[Bug]: + (plus) character in file name causes server 500 error WITH Q&D FIX #40943

mrAceT · 2023-10-17T10:17:29Z

⚠️ This issue respects the following points: ⚠️

This is a bug, not a question or a configuration/webserver/proxy issue.
This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
I agree to follow Nextcloud's Code of Conduct.

Bug description

When one has a file with a "plus character" in it (like "image +error.jpg" of "doc +error.docx") and one wants to open/access it, it gives an ERROR 500 (documents) of with an image the "loading circle" keeps turning..

AD: when an image has [a-z][space][plus][a-z] the loading-symbol keeps turning, renaming via the web interface isn't possible anymore.. also renaming via the desktop only works locally, it does not sync!!

Steps to reproduce

create / rename file with a '+' in it
open/rename it...

Expected behavior

allow files with a '+' in it?

Installation method

Community Web installer on a VPS or web space

Nextcloud Server version

25

Operating system

RHEL/CentOS

PHP engine version

PHP 8.0

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 22.1 to 22.2)

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

Default user-backend (database)
LDAP/ Active Directory
SSO - SAML
Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

I am now at version 25.0.10 I will update to 25.0.12 this night (local time) If that solves the problem I'll mention it here

mrAceT · 2023-10-17T10:22:06Z

AD: I use AWS-S3 for data storage, I do not know it that is important..
(I have checked the corresponding 'urn:oid:[0-9]+' file exists)

This is quite a big problem.. I am unable to edit/rename/remove/move the file with a '+' in it. Not even removing the '+' manually in oc_filecache in path and name allows me to regain access.. once a file has a '+' in it it is 'locked and no longer accessable'

joshtrichards · 2023-10-17T14:59:36Z

S3 as Primary Storage or as an External Storage mount? (sounds like Primary Storage since you mention checking urn but just confirming for certain).

joshtrichards · 2023-10-17T15:01:23Z

Also can you provide the associated log entries from your nextcloud.log (or equivalent) from when the 500 is generated?

mrAceT · 2023-10-17T15:07:16Z

AWS-S3 is set as primary

privacy corrected log entry:

:{"reqId":"ZS5XmxaaRGq80S1H6XCy1wAAAQA","level":3,"time":"2023-10-17T09:44:59+00:00","remoteAddr":"1.2.3.4","user":"account","app":"remote","method":"GET","url":"/remote.php/webdav/folder/file%20with%20%2Bin%20it\.ext","message":"The requested uri(/remote.php/webdav/folder/file%20with%20%2Bin%20it.ext) cannot be processed by the script '/remote.php/webdav/folder/file with +in it.ext')","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36","version":"25.0.10.1","exception":{"Exception":"Exception","Message":"The requested uri(/remote.php/webdav/folder/file%20with%20%2Bin%20it.ext) cannot be processed by the script '/remote.php/webdav/folder/file with +in it.ext')","Code":0,"Trace":[{"file":"/var/www/vhost/cloud.knoopbeheer.nl/public_html/lib/private/AppFramework/Http/Request.php","line":764,"function":"getRawPathInfo","class":"OC\\AppFramework\\Http\\Request","type":"->"},{"file":"/var/www/vhost/cloud.knoopbeheer.nl/public_html/remote.php","line":147,"function":"getPathInfo","class":"OC\\AppFramework\\Http\\Request","type":"->"}],"File":"/var/www/vhost/cloud.knoopbeheer.nl/public_html/lib/private/AppFramework/Http/Request.php","Line":738,"message":"The requested uri(/remote.php/webdav/folder/file%20with%20%2Bin%20it.ext) cannot be processed by the script '/remote.php/webdav/folder/file with +in it.ext')","exception":{},"CustomMessage":"The requested uri(/remote.php/webdav/folder/file%20with%20%2Bin%20it\.ext) cannot be processed by the script '/remote.php/webdav/folder/file with +in it.ext')"}}

solracsf · 2023-10-17T15:40:00Z

See also:
#40594
#39730
#7762

mrAceT · 2023-10-17T16:59:07Z

I've taken a quick look at the links you provided. (thanks)

But, I use AWS-S3 so I'dd expect this not to be an OS-filesystem issue, but a bug in handling the '+' sign in the code somewhere..

