nextcloud/server

[Bug]: Improper input validation in PublicPreviewController triggers internal server error

Open

Aperta il 26 mar 2026

Vedi su GitHub
 (1 commento) (0 reazioni) (0 assegnatari)PHP (34.953 star) (4865 fork)batch import
0. Needs triage32-feedbackbugfeature: previews and thumbnailsfeature: sharinggood first issue

Descrizione

⚠️ This issue respects the following points: ⚠️

Bug description

An incomplete input validation in PublicPreviewController can trigger an internal server error.

Steps to reproduce

Case A

  1. Create a public link for a folder
  2. Send GET https://server33.internal/index.php/apps/files_sharing/publicpreview/{token}
  3. 💥

https://github.com/nextcloud/server/blob/7e9e1269a059ddfc7807f977707a1800e3a303e4/apps/files_sharing/lib/Controller/PublicPreviewController.php#L123-L130

  • Default for $file is an empty string.
  • $file = $node->get(''); is still an Folder instance
  • getPreview expectes File

Case B

  1. Create a public link for a folder
  2. Send GET https://server33.internal/index.php/apps/files_sharing/publicpreview/{token}?file=notexist.png&mimeFallback=1
  3. 💥

https://github.com/nextcloud/server/blob/7e9e1269a059ddfc7807f977707a1800e3a303e4/apps/files_sharing/lib/Controller/PublicPreviewController.php#L122-L142

  • get and getPreview both throw NotFoundException.
  • However the branch with mimetype fallback only works if the preview not exists, not if the node not exists.

Expected behavior

No internal server error

Guida contributor