Skip to content

[Bug]: using proxy, wrong cloud port used when trying to enable / disable an app #45378

New issue
New issue
Closed
#45765
Closed
[Bug]: using proxy, wrong cloud port used when trying to enable / disable an app#45378
#45765
Labels
0. Needs triagePending check for reproducibility or if it fits our roadmap28-feedbackbugneeds info

Description

@quenenni
quenenni
opened on May 16, 2024

⚠️ This issue respects the following points: ⚠️

Bug description

I wrote the bug report #44685 not long ago.
(My setup is still exactly the same as reported there, so I'll just add the new infos in this one)

That report showed that there was a problem with a missing trailing slash at the end of apps/files when testing stuff.

It seems, for me at least, there was 2 problems and if I can't say the missing trailing slash fixed something for me, the major problem is that the test to /apps/files/ get the wrong server port.

As @joshtrichards pointed out in this comment (#44685 (comment)), the test was trying to use the port 4431 from my nginx instead of the normal https port 443.

I updated my cloud from v28.0.4 to v28.0.5.
I tried all I could do to understand that problem, but nothing is working, it always try the port 4431.

From my previous report, I added these settings in my config.php:

  'overwrite.cli.url' => 'https://cloud.xxxx.be:443/',  -> I tried with and without the ':443'
  'overwriteprotocol' => 'https',
  'overwritehost' => 'cloud.xxxx.be:443',

In my Nginx vhost, I tried the option "fastcgi_param SERVER_PORT 443;" on several lines.
I modified my /etc/nginx/fastcgi_params forcing the value 443 for the SERVER_PORT option.

I searched the haproxy documentation to see if I could use something like the "X-Forwarded-Port" option, but as I'm using TCP mode, from what I understand, I can't use it here (and I shouldn't need it here as far as I understand the TCP mode).

I searched the Nextcloud code to try to understand why it finds that port instead of the 443, but no luck (not easy to understand all the code, there are lots of stuffs).

I cheked the browser console on every cloud page (apps, settings, users) and for all requests I could see in the browser console, it always has the correct port.

The only one not having the right port is when I'm trying to enable / disable an app.

So how this test get the wrong port?

Steps to reproduce

.

Expected behavior

.

Installation method

Community Manual installation with Archive

Nextcloud Server version

28

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.1

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 22 to 23)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

Activity

  1. quenenni
    added
    0. Needs triagePending check for reproducibility or if it fits our roadmap
    bug
    on May 16, 2024

  2. kesselb commented on May 16, 2024

    @kesselb
    kesselb
    on May 16, 2024
    Contributor

    'overwritehost' => 'cloud.xxxx.be:443',

    overwritehost should not contain a port.

  3. quenenni commented on May 16, 2024

    @quenenni
    quenenni
    on May 16, 2024
    Author

    @kesselb Thanks for the help.

    I tried with and without the ':443', but no difference.

  4. szaimen
    added
    28-feedback
    on May 16, 2024
  5. kesselb
    added
    needs info
    on May 17, 2024

  6. kesselb commented on May 17, 2024

    @kesselb
    kesselb
    on May 17, 2024
    Contributor

    overwritehost should not contain a port.

    I was wrong, overwritehost may contain a port.
    In your case, it should contain 443 because nginx is using 4431.

    The patch for the trailing slash problem will be released with 28.0.6.
    Please let us know if the problem persists then.

  7. quenenni commented on May 17, 2024

    @quenenni
    quenenni
    on May 17, 2024
    Author

    Maybe the trailing slash was a problem in my setup, but I don't think the patch will fix the fact that NC get the wrong port when building the url when trying to enable or disable an app..

    And with all my sweat & will, I don't have a clue on how it does it..

    Content-Security-Policy : Les paramètres de la page ont empêché le chargement d’une ressource à 
https://cloud.yyyyy.be:4431/apps/files/ (« connect-src »).

    But I'll wait to have update to v28.0.6 to be sure and will come back here after.

