Public sharing is broken

[christianlupus]

Describe the bug
A publicly shared collective cannot be viewed as the server returns 404 errors. The page can obviously not be viewed and keeps empty.

See also #1530 #1559

Note that I have set all permissions to allow all users everything. So, the proposed workaround in #1530 is not helping.

To Reproduce
Steps to reproduce the behavior:

1. Create a collective
2. Ensure the permissions are set to everything for all users
3. Share the collective publicly and copy the link
4. Open the link in new, private browser tab

Expected behavior
The page is loaded successfully.

Screenshots
If applicable, add screenshots to help explain your problem.

Server details:

• Collectives app version: 3.5.0
• Nextcloud version: 32.0.5
• PHP Version: 8.3.30
• Database: MariaDB 10.11.15

Client details:

• OS: Archlinux/Windows
• Browser: Firefox
• Browser version: 147.0.3
• Device: desktop

Logs

Nextcloud log (data/nextcloud.log)

Uploaded as gist due to large amount of data.

Browser log

09:47:54.977 Warnungen zu Content-Security-Policy 2
09:48:02.146 [WARN] viewer: Some mimes were ignored because they are not enabled in the server previews config 
Object { app: "viewer", level: 0, ignoredMimes: (3) […] }
previewUtils-BWqM5-N0.chunk.mjs:14:366
09:48:02.155 [DEBUG] @nextcloud/files: FileActions initialized 
Object { app: "@nextcloud/files", level: 0 }
previewUtils-BWqM5-N0.chunk.mjs:14:230
09:48:02.155 [DEBUG] viewer: OCA.Viewer initialized 
Object { app: "viewer", level: 0 }
previewUtils-BWqM5-N0.chunk.mjs:14:230
09:48:02.162 [DEBUG] @nextcloud/files: FileListHeaders initialized 
Object { app: "@nextcloud/files", level: 0 }
_plugin-vue2_normalizer-BYCAkzB7.chunk.mjs:2:46975
09:48:02.316 [INFO] viewer: No OCP.Files app found, viewer is now in standalone mode 
Object { app: "viewer", level: 0 }
previewUtils-BWqM5-N0.chunk.mjs:14:299
09:48:02.482 TypeError: can't access property "deleted", i is undefined
    fn NavigationBar.vue:167
    Ma VueJS
    fn NavigationBar.vue:167
    VueJS 2
    lT NcAppNavigation-BGc7ks7G.mjs:158
    VueJS 50
    <anonymous> main.js:29
vendor-Cr5Qm0yU.chunk.mjs:2:24456
09:48:02.494 Polling every 60 seconds. collectives-main.mjs:3:2439224
09:48:02.494 Started background fetcher as session_keepalive is enabled collectives-main.mjs:3:2439516
09:48:02.538 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n
[HTTP/1.1 200 OK 1026ms]

09:48:02.694 Content-Security-Policy: Die Einstellungen der Seite haben das Laden einer Ressource (default-src) auf https://nextcloud.christian-wolf.click/nextcloud/custom_apps/bookmarks/js/bookmarks-src_components_CustomPickerElement_vue.js?v=00a0891c34c69fc28d85 blockiert, da sie gegen folgende Direktive verstößt: "default-src 'none'" bookmarks-references.js:2:1032365
09:48:03.728 Content-Security-Policy: Die Einstellungen der Seite haben die Ausführung eines JavaScript-Evals (script-src) blockiert, da es gegen folgende Direktive verstößt: "script-src 'nonce-zyyQ53LvL0G1IM8/u4LXI0gHHMd97KO9+zsKvMS9LPk=' blob: 'wasm-unsafe-eval'" (es fehlt 'unsafe-eval') collectives-main.mjs:3:2393060
09:48:03.734 [INFO] viewer: 7 viewer handlers registered 
Object { app: "viewer", level: 0, handlers: (7) […] }
previewUtils-BWqM5-N0.chunk.mjs:14:299
09:48:03.738 [INFO] core: session heartbeat polling started 
Object { app: "core", level: 0 }
core-common.js:1:2455938
09:48:03.785 SW registered. collectives-main.mjs:3:2443653
09:48:04.076 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/pages
[HTTP/1.1 200 OK 491ms]

