News: Integrity issue with news 13.0.0 when updating nc 13 to nc 14

[realrudi]

Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.

Results
=======
- news
    - FILE_MISSING
        - vendor/ezyang/htmlpurifier/maintenance/.htaccess

Raw output
==========
Array
(
    [news] => Array
        (
            [FILE_MISSING] => Array
                (
                    [vendor/ezyang/htmlpurifier/maintenance/.htaccess] => Array
                        (
                            [expected] => 4d51270ac56b1600199cd52c4f0fc34171bb306db59761863c87978049b771a053ebb80c8dda03b4d98bf5e43361ec0e1e1d2ad4b01fc315fb809b40acd23843
                            [current] => 
                        )

                )

        )

)

There was a similar issue - https://github.com/nextcloud/news/issues/297 - which could be solved by dropping the signature from the package in a newer version. Maybe this is possible here too?

Regards
Erik

[kevin147147]

It happend to me when updating nc 13.0.6 to 14.

[bcutter]

Same for me

It happend to me when updating nc 13.0.6 to 14.

Copy & Paste (same for me).

[rakekniven]

Same here. nc 13.0.6 to 14.

Solved by pulling file ".htaccess" out of v12.0.4 tarball and placing it in "vendor/ezyang/htmlpurifier/maintenance/".

Please update release package.

[tumpio]

You can also get it from htmlpurifier's repository:
https://github.com/ezyang/htmlpurifier/blob/master/maintenance/.htaccess

This issue has also been reported as server issue:
https://github.com/nextcloud/server/issues/9765

[FriedCircuits]

Thanks that worked. I downloaded it to the docker bind mount of nextcloud data.

[nado]

I don't understand, is it a packaging error or a nextcloud-server issue?

[Happyfeet01]

Thanks for this fix @rakekniven

[rakekniven]

I don't understand, is it a packaging error or a nextcloud-server issue?

@nado This is an packaging error of the news app. Not server side. Server can fix this by writing files. On the other side: If packaging is ok, that error here would not be existent.

[nachoparker]

Even easier

F=/var/www/nextcloud/apps/news/vendor/ezyang/htmlpurifier/maintenance/.htaccess
echo "Deny from all" > "$F"
sudo -u www-data php /var/www/nextcloud/occ integrity:check-app --path=/var/www/nextcloud/apps/news news

[Huster-at-github]

Did not have this in 14.0.0
Have this error now in 14.0.1

Workaround of @nachoparker did not help.

EDIT: After

• Creating .htaccess
• Disabling, uninstalling, enabling App again

it works now without any issue! :-)

[mannp]

With some changes to @nachoparker for my specific setup it worked fine for me.

Thanks for the fix for 14.0.1

[dewomser]

Did not have this in 14.0.0
Have this error now in 14.0.1

Workaround of @nachoparker did not help.

EDIT: After

* Creating .htaccess

* Disabling, uninstalling, enabling App again

it works now without any issue! :-)

Thank You ! After following your workaround, news is Ok. No more warnings.

[nado]

I managed to get rid of this error in 14.0 by uninstalling and installing again.
Now that I updated to 14.0.1 I get this warning again.
I tried uninstalling and reinstalling the app again but it didnt have any effect.
Were the integrity tests done on "worked around" solution? Or were they done on fresh install?

I don't really care about it and I dont use apache, I just expect this app to work without annoying warning message and without having to fix it in a normal situation. I will provide any feedback/config you ask ;)

[skjnldsv]

@nado you get this warning again??
Okay, there must be something wrong with the config because I don't have it on my installation.

The fact that you don't use apache is even more strange. I'll try to check what's going on later.

[donpatrice]

I also get this error after upgrading to 14.0.1 using apache.

[skjnldsv]

Actually I'm closing this. The file is in the archive so there is nothing wrong here.
This is coming from your config.

[skjnldsv]

PS: We'll still remove the signature of this file on the next versions manually.

[nado]

Yes, I can see that the archive is ok on github.
When extracting app manually, php occ integrity:check-app news doesnt return anything but the web ui tells me all files in apps/news are extra files.

Whats really weird is that it's like this file is ignored from the extraction, but I can confirm I got version 13.0.1.

I tried multiple combinations of disabling/rm/install. If anyone could point me to nextcloud code for installing app I'd be grateful.

[skjnldsv]

@Gatak server

[rakekniven]

Why server? Please provide some arguments if possible.

[tux1337]

@skjnldsv remove the signature of file in future versions is in my opinion a dirty fix and no solution.

If it isn't important that the file is delivered correctly, it can be removed completely. But as long as it is a part of the package it should be checked.

In my eyes it makes absolutely sense that the .htaccess denys the access to the maintance folder. Or am I wrong? Are there arguments that it isn't necessary any more?

[skjnldsv]

@tux1337 the .htaccess file we're talking about is one that have been forgotten by a library we use.
I doesn't play anything related to security on the nextcloud instance :)
Do not worry, with or without, this is not an issue.