Cannot view cell content on read only publicly shared spreadsheets

[Gloorf]

Describe the bug
When accessing spreadsheet shared with a public link in readonly mode, you cannot properly navigate them. For example, you cannot click on a cell, so you cannot use any HYPERLINK() function (because you need to click on a cell). If you share the file with readWrite access, you can however navigate without issue the spreadsheet.

Here's the readonly file : https://nextcloud.glorf.fr/s/iaSMzi2trJ2iQcp
Here's the readwrite file : https://nextcloud.glorf.fr/s/nxwSxkwqT4RTGgm
Both should contain a link to google in the A4 cell, which you can access by Ctrl-Clicking the cell.

I've tried opening the link in the same window as my active NC session, in the same browser in private mode, in another browser (which I never logged on to NC with), and in another browser in private mode, all share the same issue.
To Reproduce
Steps to reproduce the behavior:

1. Create a spreadsheet (.ods)
2. Make a public link, available to everyone, with readonly access
3. Open the public link
4. You cannot click on any cell, nor on any link with the HYPERLINK() function in a cell

Expected behavior
You can navigate the file and use hyperlink in the file

Client details:

• OS: Debian sid
• Browser: Tried with Firefox & Chrome
• Version: Firefox 73, Chrome 80
• Device: desktop

Server details

Operating system: Debian buster

Web server: nginx

Database: postgresql

PHP version: 7.3

Nextcloud version: 17.0.3

Version of the richdocuments app 3.2.0

Version of Collabora Online
LOOLWSD
4.2.0 (git hash: b889fbb)

LOKit
Collabora Office 6.2-4 (git hash: 01f0d42)

Logs

Nextcloud log (data/nextcloud.log)

There's nothing in the nextcloud log

Browser log

This is the firefox Log (for the readonly file)
Note that both logs are essentially the same for the readwrite file (inparticular, the content security policy error are the same)