    Thanks for the tips and time @kesselb

  8. kesselb commented on May 17, 2024

    @kesselb
    kesselb
    on May 17, 2024
    Contributor

    1.2.3.4 - - [05/Apr/2024:15:58:51 +0200] "POST /settings/apps/enable HTTP/2.0" 200 52 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0" "-" "cloud.yyyyy.be"

    This request looks okay. When you enable the app, see the error message and then reload the apps page, is the app enabled then?

    the fact that NC get the wrong port when building the url when trying to enable or disable an app..

    server/apps/settings/src/store/apps.js

    Lines 180 to 190 in 278aafd

    return api.post(generateUrl('settings/apps/enable'), { appIds: apps, groups })
    .then((response) => {
    context.commit('stopLoading', apps)
    context.commit('stopLoading', 'install')
    apps.forEach(_appId => {
    context.commit('enableApp', { appId: _appId, groups })
    })
    // check for server health
    return api.get(generateUrl('apps/files/'))
    .then(() => {

    The same code is used to generate the URL for app enable and server health check, the latter is responsible for the error message shown to you.

    Idea 1:
    Open the browser's network tool, check preserve logs, try to enable an app and check the xhr requests.

    Idea 2:
    You can use the browser's developer tools to search for "settings/apps/enable" in the JavaScript sources, set a breakpoint for the two places and check if the url really contains the port.

  9. quenenni commented on Jun 4, 2024

    @quenenni
    quenenni
    on Jun 4, 2024
    Author

    Hello,

    I'm back after having tested Nextcloud v28.0.6.

    Unfortunately, if something changed, the problem still remains.
    Now I can disable an app, but I still can't enable it via the web interface.

    When trying to enable an app, here is what I see in the browser console log:

    Status 200
Version HTTP/2
Transferred 870 B (34 B size)
Referrer Policyno-referrer
Request PriorityHighest
DNS ResolutionSystem

Request headers: 
{"appIds":["admin_audit"],"groups":[]}

Response:
{"data":{"update_required":false}}

    The response here:

    HTTP/2 200 
server: nginx
date: Tue, 04 Jun 2024 17:12:08 GMT
content-type: application/json; charset=utf-8
content-length: 52
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: no-referrer
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: xxxxxx
cache-control: no-cache, no-store, must-revalidate
content-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
feature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
x-robots-tag: noindex, nofollow
content-encoding: gzip
strict-transport-security: max-age=15768000; includeSubDomains; preload;
X-Firefox-Spdy: h2

    This first request is good and the app is, I think, correctly, but just temporally, enabled.

    In nginx log:

    1.2.3.4 - - [04/Jun/2024:19:12:08 +0200] "POST /settings/apps/enable HTTP/2.0" 200 52 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0" "-" "cloud.xxxx.be"
    • The next request, as before, return a 301 and get the wrong port (4431 instead of 443):
    GET /apps/files HTTP/2
Host: cloud.xxxx.be
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: application/json, text/plain, */*
Accept-Language: fr-BE,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
requesttoken: yyyyyy
DNT: 1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Connection: keep-alive
Cookie: __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; nc_username=quenenni; nc_token=zzzzz; nc_session_id=yyyyyy; oc_sessionPassphrase=xxxxxx
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

    The response here :

    HTTP/2 301 
server: nginx
date: Tue, 04 Jun 2024 17:12:08 GMT
content-type: text/html
content-length: 162
location: https://cloud.xxxxx.be:4431/apps/files/
referrer-policy: no-referrer
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block
X-Firefox-Spdy: h2

    I still see that the request doesn't include the trailing slash (/apps/files instead of /apps/files/) as it was discussed for this problem.

