "633ed0532973d",
            "types": "filesystem,dav",
            "installed_version": "1.10.2",
            "enabled": "yes"
        }
    }
}

In that case I have an error when trying to open document via Collabora.

Now I'm removing global (polish in my case) ToS via NC GUI:

OCC seems with no changes:

root@cloud:~# docker exec -it nextcloud-aio-nextcloud php occ config:list terms_of_service
{
    "apps": {
        "terms_of_service": {
            "term_uuid": "633ed0532973d",
            "types": "filesystem,dav",
            "installed_version": "1.10.2",
            "enabled": "yes"
        }
    }
}

But now Collabora opens documents.

As I mentioned before the broken time is broken only for some users and have no idea what's making a difference among users.

I'm not a developer, but fell free to ask for more.

nickvergessen · 2022-10-21T12:11:39Z

As I mentioned before the broken time is broken only for some users and have no idea what's making a difference among users.

Maybe whether they signed it before opening the document?

My colleague in the meantime added some code to the ToS app which makes sure that the ToS are triggered there before:
nextcloud/richdocuments#2559

Maybe that already solves it?

Other than that I can still not reproduce the issue even with the information given above. The only thing that I can otherwise imagine is #691 but that was fixed in 1.10.2

juliusknorr · 2022-10-21T13:03:43Z

I could reproduce this having a region (not global) set. The requests for Collabora always get checked against global ToS but without the user scope, so it might be that some users have the global signed (for those it works) and some only the polish (which doesn't work then).

@nickvergessen I think the most sane thing to do would be to still allow the requests for /richdocuments/wopi/ as even with setting the correct user during the wopi requests, we could not be able to match the country code that the user had in the browser requests.

Any preference on how to do that? I'd say with nextcloud/richdocuments#2559 it would be fine to only check against the request url, otherwise we probably need an event that TOS could dispatch so richdocuments could determine if the request ip is from the allow list.

How the wopi allow list is handled in richdocuments https://github.com/nextcloud/richdocuments/blob/2eca85078cf46e2ed61fad070a625d9161ffd26f/lib/Middleware/WOPIMiddleware.php#L68-L81

nickvergessen · 2022-10-21T13:16:05Z

How the wopi allow list is handled in richdocuments https://github.com/nextcloud/richdocuments/blob/2eca85078cf46e2ed61fad070a625d9161ffd26f/lib/Middleware/WOPIMiddleware.php#L68-L81

I would prefer this over URL checking, but we could even combine it.
Only allowing the WOPI ips on index.php/apps/richdocuments/wopi

nickvergessen · 2022-10-21T13:16:21Z

Let me prepare a patch for this.

solracsf · 2023-01-23T15:42:07Z

@nickvergessen This seems to happen also with OnlyOffice.
After disabling the TOS app, file can be edited, with app enabled, error "Download without access right'"

NC v24.0.9, TOS v1.10.2, OnlyOffice v7.5.8.

nickvergessen · 2023-01-23T15:44:57Z

Yeah, seems I forgot to make releases... Will queue a todo item for it

hamza221 · 2024-09-20T13:06:28Z

Still happening in v2.5.0

{
	"reqId": "GWDTcDbWLJfR2z3wFYRt",
	"level": 3,
	"time": "2024-09-20T12:20:53+00:00",
	"remoteAddr": "::ffff:212.46.103.227",
	"user": "--",
	"app": "richdocuments",
	"method": "GET",
	"url": "/index.php/apps/richdocuments/wopi/files/2781_ocylie5fucfr/contents?
	"message": "getFile failed: ",
	"userAgent": "COOLWSD HTTP Agent 24.04.6.3",
	"version": "29.0.7.2",
	"exception": {
		"Exception": "OCP\\Files\\NotPermittedException",
		"Message": "",
		"Code": 0,
		"Trace": [{
			"file": "/var/www/nextcloud/apps/richdocuments/lib/Controller/WopiController.php",
			"line": 385,
			"function": "fopen",
			"class": "OC\\Files\\Node\\File",
			"type": "->",
			"args": ["rb"]
		}, {
			"file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
			"line": 232,
			"function": "getFile",
			"class": "OCA\\Richdocuments\\Controller\\WopiController",
			"type": "->",
			"args": ["2781", "j0g9sGbmdmHv7zi4938DtTxfZ9GZu65V"]
		}, {
			"file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
			"line": 138,
			"function": "executeController",
			"class": "OC\\AppFramework\\Http\\Dispatcher",
			"type": "->",
			"args": [
				["OCA\\Richdocuments\\Controller\\WopiController"], "getFile"
			]
		}, {
			"file": "/var/www/nextcloud/lib/private/AppFramework/App.php",
			"line": 184,
			"function": "dispatch",
			"class": "OC\\AppFramework\\Http\\Dispatcher",
			"type": "->",
			"args": [
				["OCA\\Richdocuments\\Controller\\WopiController"], "getFile"
			]
		}, {
			"file": "/var/www/nextcloud/lib/private/Route/Router.php",
			"line": 331,
			"function": "main",
			"class": "OC\\AppFramework\\App",
			"type": "::",
			"args": ["OCA\\Richdocuments\\Controller\\WopiController", "getFile", ["OC\\AppFramework\\DependencyInjection\\DIContainer"],
				["2781_ocylie5fucfr", "richdocuments.wopi.getfile"]
			]
		}, {
			"file": "/var/www/nextcloud/lib/base.php",
			"line": 1058,
			"function": "match",
			"class": "OC\\Route\\Router",
			"type": "->",
			"args": ["/apps/richdocuments/wopi/files/2781_ocylie5fucfr/contents"]
		}, {
			"file": "/var/www/nextcloud/index.php",
			"line": 49,
			"function": "handleRequest",
			"class": "OC",
			"type": "::",
			"args": []
		}],
		"File": "/var/www/nextcloud/lib/private/Files/Node/File.php",
		"Line": 120,
		"message": "getFile failed: ",
		"exception": {},
		"CustomMessage": "getFile failed: "
	}
}

