Skip to content

[Bug]: Nextcloud 31 - Install/Enable apps with ajax request to http #51213

Closed
#52439
Closed
[Bug]: Nextcloud 31 - Install/Enable apps with ajax request to http#51213
#52439
Labels
0. Needs triagePending check for reproducibility or if it fits our roadmap31-feedbackbugfeature: apps management

Description

@wrenix
wrenix
opened on Mar 3, 2025

⚠️ This issue respects the following points: ⚠️

Bug description

After updating to nextcloud container 31 in place.
Enable / Install App makes a second Request to "httpS:///apps/files/" which has a location-header in http response to "http:///apps/files/" (without TLS).
That seems to lead to a violate Content-Security-Policy" and shows an in console:

Content-Security-Policy: The page’s settings blocked the loading of a resource (connect-src) at https://<redacted>/apps/files/ because it violates the following directive: “connect-src 'self'”

And a Failure of Enable/Install the Apps in UI.

PS: It looks like the Apps are enabled (just that failure in UI)

Steps to reproduce

  1. Install nextcloud 31 (with nginx-fpm and postgresql)
  2. Enable Application

Expected behavior

No error message shown

Nextcloud Server version

31

Operating system

Other

PHP engine version

Other

Web server

Nginx

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other

Configuration report



List of activated Apps




Nextcloud Signing status




Nextcloud Logs




Additional info


No response
Activity
  1. wrenix
    added 
    0. Needs triagePending check for reproducibility or if it fits our roadmap
     
    bug
     on Mar 3, 2025
  2. szaimen
    added 
    31-feedback
     on Mar 3, 2025
  3. szaimen commented on Mar 4, 2025 
    @szaimen
    szaimen
    on Mar 4, 2025
    Contributor
    Hi, we need the output of occ config:list system for further debugging
  4. szaimen
    added 
    needs info
     on Mar 4, 2025
  5. rafal11ck commented on Mar 4, 2025 
    @rafal11ck
    rafal11ck
    on Mar 4, 2025
    

    Hi, we need the output of occ config:list system for further debugging
    

    

    {
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "overwrite.cli.url": "https:\/\/***REMOVED MANUALLY SENSITIVE VALUE***",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR"
        ],
        "maintenance_window_start": 1,
        "default_phone_region": "PL",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "upgrade.disable-web": true,
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "***REMOVED MANUALLY SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "31.0.0.18",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***"
    }
}
  6. kesselb commented on Mar 4, 2025 
    @kesselb
    kesselb
    on Mar 4, 2025
    Contributor
    Reminds me about #44685
  7. szaimen commented on Mar 4, 2025 
    @szaimen
    szaimen
    on Mar 4, 2025
    Contributor
    @rafal11ck can you try to set overwritehost in your config and check if that fixes this?
  8. rafal11ck commented on Mar 4, 2025 
    @rafal11ck
    rafal11ck
    on Mar 4, 2025
    I set it in a way from mentioned issue above
    

      'overwritehost' => 'cloud.yyyyy.be',

    

      'overwritehost' => 'cloud.yyyyy.be:443',

    

    neither works.
  9. szaimen
    added 
    high
     and removed 
    needs info
     on Mar 4, 2025
  10. rafal11ck commented on Mar 4, 2025 
    @rafal11ck
    rafal11ck
    on Mar 4, 2025
    

    PS: It looks like the Apps are enabled (just that failure in UI)
    

    

    regarding this
    

    
  
    
    2025-03-04.12-30-49.mp4
    
  

  

    

  11. wrenix commented on Mar 4, 2025 
    @wrenix
    wrenix
    on Mar 4, 2025
    Author
    my test setup:
    

    {
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "hide_login_form": false,
        "skeletondirectory": "",
        "lost_password_link": "***REMOVED SENSITIVE VALUE***",
        "default_language": "en",
        "default_phone_region": "GB",
        "allow_local_remote_servers": true,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR"
        ],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "***REMOVED SENSITIVE VALUE***",
            "mycloud-nextcloud-hr.mycloud-dev.svc.cluster.local"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "31.0.0.18",
        "overwrite.cli.url": "http:\/\/localhost",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "loglevel": 2,
        "maintenance": false,
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "enabledPreviewProviders": [
            "OC\\Preview\\Imaginary",
            "OC\\Preview\\MP3",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\OpenDocument"
        ],
        "upgrade.disable-web": true,
        "maintenance_window_start": 1,
        "app_install_overwrite": [
            "electronicsignatures",
            "secsignid",
            "maps",
            "checksum",
            "duplicatefinder",
            "inventory",
            "neon_web"
        ],
        "enable_previews": true
    }
}
  12. Phreeman33 commented on Mar 12, 2025 
    @Phreeman33
    Phreeman33
    on Mar 12, 2025
    Contributor
    This issue can be resolved by setting fastcgi_param front_controller_active false; in the Nginx configuration. While I'm not certain if this is a Nextcloud-specific bug, maybe we should investigate the code paths related to the front_controller_active parameter for further insights.
  13. rafal11ck commented on Mar 12, 2025 
    @rafal11ck
    rafal11ck
    on Mar 12, 2025
    