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). 2 utils.js:35:9
JQMIGRATE: Migrate is installed, version 1.4.1 jquery-migrate.min.js:2:551
oc_requesttoken is deprecated: use OC.requestToken instead 2 globals.js:26:15
This page uses the non standard property “zoom”. Consider using calc() in the relevant property values, or using “transform” along with “transform-origin: 0 0”. injectStylesIntoStyleTag.js:201:10
The escapeHTML library is deprecated! It will be removed in nextcloud 19. 36 globals.js:26:15
OC.addStyle is deprecated, use OCP.Loader.loadStylesheet instead legacy-loader.js:59:9
Content Security Policy: Ignoring ‘x-frame-options’ because of ‘frame-ancestors’ directive.
Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source specified
Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). 2 utils.js:35:9
JQMIGRATE: Migrate is installed, version 1.4.1 jquery-migrate.min.js:2:551
oc_config is deprecated: use OC.config instead globals.js:26:15
This page uses the non standard property “zoom”. Consider using calc() in the relevant property values, or using “transform” along with “transform-origin: 0 0”. injectStylesIntoStyleTag.js:201:10
Waiting for page to render… document.js:147:12
The getURLParameter library is deprecated! It will be removed in nextcloud 19. globals.js:26:15
PostMessageService.sendPostMessage parent loading postMessage.tsx:54:10
[getWopiUrl] https://nextcloud.glorf.fr/index.php/apps/richdocuments/wopi/files/124781_occl30w4ieoa url.js:39:9
Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source specified 4
[viewer] Received post message 
Object { msgId: "loading", args: undefined, deprecated: undefined }
viewer.js:422:10
Content Security Policy: Ignoring ‘x-frame-options’ because of ‘frame-ancestors’ directive.
This page uses the non standard property “zoom”. Consider using calc() in the relevant property values, or using “transform” along with “transform-origin: 0 0”. loleaflet.html
Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user’s experience. For more help http://xhr.spec.whatwg.org/ bundle.js:21:26733
socket.initialize: bundle.js:40:31332
Set old/lastContent to empty 2 bundle.js:50:10340
Content Security Policy: Ignoring ‘x-frame-options’ because of ‘frame-ancestors’ directive. 2
PostMessageService.sendPostMessage loolframe {"MessageId":"Host_PostmessageReady","SendTime":1581787487892,"Values":{}} postMessage.tsx:54:10
[document] editorInitListener: Received post message  
Object { msgId: "App_LoadingStatus", args: {…}, deprecated: false }
document.js:178:13
PostMessageService.sendPostMessage parent {"MessageId":"App_LoadingStatus","SendTime":1581787487897,"Values":{"Status":"Frame_Ready","Features":{"VersionStates":true}}} postMessage.tsx:54:10
callMobileMessage documentLoaded undefined mobile.js:35:9
[document] Received post message  
Object { msgId: "App_LoadingStatus", args: {…}, deprecated: false }
document.js:230:13
PostMessageService.sendPostMessage parent {"MessageId":"App_LoadingStatus","SendTime":1581787487897,"Values":{"Status":"Frame_Ready","Features":{"VersionStates":true}}} postMessage.tsx:54:10
[document] Unhandled post message 
Object { msgId: "App_LoadingStatus", args: {…}, deprecated: false }
document.js:323:14
[viewer] Received post message 
Object { msgId: "App_LoadingStatus", args: {…}, deprecated: false }
viewer.js:422:10
[viewer] Received post message 
Object { msgId: "App_LoadingStatus", args: {…}, deprecated: false }
viewer.js:422:10
mCustomScrollbar: onUpdate: bundle.js:62:3481
re-write name Modifier bundle.js:60:8909
re-write name Supprimer bundle.js:60:8909
re-write name Commentaire bundle.js:60:8909
re-write name Insérer une feuille avant bundle.js:60:8909
re-write name Insérer une feuille après bundle.js:60:8909
re-write name Supprimer des feuilles... bundle.js:60:8909
re-write name Renommer la feuille... bundle.js:60:8909
re-write name Afficher les feuilles... bundle.js:60:8909
re-write name Masquer la feuille bundle.js:60:8909
re-write name Insérer des colonnes avant bundle.js:60:8909
