Bug 27.1.5: files_accesscontrol is breaking workflow_script

[SjoerdV]

Steps to reproduce

1. Install workflow_script (https://github.com/nextcloud/workflow_script) App for Flow
2. Install this App
3. Configure a flow for this App (see image)
4. Monitor the log

Expected behaviour

No interference with rest of workflows configured.

Actual behaviour

Constant logging (10 times per second) like this, with no interaction to the system taking place

{
  "reqId": "0mimCZxbpCoRqb4IHr81",
  "level": 0,
  "time": "2023-12-15T17:19:00+00:00",
  "remoteAddr": "192.168.2.xxx",
  "user": "REDACTED",
  "app": "workflowengine",
  "method": "POST",
  "url": "/nextcloud/apps/text/session/sync",
  "message": "Flow activation: rules were requested for operation Block access to a file",
  "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0",
  "version": "27.1.5.1",
  "data": {
    "level": "0",
    "app": "workflowengine"
  }
}
{
  "reqId": "0mimCZxbpCoRqb4IHr81",
  "level": 0,
  "time": "2023-12-15T17:19:00+00:00",
  "remoteAddr": "192.168.2.xxx",
  "user": "REDACTED",
  "app": "workflowengine",
  "method": "POST",
  "url": "/nextcloud/apps/text/session/sync",
  "message": "No flow configurations is going to run Block access to a file",
  "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0",
  "version": "27.1.5.1",
  "data": {
    "level": "0",
    "app": "workflowengine"
  }
}

2. SEVERE: Other flows especially using the workflow_script App (https://github.com/nextcloud/workflow_script) will not get triggered anymore

Server configuration

{
    "mail_smtpstreamoptions": {
        "ssl": {
            "allow_self_signed": true,
            "verify_peer": false,
            "verify_peer_name": false
        }
    },
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "localhost",
        "*"
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "dbtype": "mysql",
    "version": "27.1.5.1",
    "hashingThreads": 4,
    "memcache.local": "\\OC\\Memcache\\APCu",
    "filelocking.enabled": true,
    "memcache.locking": "\\OC\\Memcache\\Redis",
    "redis": {
        "host": "***REMOVED SENSITIVE VALUE***",
        "port": 0
    },
    "overwrite.cli.url": "https:\/\/xxx/nextcloud",
    "htaccess.RewriteBase": "\/nextcloud",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpmode": "smtp",
    "mail_smtpauth": 1,
    "mail_sendmailmode": "smtp",
    "mail_smtpauthtype": "LOGIN",
    "mail_smtpsecure": "tls",
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpport": "587",
    "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
    "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
    "allow_local_remote_servers": true,
    "app.mail.attachment-size-limit": 10485760,
    "app.mail.verify-tls-peer": false,
    "maintenance": false,
    "theme": "",
    "loglevel": 0,
    "updater.secret": "***REMOVED SENSITIVE VALUE***",
    "app_install_overwrite": [
        "issuetemplate"
    ]
}

Operating system: Linux 6.1.0-15-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.66-1 (2023-12-09) x86_64

Webserver: Apache (fpm-fcgi)

Database: mysql 10.11.4

PHP version: 8.2.7

Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, json, random, Reflection, SPL, session, standard, sodium, cgi-fcgi, mysqlnd, PDO, xml, apcu, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, gettext, iconv, igbinary, imagick, intl, exif, mysqli, pdo_mysql, Phar, posix, readline, redis, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, xmlreader, xmlwriter, xsl, zip, Zend OPcache

Nextcloud version: 27.1.5 - 27.1.5.1

Updated from an older Nextcloud/ownCloud or fresh install:

Where did you install Nextcloud from: unknown

Signing status

[]

No errors have been found.

List of activated apps:

