Cannot download from nextcloud instance hosted at subfolder

[scholzri]

Describe the bug

When using a nextcloud instance which is hosted at a subfolder of a domain, e.g. example.com/nextcloud, there is a bug that while login and upload works, it is not possible for Saber to download files from the Nextcloud Server.
When using a nextcloud instance hosted on a subdomain or on the base url, downloading works.

To reproduce

1. Login to nextcloud instance hosted at a subfolder on two clients
2. upload some files from one client
3. try to download some files from another client
4. Saber does not download the notes

Expected behavior

Downloading notes from nextcloud on a subfolder e.g. example.com/nextcloud/ should work.

Saber version

0.14.3

Device

Android 13; Linux Flatpak

Anything else?

No response

[adil192]

@provokateurin Is this reproducible on your end?

[provokateurin]

I think Nextcloud in a subfolder is always a buggy experience. I can try reproducing this and see if this is a problem in our library.

[provokateurin]

@AdmerStroh you are able to upload a file to a server hosted on a subfolder, but not able to download files from the same instance at the subfolder, right? Would it be possible to capture some logs that could contain an error message? I suspect some path sanitization or traversal is not working properly (if you are able to upload but not download).

[scholzri]

@provokateurin Yes that is correct. Upload works, download does not work. Could you please give me a quick explanation on how to capture the log and should i capture it in Saber or my nextcloud instance?

Kind regards

[provokateurin]

I guess you can either run the flatpak from command line or use adb to get logs from your Android device. You don't need to do it though, I think I already have enough information to reproduce it (as long as it is a problem in our Nextcloud library and not in Saber).

[scholzri]

I tried to get you some logs, but unfortunately my skills are a bit limited, I am sorry :/ When running the flatpak from the command line, even with the verbose flag, I do not get any error message when I try to sync, but still nothing is downloaded.

[dedfritzi]

@AdmerStroh you are able to upload a file to a server hosted on a subfolder, but not able to download files from the same instance at the subfolder, right? Would it be possible to capture some logs that could contain an error message? I suspect some path sanitization or traversal is not working properly (if you are able to upload but not download).

I have the same issue.
I do have the Neon app installed for testing purposes and have no problems up- or downloading files within Neon.
But downloading notes in Saver does not work.
Ny suspicion is that assembling the correct filename/path in Saber could be the cause of the problem.

[provokateurin]

@dedfritzi thanks for already checking. I haven't done the testing myself, but really sounds like it's a problem in Saber @adil192

[kb3uyi]

Copying from another issue #780:

I have experienced this problem as well. I have updated nextcloud from 27, to 27.0.1. And I have changed the alias in sites-enabled from "/nextcloud" to "/" to force it to be on the root of the webserver and not have "/nextcloud" in the URL. (Nextcloud server runs apache and is behind a NGINX Proxy Manager so changing the url was easy.)

That didn't resolve it so I also deleted the Saber folder on nextcloud. I readded it on my phone and then force quit and restarted the application.

Then I force quit and readded on my tablet. The notes from the phone are now on the tablet, but not the other way around.
New notes from either device would be copied, but I was using a pen on my tablet to take notes om something for a tabletop game and that refused to copy. It was in a folder so I moved it to root. No such luck.

New notes copy and I see that on my phone. So I probably should have removed the saber folder and then promptly used the tablet instead of the phone.

Either way, it looks like syncing is broken if the nextcloud URL is not right at the root. It was a little frustrating to lose the notes on my tablet but I recently started using the app so it wasn't much to replace.

Sync goes both ways now that I have the URL changed, but I had issues getting things in folders to sync. Will try again tonight but for now everything is in the root of the saber directory and is working.

[adil192]

Please can someone on this thread make me an account on their subfolder nextcloud instance?