09:48:04.501 Uncaught (in promise) TypeError: ServiceWorker script at https://nextcloud.christian-wolf.click/nextcloud/index.php/apps/collectives/service-worker.js?prefix=/nextcloud/custom_apps/collectives/ for scope https://nextcloud.christian-wolf.click/nextcloud/apps/collectives encountered an error during installation.
09:48:04.934 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/public.php/webdav/Readme.md?timestamp=1770886084
[HTTP/1.1 404 Not Found 632ms]

09:48:04.936 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/pages/7145050/attachments
[HTTP/1.1 200 OK 559ms]

09:48:05.163 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/tags
[HTTP/1.1 200 OK 525ms]

09:48:05.810 Failed to fetch content of page 
Object { message: "Request failed with status code 404", name: "AxiosError", code: "ERR_BAD_REQUEST", config: {…}, request: XMLHttpRequest, response: {…}, status: 404, stack: "", … }
collectives-main.mjs:3:2167235
09:48:06.837 Source-Map-Fehler: Error: request failed with status 404
Stack in the worker:networkRequest@resource://devtools/client/shared/source-map-loader/utils/network-request.js:43:9

Ressourcen-Adresse: https://nextcloud.christian-wolf.click/nextcloud/custom_apps/bookmarks/js/bookmarks-references.js?v=97a948bf-4
Source-Map-Adresse: bookmarks-references.js.map?v=33dfa366e877c79d31bc
09:48:07.630 XHRPOST
https://nextcloud.christian-wolf.click/nextcloud/apps/text/attachments
[HTTP/1.1 200 OK 245ms]

09:48:07.643 Uncaught (in promise) TypeError: can't access property "trim", e.value is undefined
    _ useReader.js:100
    mounted TextEditor.vue:128
    VueJS 18
    getPages pages.js:566
    ae pinia.mjs:1399
    r pinia.mjs:1887
    getAllPages CollectiveView.vue:208
    id CollectiveView.vue:95
    VueJS 11
    getCollectives collectives.js:202
    ae pinia.mjs:1399
    r pinia.mjs:1887
    getCollectivesAndSettings CollectivesApp.vue:121
    mounted CollectivesApp.vue:104
    VueJS 13
    <anonymous> main.js:29
collectives-main.mjs:3:2166874
09:49:02.499 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/pages
[HTTP/1.1 200 OK 653ms]

09:49:03.273 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/tags
[HTTP/1.1 200 OK 207ms]

09:50:02.504 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/pages
[HTTP/1.1 200 OK 857ms]

09:50:03.328 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/tags
[HTTP/1.1 200 OK 371ms]

09:51:02.748 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/pages
[HTTP/1.1 200 OK 303ms]

09:51:03.071 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/tags
[HTTP/1.1 200 OK 231ms]

09:52:02.505 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/pages
[HTTP/1.1 200 OK 300ms]

09:52:02.775 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/tags
[HTTP/1.1 200 OK 173ms]

09:53:02.506 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/pages
[HTTP/1.1 200 OK 258ms]

09:53:02.873 XHRGET
https://nextcloud.christian-wolf.click/nextcloud/ocs/v2.php/apps/collectives/api/v1.0/p/collectives/XdWwXrRANABMd9n/tags
[HTTP/1.1 200 OK 118ms]

09:53:08.004 Source-Map-Fehler: request failed with status 404
Ressourcen-Adresse: https://nextcloud.christian-wolf.click/nextcloud/custom_apps/bookmarks/js/bookmarks-references.js?v=97a948bf-4
Source-Map-Adresse: bookmarks-references.js.map?v=33dfa366e877c79d31bc
09:53:11.738 Source-Map-Fehler: No sources are declared in this source map.
Ressourcen-Adresse: https://nextcloud.christian-wolf.click/nextcloud/apps/text/js/_plugin-vue2_normalizer-wd1ZAbRr.chunk.mjs
Source-Map-Adresse: _plugin-vue2_normalizer-wd1ZAbRr.chunk.mjs.map

[mejo-]

@christianlupus thanks for the report. Do you by chance have the encryption app in use? Could you share a list of enabled apps? I still don't understand the circumstances to reproduce this bug. On all instances I personally know, public sharing works as expected 🤔

[christianlupus]

I do not have the encyption app in place AFAIK.