nickvergessen added the bug label Nov 21, 2019

joergmschulz closed this as completed Sep 27, 2022

joergmschulz mentioned this issue Oct 4, 2022

*nearly solved* document access denied when terms Of Service app is installed at the same time nextcloud/richdocuments#681

Closed

nickvergessen reopened this Oct 14, 2022

nickvergessen added the 1. to develop label Oct 18, 2022

nickvergessen mentioned this issue Oct 21, 2022

Allow WOPI requests from the richdocuments/Collabora integration #765

Merged

nickvergessen closed this as completed in #765 Oct 21, 2022

max-nextcloud mentioned this issue Oct 16, 2024

fix(office): getUser from userSession #995

Merged

max-nextcloud mentioned this issue Oct 16, 2024

Regression: TOS breaks Collabora #996

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TOS breaks collabora #260

TOS breaks collabora #260

joergmschulz commented Nov 6, 2019 •

edited

Loading

nickvergessen commented Nov 21, 2019

joergmschulz commented Nov 21, 2019

brunt82 commented Feb 28, 2020

nickvergessen commented Mar 2, 2020

joergmschulz commented Mar 2, 2020

brunt82 commented Mar 2, 2020

brunt82 commented Mar 4, 2020

wiswedel commented Mar 6, 2020 •

edited

Loading

brunt82 commented Mar 11, 2020 •

edited

Loading

juliusknorr commented Feb 25, 2021

joergmschulz commented Sep 27, 2022

sydmund commented Oct 10, 2022

nickvergessen commented Oct 14, 2022

nickvergessen commented Oct 18, 2022

sydmund commented Oct 19, 2022

nickvergessen commented Oct 21, 2022

juliusknorr commented Oct 21, 2022

nickvergessen commented Oct 21, 2022

nickvergessen commented Oct 21, 2022

solracsf commented Jan 23, 2023

nickvergessen commented Jan 23, 2023

hamza221 commented Sep 20, 2024 •

edited by max-nextcloud

Loading

TOS breaks collabora #260

TOS breaks collabora #260

Comments

joergmschulz commented Nov 6, 2019 • edited Loading

nickvergessen commented Nov 21, 2019

joergmschulz commented Nov 21, 2019

brunt82 commented Feb 28, 2020

nickvergessen commented Mar 2, 2020

joergmschulz commented Mar 2, 2020

brunt82 commented Mar 2, 2020

brunt82 commented Mar 4, 2020

wiswedel commented Mar 6, 2020 • edited Loading

brunt82 commented Mar 11, 2020 • edited Loading

juliusknorr commented Feb 25, 2021

joergmschulz commented Sep 27, 2022

sydmund commented Oct 10, 2022

nickvergessen commented Oct 14, 2022

nickvergessen commented Oct 18, 2022

sydmund commented Oct 19, 2022

nickvergessen commented Oct 21, 2022

juliusknorr commented Oct 21, 2022

nickvergessen commented Oct 21, 2022

nickvergessen commented Oct 21, 2022

solracsf commented Jan 23, 2023

nickvergessen commented Jan 23, 2023

hamza221 commented Sep 20, 2024 • edited by max-nextcloud Loading

joergmschulz commented Nov 6, 2019 •

edited

Loading

wiswedel commented Mar 6, 2020 •

edited

Loading

brunt82 commented Mar 11, 2020 •

edited

Loading

hamza221 commented Sep 20, 2024 •

edited by max-nextcloud

Loading