File Download CSP Error

[Engineer-of-Stuff]

When downloading a MP3, MP4, webM or other media file a CSP error is thrown.

Console Errors:
[filename].mp3:1 Refused to load media from 'https://192.168.0.12/drive/remote.php/webdav/[filename].mp3?downloadStartSecret=[redacted]' because it violates the following Content Security Policy directive: "default-src 'none'". Note that 'media-src' was not explicitly set, so 'default-src' is used as a fallback.

Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-jXP1MhzXJiZm3bKqqhaSoVGlgtNu8Zl7WG/WjeAssXY='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

Screenshot:

[nextcloud-bot]

GitMate.io thinks possibly related issues are #9801 (Error downloading or uploading large files), #2352 (CRC error with zip files downloaded from web UI), #4678 ("Connection to server lost" error when uploading/downloading large files), #7987 (Error downloading from shared link, shared by a user who no longer has access to the files), and #1464 (Internal server error when trying to download a non-exist file).

[stratege1401]

well, the trouble is how your mpx file was uncapsulated.

From times to times, i got mp4 files unreadable in my players because of strange mkv or others files format error...

originaly, nextcloud is not a media players, so i guess, dont expect to have the whole support for all kind of files.... like for pictures the RAW format...

[Engineer-of-Stuff]

I'm not trying to view it, I want to download it.

[stratege1401]

understood, so in that case, as your browser normal behaviors is to "play" the files, you need to use the 3 dots columns in order to reach the "download" options.
OR
modify the chrome option for the mpx file This feature was in "Advanced" -> Click "Clear Auto-opening settings"

[Engineer-of-Stuff]

I do click the "Download" button, which then opens the file in the browser.

I don't see the setting. Is it in Flags?

[stratege1401]

in chrome 67 it is located at: chrome://settings/content/pdfDocuments

in my nextcloud i have the followings apps witch can have some link to pdf:
Files Right Click
Metadata
PDF viewer

left click on the three dot, drop list, deownload ... and it works...

[fdelapena]

Also happens with FLAC files. The media-src is used for main site when logging in, but not in the share view for anonymous users, the CSP header there is not the same and lacks the media-src 'self'.

[szaimen]

As I cannot reproduce the original issue anymore, I will close this ticket. If this is still happening please make sure to upgrade to the latest version. After that, feel free to reopen.