Listr of apps reported by occ

Enabled:
  - activity: 5.0.0-dev.0
  - admin_audit: 1.22.0
  - app_api: 32.0.0
  - appointments: 2.6.2
  - audioplayer: 3.7.0
  - bookmarks: 16.0.1
  - bruteforcesettings: 5.0.0-dev.0
  - calendar: 6.2.0
  - checksum: 2.0.3
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - collectives: 3.5.0
  - comments: 1.22.0
  - contacts: 8.3.2
  - contactsinteraction: 1.13.1
  - cookbook: 0.11.5
  - cospend: 3.2.0
  - dav: 1.34.2
  - dav_push: 1.0.0
  - deck: 1.16.3
  - drawio: 3.1.2
  - event_update_notification: 2.8.0
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_external: 1.24.1
  - files_linkeditor: 1.1.23
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.1
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0-dev.0
  - forms: 5.2.4
  - groupfolders: 20.1.10
  - guests: 4.6.0
  - impersonate: 3.0.1
  - keeweb: 0.6.22
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - mail: 5.6.11
  - metadata: 0.23.0
  - music: 2.5.1
  - news: 27.2.0
  - nextcloud_announcements: 4.0.0-dev.0
  - notes: 4.13.0
  - notifications: 5.0.0-dev.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - passwords: 2025.12.21
  - phonetrack: 0.9.1
  - photos: 5.0.0-dev.1
  - polls: 8.6.3
  - previewgenerator: 5.12.1
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0-dev.0
  - related_resources: 3.0.0-dev.0
  - richdocuments: 9.0.2
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - socialsharing_email: 4.0.1
  - spreed: 22.0.8
  - support: 4.0.0-dev.0
  - survey_client: 4.0.0-dev.0
  - suspicious_login: 10.0.0-dev.0
  - tasks: 0.17.1
  - text: 6.0.1
  - theming: 2.7.0
  - timetracker: 0.0.86
  - twofactor_admin: 4.9.0
  - twofactor_backupcodes: 1.21.0
  - twofactor_email: 2.8.4
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - twofactor_totp: 14.0.0
  - updatenotification: 1.22.0
  - uppush: 2.3.1
  - user_status: 1.12.0
  - viewer: 5.0.0-dev.0
  - webhook_listeners: 1.3.0
  - whiteboard: 1.5.6
  - workflowengine: 2.14.0
Disabled:
  - analytics: 6.0.2 (installed 6.0.2)
  - dashboard: 7.12.0 (installed 6.0.0)
  - encryption: 2.20.0
  - files_downloadactivity: 1.18.1 (installed 1.18.1)
  - files_markdown: 2.4.1 (installed 2.4.1)
  - files_mindmap: 0.0.33 (installed 0.0.33)
  - files_readmemd: 3.0.2 (installed 3.0.2)
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - files_snapshots: 1.0.14 (installed 1.0.14)
  - files_texteditor: 2.15.1 (installed 2.15.1)
  - notify_push: 1.3.0 (installed 1.3.0)
  - systemtags: 1.22.0 (installed 1.13.0)
  - user_ldap: 1.23.0
  - weather_status: 1.12.0 (installed 1.3.0)
  - workflow_script: 3.0.0 (installed 3.0.0)

Is there anything, I can try out? I might create an account for you on the machine if that helped. Root access I do not wand to give out publicly, we would have to discuss this 😉.

[mejo-]

I further investigated the problem and found the culprit: requests to /public.php/webdav/<path> always return 404 on public shares on your instance.

There's two public DAV API endpoints to access files in Nextcloud, and I don't know the difference to be honest:

• /public.php/dav/files/<shareToken>/... (introduced in Public dav endpoint v2 server#32400)
• /public.php/webdav/...

We use the latter for retrieving the page Markdown content in public shares in Collectives. I took a look at how file shares are doing it and they use the former - which works on your instance.