[Bug]: TypeError: OCA\UserStatus\Controller\UserStatusController::__construct() Argument #3 ($userId) must be of type string, null given

[AndyXheli]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Error on NC 28 RC4

TypeError: OCA\UserStatus\Controller\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /var/www/nextcloud/apps/user_status/lib/Controller/UserStatusController.php#52 --

Steps to reproduce

Note Sure

Expected behavior

Not Sure

Installation method

Community Manual installation with Archive

Nextcloud Server version

28

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 22 to 23)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

{"reqId":"FmLnDVSDpkhdslGeqk0R","level":3,"time":"2023-12-10T16:01:39-06:00","remoteAddr":"172.58.164.60","user":"--","app":"PHP","method":"GET","url":"/ocs/v2.php/apps/user_status/api/v1/user_status","message":"TypeError: OCA\\UserStatus\\Controller\\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /var/www/nextcloud/apps/user_status/lib/Controller/UserStatusController.php#52","userAgent":"Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604.1","version":"28.0.0.10","data":{"app":"PHP"},"id":"6577154851e57"}

Additional info

No response

[gjpc]

A few days earlier I got this Error which may be related, the user name is redacted:

DbalException An exception occurred while executing a query: SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry **'REDACTED'** for key 'user_status_uid_ix' Exception thrown: OC\DB\Exceptions\DbalException

Nextcloud Hub 7 (28.0.1)
PHP Version: 8.2.14
DB: Type: mysql Version: 10.3.38
Operating System: Linux 5.15.0-76-generic x86_64

[SenileMonkey]

Same here. I tried reinstalling nextcloud but the problem persists. Fix?

Installation method

Community Manual installation with Archive

Nextcloud Server version

28.0.1

Operating system

Ubuntu 23.04

PHP engine version

PHP 8.2

Bug description

TypeError: OCA\UserStatus\Controller\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /var/www/nextcloud/apps/user_status/lib/Controller/UserStatusController.php#53

[gjpc]

Neither the null string error nor the duplicate entry error has reoccurred on my system. I am not using a proxy. I am also using Apache

[igebara]

Same problem after installing 28.00.
I have nextcloud via nginx reverse proxy.

[Git-ChrisSc]

Problem has not appear anymore since I have deactiviated the Cache.

[joshtrichards]

"Cache Assets" should not be enabled with Nextcloud in NPM.

NPM has a very aggressive cache configuration:

https://github.com/NginxProxyManager/nginx-proxy-manager/blob/209c1b33347d1ea82870e742edf5039cc254d7ba/docker/rootfs/etc/nginx/conf.d/include/assets.conf#L4

It serves no real purpose with Nextcloud. Typically a reverse proxy is colocated alongside Nextcloud Server (i.e. not on the other side of the world from it) and the browser caches the assets anyhow.

Having that option enabled will likely lead to numerous problems with Nextcloud because it ignores managed headers and intentional cache busting.

[naelfe]

I do have the same error message as well:
TypeError: OCA\\UserStatus\\Controller\\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /config/www/nextcloud/apps/user_status/lib/Controller/UserStatusController.php#54

They occurred the last time on 4th, 6th and 10th of March.
I am running:

• nextcloud in Docker (linuxserver/nextcloud)
• with postgres 15.6 below.
• NPM with cache assets disabled (since forever, never changed it)

The last error I have in my log is from 11th of march. I did update the container on March 13th and have no problems since.
Currently on 28.0.3- but can't say if it is a coincidence or not, because it did not happen every day.