I've done a search in my oc_filecache and there are some 70 files in there with a '+' in it.. and I've tested.. those files are "locked & lost" in the system now.. Is there any workaround for this? (renaming the files in the database doesn't seem to work..)

solracsf · 2023-10-17T19:57:14Z

This doesn't help you... but I can't reproduce your issue, when using filesystem (not S3) on v26.
File can be uploaded, opened, renamed, deleted.

mrAceT · 2023-10-18T13:02:29Z

updated to 25.10.12, no change

mrAceT · 2023-10-18T13:44:17Z

upgraded my test environment to 26.0.7, no change..

Might this somehow be related to my AWS-S3 setup?

I tried other versions, PHP 7.4 is not allowed, PHP 8.0 and PHP 8.1 have the same errors..

on the console of Chrome see this with an image (attempting to view):

Viewer.vue:524 Could not open file /test/_test +9.jpg Error: Invalid response: No root multistatus found
    at p (dav.js:45:15)
    at dav.js:64:17
    at new Promise (<anonymous>)
    at t.parseXML (dav.js:55:12)
    at stat.js:66:52
    at stat.js:33:23
    at Object.next (stat.js:14:53)
    at a (stat.js:5:58)
openFile @ Viewer.vue:524

mrAceT · 2023-10-18T13:46:37Z

Could it be that I need to or can force a character set in the apache vhost? Or something in the .htaccess to force something?

"It smells like a character (set) issue"

mrAceT · 2023-10-18T14:00:56Z

in the access-log I see a succesfull PROPFIND:

"PROPFIND /remote.php/dav/files/[user]/test/_test%20%2B9.jpg HTTP/1.1" 200 3231

Could there be something wrong in stat.js or dav.js? (I am unable to find those files?)

mrAceT · 2023-10-18T14:57:28Z

I could build a script to remove those 'plusses' from the database.. since I'm using AWS-S3 that's the only spot where those 'plusses' are..

Why can't I remove the 'plusses' in the database? in oc_filecache in the fields path and name?

Or is path_hash the party pooper? (how do I generate that hash?)

update
I did a little digging and when I do the following alteration in oc_filecache :

remove the '+' of that file in path and name
set path_hash to md5('new name') (without the +)

I can access, rename/move etc the file again

It's not pretty but I can run a script each night performing this rename.. that at least prevents those zombie files..

I do hope a better solution can be provided

mrAceT · 2023-10-19T16:48:27Z

The plot thinkens.. (I was working on a script...)

when I have a file with NO space in front or after of the '+' there is no problem!

But when there is a space before or after it, the problem arises!

@solracsf could you verify?

solracsf · 2023-10-20T12:15:19Z

No problem with image + error.jpg or image +error.jpg or image+ error.jpg
File can always be uploaded, opened, renamed, deleted and restored from trash.

mrAceT · 2023-10-20T19:12:18Z

Thanks for checking @solracsf , much appreciated.. the digging continues..

mrAceT · 2023-12-21T16:29:31Z

This bug is getting more troublesome.. So I decided to force a rename from '+' to '&' in the files..

When looking at the 'oc_filecache' structure, the path_hash is an 'md5' of the 'path' variable (including the file name). renaming (also the 'name' column) and updating the md5 does the trick on the server side..

BUT synchronization towards the client is "spotty at best".. is there any way to trigger a re-sync of those files?

I've also looked at Sabre/DAV to use renaming.. but this problem is over multiple users and I don;t have all the passwords.. and I didn't find a "super user option"..

Does anyone have an idea? All help is welcome..

mrAceT · 2023-12-21T17:11:49Z

I’ve done some more searching and found this in ‘owncloud’ that might be related: owncloud/core#34600

Reading that issue got me searching in a different way, and I found this closed issue:
#4036
Which was re-opened/moved to this issue:
#15849

there is a suggestion it might be fixed with:
#40594

mrAceT · 2023-12-21T20:19:30Z

FIXED IT!

Well.. "Quick and Dirty" that is...

As it turns out, the root cause is the same as it was with spaces!! check: #37852

And my "Q&D fix" there also fixes this problem!

So there needs to be an "next level fix" done like https://github.com/php/php-src/blob/PHP-8.1/NEWS#L38L63

But then to fix the "+" like they fixed the "space"... grmpf..

Might it be a good idea to include a variant of my "Q&D" in Nextcloud?

But thank the almighty that I now finally am rid of this nasty bug..

For reference, this bug (all with PHP 8.1.18+) is present in 25.x, 26.x and 27.x (tested them all..)

