When Richdocuments is enabled, OnlyOffice documents can't share its files with external shares

[rosa2]

Describe the bug
We have Richdocuments and OnlyOffice installed in the same NextCloud. We just updated to NextCloud 31.0.6 and both apps also, Richdocuments 8.7.7 and OnlyOffice 9.12.0. Before the update we had Nextcloud 30.0.7, Richdocuments 8.5.13 and OnlyOffice 9.11.0.

After updating, if you share a file from Microsoft (docx, pptx, xslx, etc) with edit permissions with external shares by a link, you only get the download option.
If I disable Richdocuments, then it works ok.

If the user is logged, you can open the files without a problem.

I have downgraded (disabling the app) to all Richdocuments versions that work with NextCloud 31.0.6 without success to solve the problem :(

Sorry for my bad English :)

To Reproduce
Steps to reproduce the behavior:

1. Have both apps enabled and working
2. Create a .docx document and in the file sharing tab, create a External share and give to it edit options.
3. Copy the link and in a browser where you are not logged in, paste and go. Link example: https://test.test/index.php/s/b7imH5CaykkEzsq?openfile=true
4. The file opens as downladble file without option to edit (not in OnlyOffice to edit).
5. Disable Richdocuments in the apps page.
6. Reload the document in the browser where you were not logged in. The document is opened in OnlyOffice and the person can edit it, as it is expected.

Expected behavior
OnlyOffice opens the file and the person can edit it.

Screenshots
In files, the document with a External share and edit options

Image opening the link without been logged in (only download, but not edit with OnlyOffice

Client details:

• OS: Ubuntu 22.04.5 LTS
• Browsers: LibreWolf 146.0-2, Vivaldi 7.7.3851.66 , Chromium 108.0.5359.40

Server details

Operating system:
Debian GNU/Linux 12 (bookworm)
Web server:
Apache/2.4.65 (Debian)
Database:
mariadb Ver 15.1 Distrib 10.11.14-MariaDB, for debian-linux-gnu (x86_64) using EditLine wrapper
PHP version:
PHP 8.2.30
Nextcloud version:
31.0.6
Version of the richdocuments app
8.7.7
Version of Collabora Online
Collabora Online Development Edition 25.04.8.1 278cb3481b
Configuration of the richdocuments app

{
    "apps": {
        "richdocuments": {
            "canonical_webroot": "",
            "disable_certificate_verification": "",
            "enabled": "yes",
            "external_apps": "",
            "installed_version": "8.7.7",
            "public_wopi_url": "https:\/\/test.test",
            "types": "filesystem,prevent_group_restriction",
            "wopi_allowlist": "",
            "wopi_url": "https:\/\/test.test"
        }
    }
}

Logs

Nextcloud log (data/nextcloud.log)

No logs about Richdocuments or OnlyOffice

Browser log

Insert your browser log here, this could for example include:

a) The javascript console log
Content-Security-Policy: The page’s settings blocked the loading of a resource (media-src) at data: because it violates the following directive: “media-src 'self'” [b7imH5CaykkEzsq](https://test.test/index.php/s/b7imH5CaykkEzsq?openfile=true)
[WARN] viewer: Some mimes were ignored because they are not enabled in the server previews config 
Object { app: "viewer", level: 2, ignoredMimes: (3) […] }
[index.mjs:51:17](https://test.test/apps/viewer/node_modules/@nextcloud/logger/dist/index.mjs)
OCA.Files.Settings initialized [Settings.js:12:11](webpack:///nextcloud/apps/files/src/services/Settings.js)
session heartbeat polling started [session-heartbeat.js:83:10](webpack:///nextcloud/core/src/session-heartbeat.js)
[ERROR] files: SW registration failed:  
Object { app: "files", level: 2, error: DOMException }
[index.mjs:54:17](webpack:///nextcloud/node_modules/@nextcloud/logger/dist/index.mjs)
Content-Security-Policy: The page’s settings blocked a worker script (worker-src) at https://test.test/index.php/apps/files/preview-service-worker.js from being executed because it violates the following directive: “script-src 'nonce-xPh3M1+YGKfR0M3ih3ohTGakFu89seJx7eHo9KMCXsk='” [ServiceWorker.js:22:56](webpack:///nextcloud/apps/files/src/services/ServiceWorker.js)
Mounted note-to-recipient [FilesListHeader.vue:40:17](webpack:///nextcloud/apps/files/src/components/FilesListHeader.vue)
[ERROR] files: Failed to open sidebar on file 629484, file isn't cached yet ! 
Object { app: "files", level: 2, fileId: 629484, node: {…} }
[index.mjs:54:17](webpack:///nextcloud/node_modules/@nextcloud/logger/dist/index.mjs)

[rosa2]

In Chromium console, I get

logger-CuIjhGWb.chunk.mjs:5 [WARN] viewer: Some mimes were ignored because they are not enabled in the server previews config
Object
log @ logger-CuIjhGWb.chunk.mjs:5
files-main.js?v=327b4f90-13:1 OCA.Files.Settings initialized
core-main.js?v=327b4f90-13:1 session heartbeat polling started
files-init.js?v=327b4f90-13:1 Refused to create a worker from 'https://test.test/index.php/apps/files/preview-service-worker.js' because it violates the following Content Security Policy directive: "script-src 'nonce-olfJ3MvnxVHAMzdlZldulqKm1zh6mkeueA9jePsW0tg='". Note that 'worker-src' was not explicitly set, so 'script-src' is used as a fallback.
(anonymous) @ files-init.js?v=327b4f90-13:1
core-common.js?v=327b4f90-13:1 [ERROR] files: SW registration failed:
Object
log @ core-common.js?v=327b4f90-13:1
files-main.js?v=327b4f90-13:1 Mounted note-to-recipient
core-common.js?v=327b4f90-13:1 [ERROR] files: Failed to open sidebar on file 629484, file isn't cached yet !
Object
log @ core-common.js?v=327b4f90-13:1
core-main.js?v=327b4f90-13:1 OC.requestToken changed 8UdFoSDydlGxoVT2+wr+CJdmaA5nOwP0/Y6i2Ai4f4I=:oHcUxESTHz/80j27rE2Ret4MKnoFVWmBz8iWiXzfDbE=
core-main.js?v=327b4f90-13:1 OC.requestToken changed zuP7/uMOSACqHBljfGXU+dmDgCzUgC+RxlAxESE/YaQ=:n9Oqm4dvIW7nb3AuKyK7i5Dpwli27kXk9BYFQFVYE5c=

[rosa2]

I confirm that this is for all external shares: I have also tested with email.
Steps to reproduce the behavior:

1. Have both apps enabled and working
2. Create a .docx document and in the file sharing tab, create a External share by email and give to it edit options.
3. The email will receive a link to the document.
4. Open it and the file opens as downladble file without option to edit. This happens if you are logged in or out.
5. Disable Richdocuments in the apps page.
6. Reload the document in the browser. The document is opened in OnlyOffice and the person can edit it, as it is expected.

Expected behavior
OnlyOffice opens the file and the person can edit it.