Enabled:
 - activity: 2.19.0
 - admin_audit: 1.17.0
 - announcementcenter: 6.7.0
 - approval: 1.1.1
 - bruteforcesettings: 2.7.0
 - calendar: 4.6.0
 - checksum: 1.2.2
 - circles: 27.0.1
 - cloud_federation_api: 1.10.0
 - comments: 1.17.0
 - contactsinteraction: 1.8.0
 - dashboard: 7.7.0
 - dav: 1.27.0
 - deck: 1.11.2
 - drawio: 2.1.4
 - external: 5.2.1
 - federatedfilesharing: 1.17.0
 - federation: 1.17.0
 - files: 1.22.0
 - files_accesscontrol: 1.17.1
 - files_automatedtagging: 1.17.0
 - files_external: 1.19.0
 - files_pdfviewer: 2.8.0
 - files_reminders: 1.0.0
 - files_retention: 1.16.0
 - files_rightclick: 1.6.0
 - files_scripts: 3.0.0
 - files_sharing: 1.19.0
 - files_trashbin: 1.17.0
 - files_versions: 1.20.0
 - firstrunwizard: 2.16.0
 - flow_notifications: 1.7.0
 - forms: 3.4.3
 - groupfolders: 15.3.1
 - guests: 2.5.1
 - integration_onedrive: 3.1.0
 - issuetemplate: 0.7.0
 - logreader: 2.12.0
 - lookup_server_connector: 1.15.0
 - mail: 3.5.0
 - metadata: 0.19.0
 - nextcloud_announcements: 1.16.0
 - notifications: 2.15.0
 - oauth2: 1.15.1
 - password_policy: 1.17.0
 - photos: 2.3.0
 - privacy: 1.11.0
 - provisioning_api: 1.17.0
 - quota_warning: 1.18.0
 - recommendations: 1.6.0
 - related_resources: 1.2.0
 - settings: 1.9.0
 - sharebymail: 1.17.0
 - spreed: 17.1.3
 - support: 1.10.0
 - survey_client: 1.15.0
 - suspicious_login: 5.0.0
 - systemtags: 1.17.0
 - tables: 0.6.4
 - text: 3.8.0
 - theming: 2.2.0
 - theming_customcss: 1.15.0
 - twofactor_backupcodes: 1.16.0
 - twofactor_totp: 9.0.0
 - updatenotification: 1.17.0
 - user_retention: 1.11.0
 - user_saml: 5.2.5
 - user_status: 1.7.0
 - viewer: 2.1.0
 - weather_status: 1.7.0
 - workflow_pdf_converter: 1.12.0
 - workflow_script: 1.12.1
 - workflowengine: 2.9.0
Disabled:
 - encryption: 2.13.0
 - files_downloadactivity: 1.16.0
 - serverinfo: 1.17.0
 - user_ldap
 - webhooks: 0.4.3

Nextcloud configuration:

Are you using encryption: no

Are you using an external user-backend, if yes which one: no

Client configuration

See logs above

Logs

Nextcloud log (data/owncloud.log)

See above

Browser log

Not applicable

[nickvergessen]

Constant logging (10 times per second) like this

It's debug messages, so this is totally expected. As per nextcloud/server#32132 (comment) you should just increase your log level

with no interaction to the system taking place

You have the text app open (see URL on the request: /nextcloud/apps/text/session/sync)

SEVERE: Other flows especially using the workflow_script App (https://github.com/nextcloud/workflow_script) will not get triggered anymore

That is totally possible, it depends on your rules. But this is not a bug. Users must not be able to set up workflow scripts that allows them to bypass administration configured access control.

Feel free to share the details of your rules and what the workflow script it trying to achieve and I might be able to help you work around it by properly configuring your rules

[SjoerdV]

hi @nickvergessen , thanks for your reply, Sorry for my late response.
Pretty sure I didn't have any app opened but logs kept on flowing anyway. Anyway, it seems all is working again after I adjusted my logging to only log the Workflow apps below and put the rest on Level 2 Thanks for your tip: nextcloud/server#32132 (comment). Maybe I did have a rule that was broken...

Just so others might benefit, this is the scenario I tried to achieve:

I would like to use Admin (not Personal) Flow rules for these 4 Apps in synchronicity.

• https://apps.nextcloud.com/apps/files_automatedtagging
• https://apps.nextcloud.com/apps/files_accesscontrol
• https://apps.nextcloud.com/apps/workflow_script
• https://apps.nextcloud.com/apps/workflow_pdf_converter

NOTE: If one of these Flow fails, the others might just not work as well. I find this a bit fragile, but hey.

These are the rules I set up (just for testing):

They all work great. One issue I got is that when a file is marked sensitive but it has already been downloaded by the Sync client, it won't get hidden (or de-synced), it becomes a read-only file. Is that how it is supposed to work?

[nickvergessen]

Is that how it is supposed to work?

Yeah, it could be that the rules apply based on network address etc, so clients are just blocked and don't remove it, so it's not downloading > deleting > downloading > deleting, etc when toggling between intranet and mobile networks, etc.