[AndyXheli]

Also an issue on NC 29 RC1

{"reqId":"XKn8WYXOPj8rg07A9d2y","level":3,"time":"2024-04-01T08:06:17-05:00","remoteAddr":"2.2.2.2","user":"--","app":"PHP","method":"GET","url":"/ocs/v2.php/apps/user_status/api/v1/user_status","message":"TypeError: OCA\\UserStatus\\Controller\\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /var/www/nextcloud/apps/user_status/lib/Controller/UserStatusController.php#55","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0","version":"29.0.0.14","data":{"app":"PHP"},"id":"660abd3ee4fce"}

[naelfe]

Got it again on March 27th with NC 28.0.4
{"reqId":"Oywua7SP9h6Bcr7xLn9M","level":3,"time":"2024-03-27T09:33:55+00:00","remoteAddr":"XXX.XXX.XXX.XX","user":"--","app":"PHP","method":"GET","url":"/ocs/v2.php/apps/user_status/api/v1/user_status","message":"TypeError: OCA\\UserStatus\\Controller\\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /config/www/nextcloud/apps/user_status/lib/Controller/UserStatusController.php#54","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0","version":"28.0.3.2","data":{"app":"PHP"}}

-> unfortunately still present

[prismopensource]

Same problem here with NC 28.0.5 and Apache with PHP 8.2

[no-usernames-left]

This is affecting me as well (28.0.5, manual install in a VM following the published installation instructions, updated from 27):

 TypeError: OCA\UserStatus\Controller\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /var/www/nextcloud/apps/user_status/lib/Controller/UserStatusController.php#54

Is this the same bug as #25071?

[Haui1112]

Same issue here. Nextcloud docker image and nginx proxy manager. Worked for a year without issue and since the last NC update, first circles broke and killed the whole instance and now that. I dont have block common exploits, cache assets or websockets enabled, I do have custom locations caldav and carddav enabled as well as forcessl, http/2 support and HSTS, no HSTS subdomains.

Configuration here:

# ------------------------------------------------------------
# cloud.hs.***.com
# ------------------------------------------------------------


server {
  set $forward_scheme http;
  set $server         "nextcloud-app-1";
  set $port           80;

  listen 80;
listen [::]:80;

listen 443 ssl http2;
listen [::]:443 ssl http2;


  server_name cloud.hs.***.com;


  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-2/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-2/privkey.pem;

  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security "max-age=63072000; preload" always;

    # Force SSL
    include conf.d/include/force-ssl.conf;

  access_log /data/logs/proxy-host-3_access.log proxy;
  error_log /data/logs/proxy-host-3_error.log warn;

  location /.well-known/carddav {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto  $scheme;
    proxy_set_header X-Forwarded-For    $remote_addr;
    proxy_set_header X-Real-IP		$remote_addr;
    proxy_pass       http://$host:80/remote.php/dav;

    # Force SSL
    include conf.d/include/force-ssl.conf;

  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security "max-age=63072000; preload" always;
    
  }

  location /.well-known/caldav {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto  $scheme;
    proxy_set_header X-Forwarded-For    $remote_addr;
    proxy_set_header X-Real-IP		$remote_addr;
    proxy_pass       http://$host:80/remote.php/dav;

    
    # Force SSL
    include conf.d/include/force-ssl.conf;

  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security "max-age=63072000; preload" always;

  }

  location / {

  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security "max-age=63072000; preload" always;

    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

[joshtrichards]

deployed with nextcloud AIO with Nginx Proxy Manager

@pktiuk Can you confirm Cache Assets is off (in NPM)? Some people here are triggering this bug due to that (which is a misconfiguration). Others... not sure.

[joshtrichards]

For those of you seeing these requests come in via your browser - e.g.

:"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0","version":"28.0.3.2","data":{"app":"PHP"}}

Can you check your browser inspector and under the Network tab see what Request Headers are being sent during these failing requests? They'll likely be easy to spot under your Network tab since they'll be red due to a 500 error.

Please also check Administration settings->Overview and make sure you're not getting any other errors or warnings.

[naelfe]

For those of you seeing these requests come in via your browser - e.g.

:"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0","version":"28.0.3.2","data":{"app":"PHP"}}

Can you check your browser inspector and under the Network tab see what Request Headers are being sent during these failing requests? They'll likely be easy to spot under your Network tab since they'll be red due to a 500 error.