    In Nginx logs:

    1.2.3.4 - - [04/Jun/2024:19:12:08 +0200] "GET /apps/files HTTP/2.0" 301 162 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0" "-" "cloud.xxxxx.be"

    From this, the browser console shows this error (the same as before):

    Content-Security-Policy: The page’s settings blocked the loading of a resource at https://cloud.xxxx.be:4431/apps/files/ (“connect-src”).
    • As this error occurred, the next request disables the app.
      This request works correctly (I can disable the apps).
    POST /settings/apps/disable HTTP/2
Host: cloud.xxxxxx.be
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: application/json, text/plain, */*
Accept-Language: fr-BE,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 26
X-Requested-With: XMLHttpRequest
requesttoken: zzzzzzzzz
Origin: https://cloud.xxxxx.be
DNT: 1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Connection: keep-alive
Cookie: __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; nc_username=quenenni; nc_token=wwwww; nc_session_id=zzzzzz; oc_sessionPassphrase=yyyyyyy; 5120d64d8f56b=xxxxxxx
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

    The response:

    HTTP/2 200 
server: nginx
date: Tue, 04 Jun 2024 17:12:08 GMT
content-type: application/json; charset=utf-8
content-length: 22
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: no-referrer
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: xxxxxx
cache-control: no-cache, no-store, must-revalidate
content-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
feature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
x-robots-tag: noindex, nofollow
content-encoding: gzip
strict-transport-security: max-age=15768000; includeSubDomains; preload;
X-Firefox-Spdy: h2

    In Nginx logs:

    1.2.3.4 - - [04/Jun/2024:19:12:08 +0200] "POST /settings/apps/disable HTTP/2.0" 200 22 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0" "-" "cloud.xxxxx.be"

    Why the trailing slash is not present when requesting /apps/files ?
    I understood the proposed fix for this problem (#44685) was to add the slash?

  10. susnux
    linked a pull request that will close this issuefix(settings): Use axios directly for health check to preven URL sanitizing #45765on Jun 10, 2024

  11. kesselb commented on Jun 27, 2024

    @kesselb
    kesselb
    on Jun 27, 2024
    Contributor

    Mind to retest with 28.0.7?

  12. quenenni commented on Jul 3, 2024

    @quenenni
    quenenni
    on Jul 3, 2024
    Author

    Hello,

    Thanks for fix.

    Same as before. I can disable an app, but still can't enable an app.

    1. The 2 requests when disabling an app:
    1 - https://cloud.xxxxx.be/settings/apps/disable

* Request headers:
POST /settings/apps/disable HTTP/2
Host: cloud.xxxxx.be
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json, text/plain, */*
Accept-Language: fr-BE,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 23
X-Requested-With: XMLHttpRequest
requesttoken: yyyyyyyyy
Origin: https://cloud.xxxxx.be
DNT: 1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Connection: keep-alive
Cookie: __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; oc_sessionPassphrase=zzzzzzz; 5120d64d8f56b=aaaaaaa; nc_username=quenenni; nc_token=bbbbbbb; nc_session_id=ccccccccc

* Response headers:
HTTP/2 200 
server: nginx
date: Wed, 03 Jul 2024 11:43:17 GMT
content-type: application/json; charset=utf-8
content-length: 22
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: no-referrer
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: YfynWrwcCcEk5mIrQrIb
cache-control: no-cache, no-store, must-revalidate
content-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
feature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
x-robots-tag: noindex, nofollow
content-encoding: gzip
strict-transport-security: max-age=15768000; includeSubDomains; preload;
X-Firefox-Spdy: h2

* POST params:
{"appIds":["activity"]}

    2 - https://cloud.xxxxx.be/ocs/v2.php/core/navigation/apps?format=json

* Request headers:
GET /ocs/v2.php/core/navigation/apps?format=json HTTP/2
Host: cloud.xxxxx.be
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json, text/plain, */*
Accept-Language: fr-BE,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
requesttoken: yyyyyyyyy
DNT: 1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Connection: keep-alive
Cookie: __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; oc_sessionPassphrase=zzzzzzzz; 5120d64d8f56b=aaaaaaaaa; nc_username=quenenni; nc_token=bbbbbbbb; nc_session_id=cccccccc
TE: trailers


