Cannot open uploaded docx file when using object storage and encryption

[max-nextcloud]

Describe the bug Opening an uploaded docx file fails. Error message says it could not be decrypted and I should request the share to be reshared.

To Reproduce Steps to reproduce the behavior:

1. Use latest Nextcloud
2. Enable object storage and encryption
3. Upload a docx file
4. Try to open the file
5. See error

Expected behavior It should open the file fine.

Screenshots

Client details:

• OS: [e.g. iOS]
• Browser [e.g. chrome, safari] Chrome
• Version [e.g. 22]
• Device: [e.g. iPhone6, desktop]

Server details

Operating system: nextcloud-docker-dev

[juliusknorr]

• WOPI getFile fails with Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.
• Works fine on stable24-stable26
• Looks like it could be caused by server changes as reverting the one possible related line in WopiController didn't fix

[juliusknorr]

Doesn't seem to be limited to object storage as reported in https://github.com/nextcloud/all-in-one/issues/2773

[EukalyptusX]

Somehow, the files I tried to open, will be destroyed after "opening". I can't even download the files anymore - just nothing happens. But just the files, I tried to open. The files I didn't try to open can be downloaded Just fine. I guess it's somehow related. Will I be able to download them after the planned merge? Or are the files irreversible destroyed?

[karlemilnikka]

Now that Nextcloud AIO automatically upgrades the Nextcloud container to 27, more users are experiencing this issue.

https://help.nextcloud.com/t/cannot-decrypt-this-file-probably-this-is-a-shared-file-please-ask-the-file-owner-to-reshare-the-file-with-you/166856/

[FlattusBlastus]

Maybe related to this? Clean install, all IPv6 removed, latest: 2023-08-20 13:02:12 wsd-00001-00001 2023-08-20 13:02:12.881243 -0700 [ coolwsd ] TRC Have 1 new children.| wsd/COOLWSD.cpp:5722 2023-08-20 13:02:12 wsd-00001-00001 2023-08-20 13:02:12.881271 -0700 [ coolwsd ] INF WSD initialization complete: setting log-level to [warning] as configured.| wsd/COOLWSD.cpp:5738 2023-08-20 13:02:12 wsd-00001-00015 2023-08-20 13:02:12.881258 -0700 [ prisoner_poll ] TRC Executing SocketDisposition of #16: Type::CONTINUE| net/Socket.cpp:684 2023-08-20 13:02:12 Ready to accept connections on port 9980. 2023-08-20 13:02:12 2023-08-20 13:02:14 wsd-00001-00019 2023-08-20 13:02:14.940178 -0700 [ remotefontconfig_poll ] ERR Remote config server has response status code: 502 (Bad Gateway)| wsd/COOLWSD.cpp:1188 2023-08-20 13:03:15 wsd-00001-00019 2023-08-20 13:03:15.023311 -0700 [ remotefontconfig_poll ] ERR Remote config server has response status code: 502 (Bad Gateway)| wsd/COOLWSD.cpp:1188

[juliusknorr]

I've been trying to reproduce this but wasn't able anymore on latest stable27/master.

As far as reading code goes this seems to have been fixed by https://github.com/nextcloud/server/pull/39454. For files have been running into this bug before the patch was introduced with 27.0.1 there is not much we can do from the richdocuments app side (I'm not sure in general if there is a way to recover, but this is something for a different topic).

Anyone seeing this, could you please check if this is still reproducible for you with new files or fresh uploads of a file? If so please provide detailed steps to get to the failure state in a new ticket. Also clearly state if you are using a new or existing file, if the file can still be downloaded and if master keys encrpytion is enabled (default) or disabled.

[karlemilnikka]

@juliushaertl I confirm that I now can create, upload and edit new files (existing files are still affected).

[YoannPa]

Anyone seeing this, could you please check if this is still reproducible for you with new files or fresh uploads of a file? If so please provide detailed steps to get to the failure state in a new ticket. Also clearly state if you are using a new or existing file, if the file can still be downloaded and if master keys encrpytion is enabled (default) or disabled.

Hi @juliushaertl : I still have this issue on existing files after upgrading nextcloud server to the version 27.0.2. I had .docx files stored on a nextcloud account. Opening one of them displayed the error message. The error message has overwritten the file. Downloading it, simply download the error message displayed in it. Creating a new file however is not leading to this issue (download is also fine). So the bug is only on files created before the upgrade to 27.0.2. Is there a plan to fix this issue?

Thank you for your help.

[max-nextcloud]

@karlemilnikka @YoannPa based on the underlying issue and its fix ( https://github.com/nextcloud/server/issues/39034 ) - could you check if sharing the file in question so that share keys get updated fixes the issue for that particular file?

