[UI][iOS] No audio and video playback in Web-UI (on iOS devices)

[ChrisEdS]

Steps to reproduce

1. Go to Safari Browser on your iOS device
2. Go to your ownCloud instance
3. Make sure the "Music App" is disabled
4. Tap on a video/audio file (or download a file via the dots symbol)

Expected behaviour

The file should be played with the iOS audio player

The body tag looks like this:
<video controls="" autoplay="" src="http://172.42.16.210:8888/ecko.mp3" type="audio/mpeg" class="media-document audio iPhone"></video>

Actual behaviour

Screen is empty

The body tag looks like this:
<video controls="" autoplay="" src="http://172.42.16.210:980/remote.php/webdav/Musik/Curtis%20Mayfield%20-%20Superfly%20(EckoTronic%20Movin%20%20Remix).mp3" type="audio/mpeg" class="media-document iPhone invalid video"></video>

In the Console I can see 13 errors:

Looks like the problem is:
Failed to load resource: ... Plug-in handled load and/or Refused to load ... because it appears in neither the media-src directive nor the default-src directive of the Content Security Policy.

Server configuration

Operating system:
iOS 12.1
ownCloud version:
10.0.10

[ownclouders]

GitMate.io thinks possibly related issues are #17055 (OwnCloud IOS client not autouploading videos), #9882 (Video Playback issues with owncloud 7), #24607 (Can't login from the web ui), #4632 (Video Playback in provided Video Viewer), and #28829 (Retry failed web UI uploads).

[PVince81]

did you also disable the files_videoviewer app ?

are you opening this from the regular files list or from a public link ?

The body tag looks like this:

Do you mean the whole page only contains a single video tag ? If yes, I don't think this is generated by ownCloud as we don't have such pages.

The files_videoviewer app is able to generate a popup video player that appears as overlay on top of the files app.

From the screenshot I also don't see the ownCloud body around the player.
AFAIK the video player doesn't play mp3.

I suspect that you've simply been redirected to the download URL and the iOS browser is trying to play the file in an embedded dummy page instead of downloading. This is outside the control of OC so I don't think we can fix anything.

[ChrisEdS]

did you also disable the files_videoviewer app ?

Yes. Same problem.

are you opening this from the regular files list or from a public link ?

Regular file list.

Do you mean the whole page only contains a single video tag ? If yes, I don't think this is generated by ownCloud as we don't have such pages.

Indeed. Seems like the page comes from Apple.

My guess is that there is something wrong with this Content Security Policy. Maybe we have to add a Content Security Policy header in the files_videoviewer app?

[PVince81]

It could be a CSP issue, yes.

cc @DeepDiver1975 @settermjd

[ChrisEdS]

Something like this:

Content-Security-Policy: "default-src 'none'; media-src *"
X-Content-Security-Policy: "default-src 'none'; media-src *"
X-WebKit-CSP: "default-src 'none'; media-src *"

[ChrisEdS]

Another interesting thing is the request:

On the ownCloud Manual PDF file it looks like this

URL: http://172.42.16.210:8888/10010/remote.php/webdav/ownCloud%20Manual.pdf
Status: 200 OK
Source: Network
Address: 172.42.16.210:8888

Request
GET /10010/remote.php/webdav/ownCloud%20Manual.pdf HTTP/1.1
Cookie: ocrflrmrk2j5=qtdl8b910uu4sqq3ivkalk6rbt; oc_sessionPassphrase=1G0XV5lf29j0ekxJRb55J9LTfWbeuP0iOlVR8XoSyH4bjXmTINqDAUo1NuXBgJVNGWPt4U76MTtHea%2BeZg7r9w5QJVwOYzAUjhEiXwWqiZcSqeaA%2F1Rw9jMkRS4wG0tY; oco900tzg6w7=g1glijo4ek3akgujk6r58r5c97
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Upgrade-Insecure-Requests: 1
Host: 172.42.16.210:8888
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: keep-alive

on a MP3 file like this

URL: http://172.42.16.210:8888/10010/remote.php/webdav/Curtis%20Mayfield%20-%20Superfly%20(EckoTronic%20Movin%20%20Remix).mp3
Status: 200 OK
Source: Network

Request
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
Upgrade-Insecure-Requests: 1

[ChrisEdS]

https://securityheaders.com/?q=cloud.owncloud.com&followRedirects=on
Could this be related @settermjd