re-write name Insérer des colonnes après bundle.js:60:8909
re-write name Supprimer des colonnes bundle.js:60:8909
re-write name Largeur optimale... bundle.js:60:8909
re-write name Masquer des colonnes bundle.js:60:8909
re-write name Afficher les colonnes bundle.js:60:8909
re-write name Insérer des lignes au-dessus bundle.js:60:8909
re-write name Insérer des lignes au-dessous bundle.js:60:8909
re-write name Supprimer des lignes bundle.js:60:8909
re-write name Hauteur optimale... bundle.js:60:8909
re-write name Masquer des lignes bundle.js:60:8909
re-write name Afficher les lignes bundle.js:60:8909
explicitly hiding: languagecode,languagecode bundle.js:55:4284
explicitly showing: fold bundle.js:55:4326
explicitly hiding: bundle.js:55:4284
explicitly showing: bundle.js:55:4326
_activate: bundle.js:43:7251
_startInactiveTimer: bundle.js:43:10098
[document] editorInitListener: Received post message  
Object { msgId: "App_LoadingStatus", args: {…}, deprecated: false }
document.js:178:13
PostMessageService.sendPostMessage parent {"MessageId":"App_LoadingStatus","SendTime":1581787488137,"Values":{"Status":"Document_Loaded","DocumentLoadedTime":1581787488122}} postMessage.tsx:54:10
[document] Received post message  
Object { msgId: "App_LoadingStatus", args: {…}, deprecated: false }
document.js:230:13
PostMessageService.sendPostMessage parent {"MessageId":"App_LoadingStatus","SendTime":1581787488137,"Values":{"Status":"Document_Loaded","DocumentLoadedTime":1581787488122}} postMessage.tsx:54:10
[document] Unhandled post message 
Object { msgId: "App_LoadingStatus", args: {…}, deprecated: false }
document.js:323:14
PostMessageService.handlePostMessage Ignoring deprecated post message View_Added 2 postMessage.tsx:100:12
[document] Received post message  
Object { msgId: "Views_List", args: (2) […], deprecated: false }
document.js:230:13
PostMessageService.sendPostMessage parent {"MessageId":"Views_List","SendTime":1581787488138,"Values":[{"ViewId":"1","UserName":"Anonymous guest","UserId":"Guest-I3UdC1Lq","UserExtraInfo":[],"Color":5741852,"ReadOnly":"1","IsCurrentView":false},{"ViewId":"4","UserName":"Glorf","UserId":"Glorf","UserExtraInfo":{"avatar":"https://nextcloud.glorf.fr/avatar/Glorf/32"},"Color":32896,"ReadOnly":"1","IsCurrentView":true}]} postMessage.tsx:54:10
[document] Unhandled post message 
Object { msgId: "Views_List", args: (2) […], deprecated: false }
document.js:323:14
onDialogMsg: id: 16, winType: calc-input-win, action: created, size: 800, 29, rectangle: undefined bundle.js:62:13308
_launchCalcInputBar: start: id: 16, width: 800 bundle.js:62:24835
_launchCalcInputBar: end bundle.js:62:28122
onDialogMsg: id: 15, winType: deck, action: created, size: 335, 781, rectangle: undefined bundle.js:62:13308
[viewer] Received post message 
Object { msgId: "App_LoadingStatus", args: {…}, deprecated: false }
viewer.js:422:10
[viewer] Received post message 
Object { msgId: "App_LoadingStatus", args: {…}, deprecated: false }
viewer.js:422:10
[viewer] Received post message 
Object { msgId: "Views_List", args: (2) […], deprecated: false }
viewer.js:422:10
_activate: bundle.js:43:7251
_startInactiveTimer: bundle.js:43:10098
mCustomScrollbar: onUpdate: bundle.js:62:3481
[document] Received post message  
Object { msgId: "Doc_ModifiedStatus", args: {…}, deprecated: false }
document.js:230:13
PostMessageService.sendPostMessage parent {"MessageId":"Doc_ModifiedStatus","SendTime":1581787488936,"Values":{"Modified":false}} postMessage.tsx:54:10
[document] Unhandled post message 
Object { msgId: "Doc_ModifiedStatus", args: {…}, deprecated: false }
document.js:323:14
[viewer] Received post message 
Object { msgId: "Doc_ModifiedStatus", args: {…}, deprecated: false }
viewer.js:422:10
onDialogMsg: id: 15, winType: undefined, action: invalidate, size: undefined, rectangle: 2, 2, 323, 734 bundle.js:62:13308
onDialogMsg: id: 15, winType: undefined, action: invalidate, size: undefined, rectangle: 204, 204, 121, 34 bundle.js:62:13308
onDialogMsg: id: 15, winType: undefined, action: invalidate, size: undefined, rectangle: 11, 342, 296, 18