Please also check Administration settings->Overview and make sure you're not getting any other errors or warnings.

first off:
Cashe Assets are turned off in nginx reverse proxy

these two errors do happen at almost the same time:
A)
{"reqId":"EQRhPHDZ5n5tgtc1Q000","level":3,"time":"2024-07-04T07:21:10+00:00","remoteAddr":"192.xxx.xxx.xxx","user":"--","app":"no app in context","method":"GET","url":"/js/core/merged-template-prepend.js?v=1823dd9b-23","message":"Could not decrypt or decode encrypted session data","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0","version":"29.0.3.4","exception":{"Exception":"Exception","Message":"HMAC does not match.","Code":0,"Trace":[{"file":"/app/www/public/lib/private/Security/Crypto.php","line":119,"function":"decryptWithoutSecret","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/app/www/public/lib/private/Session/CryptoSessionData.php","line":91,"function":"decrypt","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/app/www/public/lib/private/Session/CryptoSessionData.php","line":68,"function":"initializeSession","class":"OC\\Session\\CryptoSessionData","type":"->"},{"file":"/app/www/public/lib/private/Session/CryptoWrapper.php","line":112,"function":"__construct","class":"OC\\Session\\CryptoSessionData","type":"->"},{"file":"/app/www/public/lib/base.php","line":455,"function":"wrapSession","class":"OC\\Session\\CryptoWrapper","type":"->"},{"file":"/app/www/public/lib/base.php","line":711,"function":"initSession","class":"OC","type":"::"},{"file":"/app/www/public/lib/base.php","line":1181,"function":"init","class":"OC","type":"::"},{"file":"/app/www/public/index.php","line":47,"args":["/app/www/public/lib/base.php"],"function":"require_once"}],"File":"/app/www/public/lib/private/Security/Crypto.php","Line":158,"message":"Could not decrypt or decode encrypted session data","exception":{},"CustomMessage":"Could not decrypt or decode encrypted session data"}}
B)
{"reqId":"14n0PVpJekNRH7Vf5000","level":3,"time":"2024-07-04T07:21:11+00:00","remoteAddr":"192.xxx.xxx.xxx","user":"--","app":"PHP","method":"GET","url":"/ocs/v2.php/apps/user_status/api/v1/user_status","message":"TypeError: OCA\\UserStatus\\Controller\\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /config/www/nextcloud/apps/user_status/lib/Controller/UserStatusController.php#55","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0","version":"29.0.3.4","data":{"app":"PHP"}}

This one happens, but does not seem to be timing related:
{"reqId":"bSegYDgv3XGT5I54n000","level":2,"time":"2024-07-04T07:25:05+00:00","remoteAddr":"","user":"--","app":"cron","method":"","url":"--","message":"Used memory grew by more than 10 MB when executing job OC\\FilesMetadata\\Job\\UpdateSingleMetadata (id: 14519, arguments: [\"xyz\",189641]): 51.9 MB (before: 35.5 MB)","userAgent":"--","version":"29.0.3.4","data":{"app":"cron"}}

