Sync fails when file/directory names contain commas

[leolivier]

Steps to reproduce

1. go to this link in your browser (after replacing the path to the server and the user, the file does not need to exist on the server):
   https://path/to/nextcloud/remote.php/dav/files/your_account/dir/file,test.jpg
   ==> this leads for me to a 403 error
2. If you just replace the comma in file,test.jpg by a dot:
   https://path/to/nextcloud/remote.php/dav/files/your_account/dir/file.test.jpg
   ==> I get the authentication window!

Expected behaviour

I should reach the authentication window in both cases

Actual behaviour

I get a 403 error when there's a comma in a file or directory name. This prevents those file for syncing.

Server configuration

Operating system: raspbian stretch

Web server: apache

Database: mysql

PHP version: 7

Nextcloud version: 12.0.3

Updated from an older Nextcloud/ownCloud or fresh install: updated from 12.0.2 (but didn't work in 12.0.2 neither)

Where did you install Nextcloud from: manual install from the official zip

Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

Enabled:
  - activity: 2.5.2
  - calendar: 1.5.6
  - circles: 0.13.6
  - comments: 1.2.0
  - contacts: 2.0.1
  - dav: 1.3.0
  - deck: 0.2.5
  - federatedfilesharing: 1.2.0
  - federation: 1.2.0
  - files: 1.7.2
  - files_accesscontrol: 1.2.5
  - files_external: 1.3.0
  - files_external_dropbox: 1.0.0
  - files_opds: 0.8.2
  - files_pdfviewer: 1.1.1
  - files_sharing: 1.4.0
  - files_texteditor: 2.4.1
  - files_trashbin: 1.2.0
  - files_versions: 1.5.0
  - files_videoplayer: 1.1.0
  - firstrunwizard: 2.1
  - gallery: 17.0.0
  - logreader: 2.0.0
  - lookup_server_connector: 1.0.0
  - mail: 0.7.4
  - nextcloud_announcements: 1.1
  - notes: 2.3.1
  - notifications: 2.0.0
  - oauth2: 1.0.5
  - password_policy: 1.2.2
  - provisioning_api: 1.2.0
  - serverinfo: 1.2.0
  - sharebymail: 1.2.0
  - survey_client: 1.0.0
  - systemtags: 1.2.0
  - tasks: 0.9.5
  - theming: 1.3.0
  - twofactor_backupcodes: 1.1.1
  - updatenotification: 1.2.0
  - workflowengine: 1.2.0
Disabled:
  - admin_audit
  - bruteforcesettings
  - encryption
  - external
  - rainloop
  - socialsharing_email
  - socialsharing_facebook
  - user_external
  - user_ldap

Nextcloud configuration:

Config report

I{
    "system": {
        "instanceid": "ocxrjbmiyjnu",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "levillain.fr.nf",
            "nextcloud.levillain.fr.nf"
        ],
        "datadirectory": "\/ssd\/data\/nextcloud",
        "overwrite.cli.url": "https:\/\/levillain.fr.nf\/nextcloud",
        "dbtype": "mysql",
        "version": "12.0.3.3",
        "dbname": "nextcloud",
        "dbhost": "localhost:3306",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mail_from_address": "olivier",
        "mail_smtpmode": "php",
        "mail_smtpauthtype": "LOGIN",
        "mail_domain": "levillain.fr.nf",
        "maintenance": false,
        "theme": "",
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "loglevel": 1,
        "log_rotate_size": 10485760,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "mail_smtpsecure": "tls",
        "mail_smtphost": "levillain.fr.nf",
        "mail_smtpport": "25",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "enabledPreviewProviders": [
            "OC\\Preview\\Image",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\Epub",
            "OC\\Preview\\PDF",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\StarOffice",
            "OC\\Preview\\MSOfficeDoc",
            "OC\\Preview\\MSOffice2003",
            "OC\\Preview\\MSOffice2007"
        ]
    },
    "apps": ** removed, see above **
}

Are you using external storage, if yes which one: dropbox v2 (unofficial, removed but seems not totally removed)

Are you using encryption: no

Are you using an external user-backend, if yes which one: no

Client configuration

Browser: firefox 56

Operating system: Linux Mint 18.2

Logs

Web server error log

Web server error log

empty

Nextcloud log (data/nextcloud.log)

Nextcloud log

Nothing even at loglevel 1

Browser log

Browser log

Forbidden

You don't have permission to access /nextcloud/remote.php/dav/files/olivier.levillain@free.fr/workspace/lespetitscarreaux/lpc/albums/img/rene-paulette-enfants/tante louise,Rene, simon, anne.jpg on this server.

Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.
Apache/2.4.25 (Raspbian) Server at levillain.fr.nf Port 443

Local desktop log says:
10/11/2017 13:11:11,workspace/lespetitscarreaux/lpc/albums/img/rene-paulette-enfants/tante louise,Rene, simon, anne.jpg, /data/nextcloud,Cet élément n'a pas été synchronisé en raison des erreurs précédentes : Error downloading https://levillain.fr.nf/nextcloud/remote.php/dav/files/olivier.levillain@free.fr/workspace/lespetitscarreaux/lpc/albums/img/rene-paulette-enfants/tante louise,Rene, simon, anne.jpg - server replied: Forbidden

this for ~400 files...

[brunt82]

Commas are characters, which need to be encoded in urls (in contrast to dots). Therefore your described use case may not be the same like what your desktop client does. Just because the log does not encode the url, it does not mean that it is not encoded while requesting the server...

Anyhow I'm not able to reproduce it with a file / folder like "test, test, test.jpg"

[leolivier]

@brunt82, you're right and I don't know why it works for some installations and not for mine but 2 things are for sure:

• I am not the only one who has this problem, I found other cases on the forum
• I replaced the nextcloud desktop client 2.3.2 by the owncloud client 2.3.4 and it started working. But as items had been put in the black list, maybe it's not directly linked to the client.
  Anyway, the problem is solved for me but I don't know how...