PS: I am running PHP 8.1.27

mrAceT · 2024-01-31T16:52:27Z

@skjnldsv thanks for closing this bug report, as the bug had been resolved in PHP! (see the closed bug report above)

mrAceT added 0. Needs triage Pending check for reproducibility or if it fits our roadmap bug labels Oct 17, 2023

szaimen added the 25-feedback label Oct 17, 2023

joshtrichards added the feature: files label Oct 17, 2023

mrAceT changed the title ~~[Bug]: + (plus) character in file name causes server 500 error~~ [Bug]: + (plus) character in file name causes server 500 error WITH Q&D FIX Dec 21, 2023

mrAceT mentioned this issue Dec 21, 2023

Incorrect SCRIPT_NAME with apache ProxyPassMatch when a plus '+' is in path php/php-src#12996

Closed

solracsf mentioned this issue Jan 18, 2024

[Bug]: Problem with external storage (WebDAV) and folder names with "+" in it, in combination with Synology WebDav server or rclone Webdav server #42932

Closed

8 tasks

skjnldsv mentioned this issue Jan 30, 2024

dav: fix wrong decoding of pluses in URLs #40594

Merged

4 tasks

skjnldsv added 3. to review Waiting for reviews and removed 0. Needs triage Pending check for reproducibility or if it fits our roadmap labels Jan 31, 2024

skjnldsv closed this as completed in #40594 Jan 31, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Bug]: + (plus) character in file name causes server 500 error WITH Q&D FIX #40943

[Bug]: + (plus) character in file name causes server 500 error WITH Q&D FIX #40943

mrAceT commented Oct 17, 2023

mrAceT commented Oct 17, 2023 •

edited

Loading

joshtrichards commented Oct 17, 2023 •

edited

Loading

joshtrichards commented Oct 17, 2023

mrAceT commented Oct 17, 2023 •

edited

Loading

solracsf commented Oct 17, 2023

mrAceT commented Oct 17, 2023

solracsf commented Oct 17, 2023 •

edited

Loading

mrAceT commented Oct 18, 2023

mrAceT commented Oct 18, 2023 •

edited

Loading

mrAceT commented Oct 18, 2023

mrAceT commented Oct 18, 2023

mrAceT commented Oct 18, 2023 •

edited

Loading

mrAceT commented Oct 19, 2023

solracsf commented Oct 20, 2023

mrAceT commented Oct 20, 2023

mrAceT commented Dec 21, 2023

mrAceT commented Dec 21, 2023

mrAceT commented Dec 21, 2023 •

edited

Loading

mrAceT commented Jan 31, 2024

[Bug]: + (plus) character in file name causes server 500 error WITH Q&D FIX #40943

[Bug]: + (plus) character in file name causes server 500 error WITH Q&D FIX #40943

Comments

mrAceT commented Oct 17, 2023

⚠️ This issue respects the following points: ⚠️

Bug description

Steps to reproduce

Expected behavior

Installation method

Nextcloud Server version

Operating system

PHP engine version

Web server

Database engine version

Is this bug present after an update or on a fresh install?

Are you using the Nextcloud Server Encryption module?

What user-backends are you using?

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

mrAceT commented Oct 17, 2023 • edited Loading

joshtrichards commented Oct 17, 2023 • edited Loading

joshtrichards commented Oct 17, 2023

mrAceT commented Oct 17, 2023 • edited Loading

solracsf commented Oct 17, 2023

mrAceT commented Oct 17, 2023

solracsf commented Oct 17, 2023 • edited Loading

mrAceT commented Oct 18, 2023

mrAceT commented Oct 18, 2023 • edited Loading

mrAceT commented Oct 18, 2023

mrAceT commented Oct 18, 2023

mrAceT commented Oct 18, 2023 • edited Loading

mrAceT commented Oct 19, 2023

solracsf commented Oct 20, 2023

mrAceT commented Oct 20, 2023

mrAceT commented Dec 21, 2023

mrAceT commented Dec 21, 2023

mrAceT commented Dec 21, 2023 • edited Loading

mrAceT commented Jan 31, 2024

mrAceT commented Oct 17, 2023 •

edited

Loading

joshtrichards commented Oct 17, 2023 •

edited

Loading

mrAceT commented Oct 17, 2023 •

edited

Loading

solracsf commented Oct 17, 2023 •

edited

Loading

mrAceT commented Oct 18, 2023 •

edited

Loading

mrAceT commented Oct 18, 2023 •

edited

Loading

mrAceT commented Dec 21, 2023 •

edited

Loading