then these 3 are almost at the same time:
A)
{"reqId":"LDzHL2T2UZQTx6hBZN000","level":3,"time":"2024-07-05T17:54:29+00:00","remoteAddr":"000.000.000.000","user":"--","app":"no app in context","method":"MKCOL","url":"/remote.php/dav/files/abc/Photos/Camera%20Roll","message":"Could not decrypt or decode encrypted session data","userAgent":"Mozilla/5.0 (iOS) Nextcloud-iOS/5.4.1","version":"29.0.3.4","exception":{"Exception":"Exception","Message":"HMAC does not match.","Code":0,"Trace":[{"file":"/app/www/public/lib/private/Security/Crypto.php","line":119,"function":"decryptWithoutSecret","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/app/www/public/lib/private/Session/CryptoSessionData.php","line":91,"function":"decrypt","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/app/www/public/lib/private/Session/CryptoSessionData.php","line":68,"function":"initializeSession","class":"OC\\Session\\CryptoSessionData","type":"->"},{"file":"/app/www/public/lib/private/Session/CryptoWrapper.php","line":112,"function":"__construct","class":"OC\\Session\\CryptoSessionData","type":"->"},{"file":"/app/www/public/lib/base.php","line":455,"function":"wrapSession","class":"OC\\Session\\CryptoWrapper","type":"->"},{"file":"/app/www/public/lib/base.php","line":711,"function":"initSession","class":"OC","type":"::"},{"file":"/app/www/public/lib/base.php","line":1181,"function":"init","class":"OC","type":"::"},{"file":"/app/www/public/remote.php","line":119,"args":["/app/www/public/lib/base.php"],"function":"require_once"}],"File":"/app/www/public/lib/private/Security/Crypto.php","Line":158,"message":"Could not decrypt or decode encrypted session data","exception":{},"CustomMessage":"Could not decrypt or decode encrypted session data"}}
B)
{"reqId":"2xS5rENHqVM9ytpxmG000","level":3,"time":"2024-07-05T17:54:29+00:00","remoteAddr":"000.000.000.000","user":"--","app":"no app in context","method":"GET","url":"/ocs/v2.php/apps/dashboard/api/v1/widgets","message":"Could not decrypt or decode encrypted session data","userAgent":"Mozilla/5.0 (iOS) Nextcloud-iOS/5.4.1","version":"29.0.3.4","exception":{"Exception":"Exception","Message":"HMAC does not match.","Code":0,"Trace":[{"file":"/app/www/public/lib/private/Security/Crypto.php","line":119,"function":"decryptWithoutSecret","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/app/www/public/lib/private/Session/CryptoSessionData.php","line":91,"function":"decrypt","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/app/www/public/lib/private/Session/CryptoSessionData.php","line":68,"function":"initializeSession","class":"OC\\Session\\CryptoSessionData","type":"->"},{"file":"/app/www/public/lib/private/Session/CryptoWrapper.php","line":112,"function":"__construct","class":"OC\\Session\\CryptoSessionData","type":"->"},{"file":"/app/www/public/lib/base.php","line":455,"function":"wrapSession","class":"OC\\Session\\CryptoWrapper","type":"->"},{"file":"/app/www/public/lib/base.php","line":711,"function":"initSession","class":"OC","type":"::"},{"file":"/app/www/public/lib/base.php","line":1181,"function":"init","class":"OC","type":"::"},{"file":"/app/www/public/ocs/v1.php","line":31,"args":["/app/www/public/lib/base.php"],"function":"require_once"},{"file":"/app/www/public/ocs/v2.php","line":23,"args":["/app/www/public/ocs/v1.php"],"function":"require_once"}],"File":"/app/www/public/lib/private/Security/Crypto.php","Line":158,"message":"Could not decrypt or decode encrypted session data","exception":{},"CustomMessage":"Could not decrypt or decode encrypted session data"}}
C)
{"reqId":"exqWBRjXoQO2xyQHj0000","level":2,"time":"2024-07-05T17:55:04+00:00","remoteAddr":"","user":"--","app":"cron","method":"","url":"--","message":"Used memory grew by more than 10 MB when executing job OC\\FilesMetadata\\Job\\UpdateSingleMetadata (id: 14648, arguments: [\"abc\",190358]): 51 MB (before: 31.1 MB)","userAgent":"--","version":"29.0.3.4","data":{"app":"cron"}}

I do use NC on 2 seperate PCs view browser (both firefox) and on the iOS app.
Prolem is, that I can't reproduce the error. It does work multiple days and I can access everything just by typing in my URL.
Some time however (afer days or weeks), it tries to load, gets an error and forces me to log back in again (with 2fa mail). Don't know what triggers it.

