nextcloud/server

[Bug]: Improper input validation in PublicPreviewController triggers internal server error

Open

#59,229 建立於 2026年3月26日

在 GitHub 查看
 (1 留言) (0 反應) (0 負責人)PHP (34,953 star) (4,865 fork)batch import
0. Needs triage32-feedbackbugfeature: previews and thumbnailsfeature: sharinggood first issue

描述

⚠️ This issue respects the following points: ⚠️

Bug description

An incomplete input validation in PublicPreviewController can trigger an internal server error.

Steps to reproduce

Case A

  1. Create a public link for a folder
  2. Send GET https://server33.internal/index.php/apps/files_sharing/publicpreview/{token}
  3. 💥

https://github.com/nextcloud/server/blob/7e9e1269a059ddfc7807f977707a1800e3a303e4/apps/files_sharing/lib/Controller/PublicPreviewController.php#L123-L130

  • Default for $file is an empty string.
  • $file = $node->get(''); is still an Folder instance
  • getPreview expectes File

Case B

  1. Create a public link for a folder
  2. Send GET https://server33.internal/index.php/apps/files_sharing/publicpreview/{token}?file=notexist.png&mimeFallback=1
  3. 💥

https://github.com/nextcloud/server/blob/7e9e1269a059ddfc7807f977707a1800e3a303e4/apps/files_sharing/lib/Controller/PublicPreviewController.php#L122-L142

  • get and getPreview both throw NotFoundException.
  • However the branch with mimetype fallback only works if the preview not exists, not if the node not exists.

Expected behavior

No internal server error

貢獻者指南