[YoannPa]

Hi @max-nextcloud , I am sorry but I think we are not talking about the same thing (my bad if so). The files for which I have this issue in Nextcloud version 27.0.2, are not necessarily shared. And the issue impacts multiple file formats : .docx of course. But also .xlsx, .pptx, .odt, .ods, .odp. It is not even yet a question of re-sharing the file. Most of my .docx files are not shared. Yet this is what happen when I try to open one since the upgrade to 27.0.2 (SNS Cloud is the name of my server; I took the freedom to hide the file name and the server's motto): My current fix for this situation is to download the file before opening it in Collabora (to avoid loosing its content definitively), and to simply re-upload the downloaded file. After the re-upload the file loads without any trouble into Collabora interface.

Also, I don't know why, but since the upgrade, the Collabora interface has switch to dark mode when the loading of a file fails. Not a big trouble, but still very strange.

Hope this feed back is useful any way.

[juliusknorr]

Creating a new file however is not leading to this issue (download is also fine). So the bug is only on files created before the upgrade to 27.0.2. Is there a plan to fix this issue?

From my current insight, there is no way to fix this case from the richdocuments side, and I'm also not sure if this can be done on the server side. Especially if the plain download is also failing this would indicate that that the encryption keys are not available for properly reading the file content.

[YoannPa]

@juliushaertl If you read my second message, I give more details about the situation:

Hi @max-nextcloud , I am sorry but I think we are not talking about the same thing (my bad if so). The files for which I have this issue in Nextcloud version 27.0.2, are not necessarily shared. And the issue impacts multiple file formats : .docx of course. But also .xlsx, .pptx, .odt, .ods, .odp. It is not even yet a question of re-sharing the file. Most of my .docx files are not shared. Yet this is what happen when I try to open one since the upgrade to 27.0.2 (SNS Cloud is the name of my server; I took the freedom to hide the file name and the server's motto): My current fix for this situation is to download the file before opening it in Collabora (to avoid loosing its content definitively), and to simply re-upload the downloaded file. After the re-upload the file loads without any trouble into Collabora interface.

Also, I don't know why, but since the upgrade, the Collabora interface has switch to dark mode when the loading of a file fails. Not a big trouble, but still very strange.

Hope this feed back is useful any way.

Actually, unless you open a .docx file in Collabora before (because it is the opening in Collabora that remove the content of the file, replacing it by the error message), just downloading the .docx file works fine. So manually one can just: donwload a .docx file, and simply re-upload it. Doing this prevent the Collabora error to happen (and prevent the replacement of the file content by the error message). Reading so many people facing this situation: I hope there will be a solution, either from richdocument, or from nextcloud server... because this is severe and doesn't make it possible anymore to use Collabora (I decided to deactivate it on my server to prevent any user from erasing the content of their documents by clicking their files in Nextcloud).

[Dominion0815]

I also encounter this issue. Since 27.0.2 is stable in docker our docx files are broken after opening with office. Then it is not possible to download the file. File is damaged!

[YoannPa]

@Dominion0815 if you have admin permissions over the Nextcloud server, I may be able to share a small tutorial on how to fix this situation in the coming days, as I also have to treat this on the server I administrate. It won't be as great as a real fix from collabora and nextcloud server, but at least it may fix this issue. Best advice until a solution comes up: deactivate Collabora in Nextcloud. This way if a user click on a document in his files, he will not erase its content, it will just download the file.

[Dominion0815]

@YoannPa Yeah that would be great ! Collabora is already disabled.

[Dominion0815]

I was able to recover a damaged file by restoring only the Keys:

/nextcloud-data/USER/files_encryption/keys/files/Neues\ Dokument.docx/OC_DEFAULT_MODULE/ insgesamt 13K drwxr-xr-x 2 www-data www-data 4,0K 15. Sep 21:15 . drwxr-xr-x 3 www-data www-data 4,0K 15. Sep 15:04 .. -rw-r--r-- 1 www-data www-data 292 15. Sep 21:15 fileKey -rw-r--r-- 1 www-data www-data 1,6K 15. Sep 21:15 master_d7362778.shareKey -rw-r--r-- 1 www-data www-data 1,6K 15. Sep 21:15 pubShare_d7362778.shareKey

[YoannPa]

@YoannPa Yeah that would be great ! Collabora is already disabled.

@Dominion0815 Here is a first draft: https://gist.github.com/YoannPa/69d044f93c58a870ccad1cc2efdda791 I'm not yet entirely sure that it fixes the issue. Basically it just reupload everything (and so re-encrypt everything).

[YoannPa]

It seems that the latest upgrade Nextcloud 27.1.1 fixed the issue.

[wgalafassijr]

I was able to recover a damaged file by restoring only the Keys:

/nextcloud-data/USER/files_encryption/keys/files/Neues\ Dokument.docx/OC_DEFAULT_MODULE/ insgesamt 13K drwxr-xr-x 2 www-data www-data 4,0K 15. Sep 21:15 . drwxr-xr-x 3 www-data www-data 4,0K 15. Sep 15:04 .. -rw-r--r-- 1 www-data www-data 292 15. Sep 21:15 fileKey -rw-r--r-- 1 www-data www-data 1,6K 15. Sep 21:15 master_d7362778.shareKey -rw-r--r-- 1 www-data www-data 1,6K 15. Sep 21:15 pubShare_d7362778.shareKey

can you please detail how is the process?