And here's the Chrome log (for the readonly file)
Note that both logs are essentially the same for the readwrite file (inparticular, the "Blocked autofocusing on a form control in a cross-origin subframe." error is the same)

globals.js:26 oc_requesttoken is deprecated: use OC.requestToken instead
He @ globals.js:26
get @ globals.js:52
(anonymous) @ scripts-for-file-app.js?v=458e096d-0:1244
globals.js:26 oc_requesttoken is deprecated: use OC.requestToken instead
He @ globals.js:26
get @ globals.js:52
(anonymous) @ scripts-for-file-app.js?v=458e096d-0:1451
36globals.js:26 The escapeHTML library is deprecated! It will be removed in nextcloud 19.
He @ globals.js:26
i @ globals.js:38
(anonymous) @ l10n.js:103
(anonymous) @ l10n.js:98
translate @ l10n.js:121
O @ underscore.js:762
(anonymous) @ underscore.js:775
(anonymous) @ underscore.js:122
register @ viewer.js:52
(anonymous) @ viewer.js:405
u @ jquery.js:3099
fireWith @ jquery.js:3211
ready @ jquery.js:3417
P @ jquery.js:3433
legacy-loader.js:59 OC.addStyle is deprecated, use OCP.Loader.loadStylesheet instead
d @ legacy-loader.js:59
onEdit @ viewer.js:126
(anonymous) @ viewer.js:418
u @ jquery.js:3099
fireWith @ jquery.js:3211
ready @ jquery.js:3417
P @ jquery.js:3433
jquery.js:8630 GET https://nextcloud.glorf.fr/index.php/apps/richdocuments/ajax/settings.php 401 (Unauthorized)
send @ jquery.js:8630
ajax @ jquery.js:8166
m.<computed> @ jquery.js:8311
(anonymous) @ viewer.js:407
u @ jquery.js:3099
fireWith @ jquery.js:3211
ready @ jquery.js:3417
P @ jquery.js:3433
jquery-migrate.min.js:2 JQMIGRATE: Migrate is installed, version 1.4.1
globals.js:26 The getURLParameter library is deprecated! It will be removed in nextcloud 19.
He @ globals.js:26
i @ globals.js:38
onStartup @ document.js:370
(anonymous) @ document.js:471
u @ jquery.js:3099
fireWith @ jquery.js:3211
ready @ jquery.js:3417
P @ jquery.js:3433
bundle.js:21 [Deprecation] Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user's experience. For more help, check https://xhr.spec.whatwg.org/.
request_JSON @ bundle.js:21
String_ctr.<computed> @ bundle.js:21
(anonymous) @ bundle.js:21
(anonymous) @ bundle.js:21
bundle.js:50 Set old/lastContent to empty
bundle.js:50 Blocked autofocusing on a form control in a cross-origin subframe.
onAdd @ bundle.js:50
_layerAdd @ bundle.js:44
whenReady @ bundle.js:43
addLayer @ bundle.js:44
initialize @ bundle.js:42
NewClass @ bundle.js:40
L.map @ bundle.js:43
(anonymous) @ bundle.js:68
(anonymous) @ bundle.js:69
(anonymous) @ bundle.js:69
bundle.js:50 Set old/lastContent to empty
bundle.js:60 re-write name Modify
bundle.js:60 re-write name Remove
bundle.js:60 re-write name Comment
bundle.js:60 re-write name Insert sheet before this
bundle.js:60 re-write name Insert sheet after this
bundle.js:60 re-write name Delete Sheet...
bundle.js:60 re-write name Rename Sheet...
bundle.js:60 re-write name Show Sheet...
bundle.js:60 re-write name Hide Sheet
bundle.js:60 re-write name Insert Columns Before
bundle.js:60 re-write name Insert Columns After
bundle.js:60 re-write name Delete Columns
bundle.js:60 re-write name Optimal Width...
bundle.js:60 re-write name Hide Columns
bundle.js:60 re-write name Show Columns
bundle.js:60 re-write name Insert Rows Above
bundle.js:60 re-write name Insert Rows Below
bundle.js:60 re-write name Delete Rows
bundle.js:60 re-write name Optimal Height...
bundle.js:60 re-write name Hide Rows
bundle.js:60 re-write name Show Rows
bundle.js:55 explicitly hiding: languagecode,languagecode
bundle.js:55 explicitly showing: fold
bundle.js:55 explicitly hiding: 
bundle.js:55 explicitly showing: 
bundle.js:62 onDialogMsg: id: 7, winType: calc-input-win, action: created, size: 800, 29, rectangle: undefined
bundle.js:62 _launchCalcInputBar: start: id: 7, width: 800
bundle.js:62 _launchCalcInputBar: end
bundle.js:62 onDialogMsg: id: 6, winType: deck, action: created, size: 335, 781, rectangle: undefined
32:1 GET https://nextcloud.glorf.fr/avatar/Guest-I3UdC1Lq/32 404 (Not Found)
Image (async)
o.a.fn.avatar @ avatar.js:160
_avatarForView @ FilesAppIntegration.js:291
_userEntry @ FilesAppIntegration.js:239
renderAvatars @ FilesAppIntegration.js:309
setViews @ FilesAppIntegration.js:142
(anonymous) @ viewer.js:459
(anonymous) @ postMessage.tsx:103
e.handlePostMessage @ postMessage.tsx:98
(anonymous) @ postMessage.tsx:42
postMessage (async)
e.sendPostMessage @ postMessage.tsx:53
(anonymous) @ document.js:273
(anonymous) @ postMessage.tsx:103
e.handlePostMessage @ postMessage.tsx:98
(anonymous) @ postMessage.tsx:42
postMessage (async)
_postMessage @ bundle.js:55
_postViewsMessage @ bundle.js:55
(anonymous) @ bundle.js:54
fire @ bundle.js:40
_onViewInfoMsg @ bundle.js:46
_onMessage @ bundle.js:45
_onMessage @ bundle.js:49
_onViewInfoMsg @ bundle.js:41
_onMessage @ bundle.js:41
bundle.js:62 onDialogMsg: id: 6, winType: undefined, action: invalidate, size: undefined, rectangle: 2, 2, 323, 734
bundle.js:62 onDialogMsg: id: 6, winType: undefined, action: invalidate, size: undefined, rectangle: 204, 204, 121, 34
bundle.js:62 onDialogMsg: id: 6, winType: undefined, action: invalidate, size: undefined, rectangle: 11, 342, 296, 18
bundle.js:50 Set old/lastContent to empty
632:1 GET https://nextcloud.glorf.fr/avatar/Guest-I3UdC1Lq/32 404 (Not Found)```

</details>

[juliushaertl]

This tracker is for the Nextcloud connector app named Collabora Online. For issues in the product, please open a bug report at: https://bugs.documentfoundation.org/enter_bug.cgi?product=LibreOffice%20Online

[Gloorf]

Since this bug is happening only with read only shared spreadsheet, and read/write spreadsheet are working fine, I'm assuming the bug is more of a nextcloud/richdocuments issue than a libreofficeonline one, but I can also file a bug on libreoffice online bugzilla :)

[juliushaertl]

Since this bug is happening only with read only shared spreadsheet, and read/write spreadsheet are working fine, I'm assuming the bug is more of a nextcloud/richdocuments issue than a libreofficeonline one, but I can also file a bug on libreoffice online bugzilla :)

Yes, LOOL is obtaining the file from Nextcloud and all rendering related is handed there then. The readonly view is just enabled with an optional parameter from the Nextcloud side.