[MichaelNiemetz]

Any news on this? It fails her with Android an Desktop (appimage) version (version 24.4)

On sync I get a flood of

flutter: WARNING: SyncerDownloader: Transfer failed: ClientException: Invalid status code 404.

and the file shows up on the server Saber directory.

After "syncing" a while it changes to

flutter: WARNING: SyncerDownloader: Transfer failed: ClientException with SocketException: Connection failed (OS Error: Too many open files, errno = 24), address = myserver.nowhere, port = 443, uri=https://myserver.nowhere/myfancysubsite/remote.php/webdav/webdav/Saber/b22c21f11cbf9cb5c5f9921b2bfa7051bfd452e298f3d10aa2650f86bfe13abd.sbe

The duplication of "webdav" in this seems suspicious...

[Mr-Mime]

I am experiencing the same behavior.
@adil192 If you want I can create you an account for my nextcloud instance.

The error message I see is the following:
(I only removed domain name and IP address)

Error Log

WARNING at 2024-10-09 18:37:46.688988
Transfer failed: ClientException: Invalid status code 404, headers: {set-cookie: oc_sessionPassphrase=Hq2aaF1sdFp8Vqf9UOTBI4AXmvXmvO8hmi6aNWADF5xvbFryQbVlHWS0Sn9No5pxQnXS6oGn9V4JjglXZH4i%2BUZxMOrIGIfXOroHrwO%2BydMhheqjbayZ1Hm3O71TJaKe; path=/nextcloud; secure; HttpOnly; SameSite=Lax,nc_sameSiteCookielax=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax,nc_sameSiteCookiestrict=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict,ocon4vozifq4=918o5sg7to8va3ik2oaciee3ic; path=/nextcloud; secure; HttpOnly; SameSite=Lax, date: Wed, 09 Oct 2024 16:37:46 GMT, transfer-encoding: chunked, strict-transport-security: max-age=15552000; includeSubDomains, referrer-policy: no-referrer, x-robots-tag: noindex, nofollow, x-permitted-cross-domain-policies: none, content-type: application/xml; charset=utf-8, x-xss-protection: 1; mode=block, server: Apache, x-powered-by: PHP/8.3.8,PleskLin, x-frame-options: SAMEORIGIN, x-content-type-options: nosniff, content-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self' data:;connect-src 'self';media-src 'self';frame-ancestors 'self';form-action 'self'}, body: <?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
	<s:exception>Internal Server Error</s:exception>
	<s:message>
		The server was unable to complete your request.		If this happens again, please send the technical details below to the server administrator.		More details can be found in the server log.			</s:message>

	<s:technical-details>
		<s:remote-address>88.11.227.89</s:remote-address>
		<s:request-id>rtzZhgzCcB7UdD0txeLZ</s:request-id>

		</s:technical-details>
</d:error>
, uri=https://abcdef.de/nextcloud/remote.php/webdav/webdav/Saber/e2c0c6d48a893710123506c61e9ea2e291d40d76b04f9869af93b7db9bf25f68.sbe
ClientException: Invalid status code 404, headers: {set-cookie: oc_sessionPassphrase=Hq2aaF1sdFp8Vqf9UOTBI4AXmvXmvO8hmi6aNWADF5xvbFryQbVlHWS0Sn9No5pxQnXS6oGn9V4JjglXZH4i%2BUZxMOrIGIfXOroHrwO%2BydMhheqjbayZ1Hm3O71TJaKe; path=/nextcloud; secure; HttpOnly; SameSite=Lax,nc_sameSiteCookielax=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax,nc_sameSiteCookiestrict=true; path=/nextcloud; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict,ocon4vozifq4=918o5sg7to8va3ik2oaciee3ic; path=/nextcloud; secure; HttpOnly; SameSite=Lax, date: Wed, 09 Oct 2024 16:37:46 GMT, transfer-encoding: chunked, strict-transport-security: max-age=15552000; includeSubDomains, referrer-policy: no-referrer, x-robots-tag: noindex, nofollow, x-permitted-cross-domain-policies: none, content-type: application/xml; charset=utf-8, x-xss-protection: 1; mode=block, server: Apache, x-powered-by: PHP/8.3.8,PleskLin, x-frame-options: SAMEORIGIN, x-content-type-options: nosniff, content-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self' data:;connect-src 'self';media-src 'self';frame-ancestors 'self';form-action 'self'}, body: <?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
	<s:exception>Internal Server Error</s:exception>
	<s:message>
		The server was unable to complete your request.		If this happens again, please send the technical details below to the server administrator.		More details can be found in the server log.			</s:message>

