Wrong public WOPI url: Ignored user configuration and used wrong detection

[recolic]

[RCA has been located, see bottom]

Describe the bug
As a noob, I'm trying to set a fresh new Nextcloud-Office server. I installed RichDocuments and RichDocumentsCode app, went to admin dashboard to set online server URL.

I click save, it works. But I refresh the page, it send /discovery query to wrong URL, and received mixed-content error.

To Reproduce
Steps to reproduce the behavior:

1. Install RichDocuments and RichDocumentsCode app
2. Go to admin dashboard, locate server URL, click save
3. Looks like it works
4. Click refresh, it's broken (F12 shows it's sending discovery to completely wrong URL)

Expected behavior
It should just works.

Screenshots

I click save, it looks good:

I refresh the page, it still use bad URL:

Client details:

• OS: Any OS
• Browser : Any Browser
• Version [e.g. 22]
• Device: Desktop

Server details

Operating system: Ubuntu 2204 running Nextcloud Docker nextcloud:29.0.10

Web server: Docker nextcloud:29.0.10 built-in

Database: sqlite

PHP version: Docker nextcloud:29.0.10 built-in

Nextcloud version: Docker nextcloud:29.0.10 built-in

Version of the richdocuments app

Version of Collabora Online

Configuration of the richdocuments app

root@drive-git-server /s/nextcloud# docker exec -u 33 -ti rdrive ./occ config:list richdocuments
{
    "apps": {
        "richdocuments": {
            "installed_version": "8.4.11",
            "enabled": "yes",
            "types": "prevent_group_restriction",
            "wopi_url": "https:\/\/drive.recolic.cc\/custom_apps\/richdocumentscode\/proxy.php?req=",
            "disable_certificate_verification": "yes",
            "wopi_allowlist": "",
            "public_wopi_url": "http:\/\/drive.recolic.cc",
            "wopi_callback_url": ""
        }
    }
}

RCA

I can easily tell what's going wrong: The web dashboard doesn't set public_wopi_url. It only set wopi_url which is not used at all.

1. Could someone help fix the frontend admin UI, to make sure public_wopi_url also got updated correctly?
2. Could someone help update this guide ( https://github.com/nextcloud/richdocuments/blob/main/docs/install.md#configure-the-app-from-the-commandline ), to mention updating public_wopi_url ?

Let's make it easy for other noobs. Thanks!!

Update Apr 13: Renamed: Wrong public WOPI url: Ignored user configuration and used wrong detection

Looks like it's not as simple as a configuration issue. See discussion below.

It ignored user configuration, ignored any explicit URL config, but using its own unreliable "detected" URL, which caused many many errors behind reverse proxy + https.

Context: How I deploy nextcloud

I did docker run ... -p 3083:80 -v ... nextcloud, with nginx reverse proxy like this:

    server {
        listen       [::]:443 ssl http2;
        listen       443 ssl http2;
        server_name  drive.recolic.net drive.recolic.cc;
        ssl_certificate ...;
        location / {
                proxy_pass http://127.0.0.1:3083;

                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-Proto $scheme;

                proxy_set_header X-Scheme $scheme;

                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                add_header Front-End-Https on;
        }

Apr 23 Update: this issue has been fixed by adjusting nginx configuration

See discussion below.

[recolic]

Another potential bug: when I update wopi_allowlist from admin UI, it automatically reset public_wopi_url to bad value again.

I have to manually fix public_wopi_url after every config change.

I think this might be related to my nginx reverse proxy & some auto detection code?

[vicolmenares]

Very useful the command Recolic shared, so I checked the value on wopi_allowlist inside the occ and what I had in the config.php file. Because I had this warning:

WOPI request denied from (mypublicip) as it does not match the configured ranges: (ip ranges)

So After i update the ips values in both sites, i got fixed the issue.

I used:

Check the IP configured in OCC:
docker exec -u 33 -ti nextcloud-aio-nextcloud ./occ config:list richdocuments

It should shows the same as configured inside config.php if not, run the following:
docker exec -u 33 -ti nextcloud-aio-nextcloud ./occ config:app:set richdocuments wopi_allowlist --value="YOURPUBLICIP"

Then configure the same in the config.php
go to config/config.php and at the end add: 'wopi_allowlist' => 'YOURIPSRANGES'

After that I am able to open office documents inside nextcloud with collabora.

Im not a expert on nextcloud so I found that solution online and it worked for me.

[recolic]

I tested again with fresh latest nextcloud docker + nginx reverse proxy. Looks like built-in CODE server works out-of-box (behind http-only reverse proxy)

Not sure what went wrong.. probably this issue only applies if upgraded from old version.

update: looks like public url is no longer necessary in latest app. But it still doesn't work because of some 500 token error.

update: 500 token error solved by clear all app data following this guide #3742 (comment), but app doesn't start anymore after that.

update: app doesn't start error has been resolved by creating a fake ./remoteData/capabilities file, now app started, but still cannot open document because of Content-Security-Policy error.

Content-Security-Policy: The page’s settings blocked the loading of a resource (form-action) at 
http://drive.recolic.cc/custom_apps/richdocumentscode/proxy.php?req=/browser/b7ba9a23ba/cool.html?WOPISrc=https%3A%2F%2Fdrive.recolic.cc%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F308504_oca5n8eadtqi&lang=en&closebutton=1 
because it violates the following directive: “form-action 'self' https://drive.recolic.cc/”

update: looks like it's the broken public URL detection again... it detected correct URL https:// but still using http://

[recolic]

same error after setting public_WOPI_url .. looks like the error is somewhere else.

Refused to send form data to 'http://drive.recolic.cc/custom_apps/richdocumentscode/proxy.php?req=/browser/b7ba9a23ba/cool.html?WOPISrc=https%3A%2F%2Fdrive.recolic.cc%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F308504_oca5n8eadtqi&lang=en&closebutton=1' 
because it violates the following Content Security Policy directive: "form-action 'self' https://drive.recolic.cc".

[recolic]

why do we make this "WOPI" url so complex? there're at least 4 different "url"s in this issue.

we already have "nextcloud public url" in config.php, have "wopi url" in app config, have another "wopi public url" in config, why there's one more "url" in coolwsd.xml? it's not cool at all.

Could we just make a single configuration entry? Just ask the user for URL, and use it everywhere. Nothing could go wrong. Stop doing random buggy detection.

[recolic]

update: the error above could be solved by manually patch apps/richdocuments/js/richdocuments-viewer.js: search for urlsrc and modify to de.get('urlsrc').replace(/^http:/, 'https:').

but still getting other CSP errors after this one. Need to patch proxy.php also.

[recolic]

Could someone give a suggestion about how to hardcode the same http:// => https:// replacement in proxy.php?

[elzody]

I'm confused by what the problem is exactly -- you are trying to use https but http is being used?
Also, it wouldn't really be possible to have one URL to configure in many different setups. For example, I run things in a Docker compose setup, so the Nextcloud callback URL that Collabora has to use to connect with Nextcloud must be configured differently than the URL my browser would use.

[recolic]

I'm confused by what the problem is exactly -- you are trying to use https but http is being used? Also, it wouldn't really be possible to have one URL to configure in many different setups. For example, I run things in a Docker compose setup, so the Nextcloud callback URL that Collabora has to use to connect with Nextcloud must be configured differently than the URL my browser would use.

Yes. Currently the problem is, my explicit WOPI public url configuration was ignored, and it insists using incorrectly detected URL (http://)

[tony-engineering]

I think we are facing the same issue #4611