because I currently do not have an error, here are the headers I can show you:
{ "Request Headers (900 B)": { "headers": [ { "name": "Accept", "value": "application/json, text/plain, */*" }, { "name": "Accept-Encoding", "value": "gzip, deflate, br, zstd" }, { "name": "Accept-Language", "value": "en-US,en;q=0.5" }, { "name": "Connection", "value": "keep-alive" }, { "name": "Cookie", "value": "__Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; oc_sessionPassphrase=abc; abc=def; nc_username=abc; nc_token=abc; nc_session_id=abc" }, { "name": "DNT", "value": "1" }, { "name": "Host", "value": "nextcloud.abc.de" }, { "name": "requesttoken", "value": "abc/def/ghi=:jkl/mno" }, { "name": "Sec-Fetch-Dest", "value": "empty" }, { "name": "Sec-Fetch-Mode", "value": "cors" }, { "name": "Sec-Fetch-Site", "value": "same-origin" }, { "name": "TE", "value": "trailers" }, { "name": "User-Agent", "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" } ] } }

Btw I do not have to re-login on the iOS app, only in the browser, and only every couple of days / weeks. Did never have the probling with NC27 and before, only since NC28 and NC29 did not fix it :(

[joshtrichards]

Thanks, @naelfe.

This confirms my suspicion (at least in your case).

That first error is closer to the cause than the user status error this issue has been focused on so far. So that is helpful.

The user status TypeError should only occur if the user session is already somehow messed up. Which is what the first error immediately preceding it is indicating.

Now we know to not spend any time looking at the user status code because that's not where the problem is.

Still not sure of the root cause, but it gets us closer to the origin. And it's quite possibly related to a couple other open Issues (or at least the work on them may turn up something useful here).

Of course the ability to reproduce would be ideal, but we work with what we've got sometimes. :-)

[prismopensource]

Could this be related to the user_external app maybe?

[naelfe]

Could this be related to the user_external app maybe?

Unfortunately I do not have it enabled :(

Since we are already at that topic- apps that I once had installed and are currently disabled:

The only two non-featured apps I do have active are:
https://github.com/nextcloud/quota_warning
https://github.com/nursoda/twofactor_email <- this one seems to work fine- but it is officially not compatible as far as I know. Currently forced

also currently using
https://github.com/nextcloud/news in alpha

update / edit:
but maybe there is a relation to this one #42157
I do have only one token though for iOS app + contacts / calendar. I did use it also for the notes app, but deleted it a while ago.

[AndyXheli]

Error in NC 20.0.4 RC1

{"reqId":"3RGhrT2kz83e7gP6iobX","level":3,"time":"2024-07-12T23:37:44-05:00","remoteAddr":"10.9.0.4","user":"--","app":"PHP","method":"GET","url":"/ocs/v2.php/apps/user_status/api/v1/user_status","message":"TypeError: OCA\\UserStatus\\Controller\\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /var/www/nextcloud/apps/user_status/lib/Controller/UserStatusController.php#55","userAgent":"Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1","version":"29.0.4.0","data":{"app":"PHP"},"id":"6692b0f24b123"}

[AndyXheli]

Nextcloud 30.0.1 RC2

{"reqId":"c4C2hpRQTvCWgOvThK9S","level":3,"time":"2024-10-14T17:24:33-05:00","remoteAddr":"172.59.189.36","user":"--","app":"PHP","method":"GET","url":"/ocs/v2.php/apps/user_status/api/v1/user_status","message":"TypeError: OCA\\UserStatus\\Controller\\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /var/www/nextcloud/apps/user_status/lib/Controller/UserStatusController.php#36","userAgent":"Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/130.0.6723.37 Mobile/15E148 Safari/604.1","version":"30.0.1.1","data":{"app":"PHP"},"id":"670e77493faac"}