	<s:technical-details>
		<s:remote-address>IP.IP.IP.IP</s:remote-address>
		<s:request-id>rtzZhgzCcB7UdD0txeLZ</s:request-id>

		</s:technical-details>
</d:error>
, uri=https://abcdef.de/nextcloud/remote.php/webdav/webdav/Saber/e2c0c6d48a893710123506c61e9ea2e291d40d76b04f9869af93b7db9bf25f68.sbe
#0      WebDavClient.getStream (package:nextcloud/src/api/webdav/webdav_client.dart:419)
<asynchronous suspension>
#1      WebDavClient.get (package:nextcloud/src/api/webdav/webdav_client.dart:399)
<asynchronous suspension>
#2      SaberSyncInterface.downloadRemoteFile (package:saber/data/nextcloud/saber_syncer.dart:182)
<asynchronous suspension>
#3      Mutex.protect (package:mutex/src/mutex.dart:79)
<asynchronous suspension>
#4      SyncerDownloader.transfer (package:abstract_sync/src/syncer_downloader.dart:38)
<asynchronous suspension>
#5      SyncerComponent._transferWrapper (package:abstract_sync/src/syncer_component.dart:142)
<asynchronous suspension>

If I can help with any testing just let me know :)

PS: I see this error on linux and android both on version 0.25

[Mr-Mime]

As @MichaelNiemetz mentioned the error seems to be connected to the duplication of webdav in the uri.

When I copy the uri from my previous error log and paste it in the browser search bar I get a "not found" page from nextcloud.
When I remove one of the webdav occurrences, it works. I then see an option to save the file to my computer.
I also tested another uri which was recommended to use in this post

❌ https://abc.de/nextcloud/remote.php/webdav/webdav/Saber/123.sbe
✅ https://abc.de/nextcloud/remote.php/webdav/Saber/123.sbe
✅ https://abc.de/nextcloud/remote.php/dav/files/USERNAME/Saber/123.sbe

So far I was not able how/where the URI is created and why there is the duplicate.

[Mr-Mime]

This PR of the dart/flutter plugin might be related.

nextcloud/neon#2557

[provokateurin]

This PR of the dart/flutter plugin might be related.

It will not fix the problem.

@dedfritzi reported this:

I do have the Neon app installed for testing purposes and have no problems up- or downloading files within Neon.
But downloading notes in Saver does not work.
Ny suspicion is that assembling the correct filename/path in Saber could be the cause of the problem.

so I'm pretty sure it is a Saber and not nextcloud package problem.

[provokateurin]

so I'm pretty sure it is a Saber and not nextcloud package problem.

Ok I actually found one subpath related problem which might be the cause for this.
I think it works in Neon because we store the path separately while Saber probably uses the raw WebDAV results.

[provokateurin]

Could someone who faces the problem rebuild the app with a dependency override for nextcloud/neon#2562 to check if it works with that fix?

[Mr-Mime]

Nice!

I used the fix (nextcloud/neon#2562) and build saber for linux with it.
After running saber and logging in with my nextcloud, the download immediately worked.

I see no errors in the log/console output.

[provokateurin]

Awesome, then I hope a new release of the package can be done this week and then @adil192 can bump the version to fix this issue.

[provokateurin]

A new version of the package was released and I created a PR: #1372