    This issue can be resolved by setting fastcgi_param front_controller_active false; in the Nginx configuration. While I'm not certain if this is a Nextcloud-specific bug, maybe we should investigate the code paths related to the front_controller_active parameter for further insights.
    

    

    in helm chart values
    

        nginx:
      enabled: true
      config:
        custom: |-
          fastcgi_param front_controller_active false;

    

    Does not fix.
  14. joshtrichards
    added 
    feature: apps management
     on Mar 12, 2025
  15. Phreeman33 commented on Mar 13, 2025 
    @Phreeman33
    Phreeman33
    on Mar 13, 2025
    Contributor
    

    in helm chart values
    

        nginx:
      enabled: true
      config:
        custom: |-
          fastcgi_param front_controller_active false;

    

    Does not fix.
    

    

    I'm not familiar with Helm Chart, so I can't assist with that aspect unfortunately.
    
In my implementation, I'm running the stack via Docker with Nginx configuration files mounted from the host system for direct editing. My setup references the official Nextcloud documentation.
  16. anayrat commented on Mar 14, 2025 
    @anayrat
    anayrat
    on Mar 14, 2025
    Same here with a self-hosted nextcloud after migration from 30 to 31. I use nginx.
    

    {
    "system": {
        "debug": false,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.mydomain.info"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/cloud.mydomain.info",
        "overwriteprotocol": "https",
        "dbtype": "pgsql",
        "version": "31.0.1.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtpauthtype": "LOGIN",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "theme": "",
        "loglevel": 0,
        "updater.release.channel": "stable",
        "mail_smtpport": "465",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "app_install_overwrite": [
            "files_ebookreader",
            "calendar",
            "keeweb",
            "passman"
        ],
        "mail_sendmailmode": "smtp",
        "default_phone_region": "FR",
        "mail_smtpsecure": "ssl",
        "maintenance_window_start": 100
    }
}

    

    I added  "overwriteprotocol": "https", Nothing changed, I was able to enable my app thanks to cli.
  17. rafal11ck commented on Mar 26, 2025 
    @rafal11ck
    rafal11ck
    on Mar 26, 2025
    I tested same helm values with both 30 and 31, so that only difference is server image. Old one uses (and works) https://<redacted>/apps/files/, while new http://<redacted>/apps/files/.
  18. susnux
    added this to  🧑‍🤝‍🧑 Community triageon Mar 26, 2025
  19. susnux
    moved this to Legacy backlog in  🧑‍🤝‍🧑 Community triageon Mar 26, 2025
  20. szaimen commented on Apr 1, 2025 
    @szaimen
    szaimen
    on Apr 1, 2025
    Contributor
    I could reproduce with v31.0.2. Seems like this is happening to apps included in the app_install_overwrite array...
  21. szaimen
    removed 
    high
     on Apr 1, 2025
  22. rafal11ck commented on Apr 1, 2025 
    @rafal11ck
    rafal11ck
    on Apr 1, 2025
    I did not have app_install_overwrite and got errors, however since ooc install works and I use helm, I did workaround using before-starting script nextcloud/helm#673 (comment)
  23. solracsf
    marked [Bug]: enabling apps calls a http url despite accessed through https #51940 as a duplicate of this issue on Apr 25, 2025
  24. solracsf commented on Apr 25, 2025 
    @solracsf
    solracsf
    on Apr 25, 2025
    Member
    @susnux I've noticed that #45765 has been commited against 29, than backported to 28 and 30.
    

    So, this is not in master and 31.
  25. solracsf
    closed this as completedin #52439on Apr 25, 2025
  26. github-project-automation
    moved this from Backlog to Done in  🧑‍🤝‍🧑 Community triageon Apr 25, 2025
  27. kesselb
    marked [Bug]: Cant Enable any recommendation app! #52618 as a duplicate of this issue on May 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Metadata
Metadata
Assignees
No one assigned
    Labels
    0. Needs triagePending check for reproducibility or if it fits our roadmap31-feedbackbugfeature: apps management
    Type
    No type
    Projects
    Milestone
    No milestone
    Relationships
    None yet
    Development
    No branches or pull requests
    Issue actions