Access controlled files can't be edited/viewed with Nextcloud Office

[maximelehericy]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

1. create a tag mytag, a group mygroup, assign a user Alice to mygroup
2. create a FAC rule as follow: When file is access AND file is tagged my mytagAND user groupmembership is not member ofmygroup` THEN block access to the file.
3. login as alice
4. create a folder
5. assign mytag to the folder, and refresh the page
6. create an Office document in the folder
7. it loads, edit the document
8. close the document
9. try to open again the document, it fails.

Expected behaviour

Alice should be able to open the document again

Actual behaviour

opening the document fails

Nextcloud log shows:

{
  "reqId": "tkLxy0we2X6ECthxIfYC",
  "level": 3,
  "time": "2026-04-14T19:53:14+00:00",
  "remoteAddr": "2a01:4f9:3a:161f::cafe",
  "user": "--",
  "app": "richdocuments",
  "method": "GET",
  "url": "/index.php/apps/richdocuments/wopi/files/1085_ocucescblmv4/contents?access_token=z98dVmVlCWhEGBR75tk4Ty6Kt1vY2LVV&access_token_ttl=0",
  "scriptName": "/index.php",
  "message": "getFile failed: Access denied by access control",
  "userAgent": "COOLWSD HTTP Agent 25.04.8.3",
  "version": "32.0.8.2",
  "exception": {
    "Exception": "OCP\\Files\\ForbiddenException",
    "Message": "Access denied by access control",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/html/custom_apps/files_accesscontrol/lib/StorageWrapper.php",
        "line": 46,
        "function": "checkFileAccess",
        "class": "OCA\\FilesAccessControl\\Operation",
        "type": "->",
        "args": [
          "Gestion du personnel/Nouveau document.docx",
          {
            "__class__": "OCA\\GroupFolders\\Mount\\GroupMountPoint"
          },
          false
        ]
      },
      {
        "file": "/var/www/html/custom_apps/files_accesscontrol/lib/StorageWrapper.php",
        "line": 235,
        "function": "checkFileAccess",
        "class": "OCA\\FilesAccessControl\\StorageWrapper",
        "type": "->",
        "args": [
          "Gestion du personnel/Nouveau document.docx",
          false
        ]
      },
      {
        "file": "/var/www/html/custom_apps/terms_of_service/lib/Filesystem/StorageWrapper.php",
        "line": 69,
        "function": "fopen",
        "class": "OCA\\FilesAccessControl\\StorageWrapper",
        "type": "->",
        "args": [
          "Gestion du personnel/Nouveau document.docx",
          "r"
        ]
      },
      {
        "file": "/var/www/html/lib/private/Files/View.php",
        "line": 1211,
        "function": "fopen",
        "class": "OCA\\TermsOfService\\Filesystem\\StorageWrapper",
        "type": "->",
        "args": [
          "Gestion du personnel/Nouveau document.docx",
          "r"
        ]
      },
      {
        "file": "/var/www/html/lib/private/Files/View.php",
        "line": 1039,
        "function": "basicOperation",
        "class": "OC\\Files\\View",
        "type": "->",
        "args": [
          "fopen",
          "/alice/files/RH/Gestion du personnel/Nouveau document.docx",
          [
            "read"
          ],
          "r"
        ]
      },
      {
        "file": "/var/www/html/lib/private/Files/Node/File.php",
        "line": 95,
        "function": "fopen",
        "class": "OC\\Files\\View",
        "type": "->",
        "args": [
          "/alice/files/RH/Gestion du personnel/Nouveau document.docx",
          "r"
        ]
      },
      {
        "file": "/var/www/html/custom_apps/richdocuments/lib/Controller/WopiController.php",
        "line": 390,
        "function": "fopen",
        "class": "OC\\Files\\Node\\File",
        "type": "->",
        "args": [
          "rb"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 204,
        "function": "getFile",
        "class": "OCA\\Richdocuments\\Controller\\WopiController",
        "type": "->",
        "args": [
          "1085",
          "z9…VV"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 118,
        "function": "executeController",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Richdocuments\\Controller\\WopiController"
          },
          "getFile"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/App.php",
        "line": 153,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Richdocuments\\Controller\\WopiController"
          },
          "getFile"
        ]
      },
      {
        "file": "/var/www/html/lib/private/Route/Router.php",
        "line": 321,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::",
        "args": [
          "OCA\\Richdocuments\\Controller\\WopiController",
          "getFile",
          {
            "__class__": "OC\\AppFramework\\DependencyInjection\\DIContainer"
          },
          {
            "_route": "richdocuments.wopi.getfile",
            "fileId": "1085_ocucescblmv4"
          }
        ]
      },
      {
        "file": "/var/www/html/lib/base.php",
        "line": 1091,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->",
        "args": [
          "/apps/richdocuments/wopi/files/1085_ocucescblmv4/contents"
        ]
      },
      {
        "file": "/var/www/html/index.php",
        "line": 25,
        "function": "handleRequest",
        "class": "OC",
        "type": "::",
        "args": []
      }
    ],
    "File": "/var/www/html/custom_apps/files_accesscontrol/lib/Operation.php",
    "Line": 81,
    "message": "getFile failed: Access denied by access control",
    "exception": [],
    "CustomMessage": "getFile failed: Access denied by access control"
  },
  "id": "69de9b3d51f47"
}

Server configuration

alptis.ltd3.nc.c

Web server: Apache/Nginx

Database: MySQL/Maria/SQLite/PostgreSQL

PHP version: 8.2/8.3/8.4

Nextcloud version: (see Nextcloud admin page)

List of activated apps

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

Nextcloud configuration

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder

Browser

Browser name: Firefox/Chrome/Safari/…

Browser version: 124/125/…

Operating system: Windows/Ubuntu/Mac/…

Browser log

Insert your browser log here, this could for example include:
a) The javascript console log
b) The network log
c) ...

[maximelehericy]

edit: modifying the rule by adding an extra condition seems to workaround the issue:

AND request remote address DOES NOT MATCH ip address of your collabora server/mask

[nickvergessen]

modifying the rule by adding an extra condition seems to workaround the issue:

That would allow anyone to do the request via richdocuments.
A fix should be done in richdocuments combined with server. They somehow need to inject the user from the Wopi token into https://github.com/nextcloud/server/blob/5981b7eb512aa411f51cad541d01c5c6e93476f0/apps/workflowengine/lib/Check/UserGroupMembership.php#L42-L49 BUT only when the token is individual per user
cc @elzody

Otherwise blocking is the expected behaviour atm.