* Response headers:
HTTP/2 200 
server: nginx
date: Wed, 03 Jul 2024 11:43:18 GMT
content-type: application/json; charset=utf-8
content-length: 513
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: no-referrer
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: cfqvrl00c8JTHcgnyVTk
cache-control: no-cache, no-store, must-revalidate
content-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
feature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
x-robots-tag: noindex, nofollow
etag: "b174b16f974c7587c00b1ea41730e9e4"
content-encoding: gzip
strict-transport-security: max-age=15768000; includeSubDomains; preload;
X-Firefox-Spdy: h2
    1. The 3 requests when enabling an app:
    1 - https://cloud.xxxxx.be/settings/apps/enable

* Request headers:
POST /settings/apps/enable HTTP/2
Host: cloud.xxxxx.be
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json, text/plain, */*
Accept-Language: fr-BE,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 35
X-Requested-With: XMLHttpRequest
requesttoken: yyyyyyyyy
Origin: https://cloud.xxxxx.be
DNT: 1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Connection: keep-alive
Cookie: __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; oc_sessionPassphrase=zzzzzzzz; 5120d64d8f56b=aaaaaaaaaaa; nc_username=quenenni; nc_token=bbbbbbb; nc_session_id=cccccccc
TE: trailers

* Response headers:
HTTP/2 200 
server: nginx
date: Wed, 03 Jul 2024 11:45:14 GMT
content-type: application/json; charset=utf-8
content-length: 52
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: no-referrer
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: P6mBuXLwMeyHit7muCSz
cache-control: no-cache, no-store, must-revalidate
content-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
feature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
x-robots-tag: noindex, nofollow
content-encoding: gzip
strict-transport-security: max-age=15768000; includeSubDomains; preload;
X-Firefox-Spdy: h2

* Post params:
{"appIds":["activity"],"groups":[]}

    2 - https://cloud.xxxxx.be/apps/files

* Request headers:
GET /apps/files HTTP/2
Host: cloud.xxxxx.be
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json, text/plain, */*
Accept-Language: fr-BE,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
requesttoken: yyyyyyyyy
DNT: 1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Connection: keep-alive
Cookie: __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; oc_sessionPassphrase=zzzzzzzz; 5120d64d8f56b=aaaaaaaaa; nc_username=quenenni; nc_token=bbbbbbbb; nc_session_id=cccccccccc
TE: trailers

* Response headers:
HTTP/2 301 
server: nginx
date: Wed, 03 Jul 2024 11:45:14 GMT
content-type: text/html
content-length: 162
location: https://cloud.xxxxx.be:4431/apps/files/
referrer-policy: no-referrer
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block
X-Firefox-Spdy: h2

    3 - https://cloud.xxxxx.be:4431/apps/files/

* Request headers:
GET /apps/files/ undefined
Host: cloud.xxxxx.be:4431
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: application/json, text/plain, */*
Accept-Language: fr-BE,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br

* Response headers:
N/A

    Nothing special in Nginx and Nextcloud logs.
    And same error as before in browser console.

  13. quenenni commented on Jul 3, 2024

    @quenenni
    quenenni
    on Jul 3, 2024
    Author

    If I'm updating the cloud to v29, will it be different or the same? Will it be easier for you to debug with a v29 cloud?

  14. quenenni commented on Jul 3, 2024

    @quenenni
    quenenni
    on Jul 3, 2024
    Author

    I tested on a new v29 (v29.0.3) cloud and it works for both enabling and disabling applications.
    The problem is only for v28 (or new instance).

    I'm going to try to update our main cloud to v29 and see if it's also working.

  15. kesselb commented on Jul 3, 2024

    @kesselb
    kesselb
    on Jul 3, 2024
    Contributor

    Thanks for the update 👍

    The patch missed the merge window for 28.0.7: #45770

  16. quenenni commented on Jul 3, 2024

    @quenenni
    quenenni
    on Jul 3, 2024
    Author

    Well, that explains this :)

    I tested an upgrade for a cloud in production from previous version to v29 where the problem was present in v28 and everything seems to work well.
    I didn't find any problem.

    I suppose I'll pass quickly v28 for all our clouds to go to v29.

    Big thanks for all the help.

  17. kesselb
    closed this as completedon Jul 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    0. Needs triagePending check for reproducibility or if it fits our roadmap28-feedbackbugneeds info

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions