News: NC Update to 20, cannot update News anymore 14.2.2 -> 15.1.1

[natrius]

IMPORTANT

Read and tick the following checkbox after you have created the issue or place an x inside the brackets ;)

• [x] I have read the CONTRIBUTING.md and followed the provided tips
• [x] I accept that the issue will be closed without comment if I do not check here
• [x] I accept that the issue will be closed without comment if I don not fill out all items in the issue template.

Explain the Problem

Updated NextCloud to 20.0.6, resolved all errors after the update and i'm not able to update News. The error is
Es ist ein Fehler bei der Anfrage aufgetreten. Es kann nicht fortgefahren werden. Die App konnte nicht aktualisiert werden.

Steps to Reproduce

1. Old version installed on Nextcloud 19
2. Update to Nextcloud 20
3. Try to update News via the browser updater

System Information

• News app version: 14.1.1
• Nextcloud version: 20.0.6
• Cron type: What is meant? */5 * * * * php -f /var/www/nextcloud/cron.php > /dev/null 2>&1
• PHP version: 7.4 (manually set)
• Database and version:
• Browser and version: Firefox 85.0
• Distribution and version: Server Ubuntu Server LTS 18.04

Contents of nextcloud/data/nextcloud.log

For some reason i'm currently not able to access /data/
Will try.

Paste output here

Contents of Browser Error Console

GEThttps://nextcloud.kraw.eu/settings/apps/update/news
[HTTP/2 500 Internal Server Error 1127ms]

I read https://github.com/nextcloud/news/issues/960 and https://github.com/nextcloud/news/issues/938 but it does not seem like these affect me.

[SMillerDev]

For some reason i'm currently not able to access /data/

This seems like a good reason for apps to fail. In addition to that I'd recommend installing the latest news version and trying with that.

[natrius]

Well, no. Other apps could be updated without problem and i should not be able to access /nextcloud/data/ as there is user-data stored. The question remains, why new is not able to update but every other app is.

EDIT: Or do you suggest deleting and reinstalling the news app?

[Grotax]

Without the log I don't think we can figure out what the issue is.

[trendless]

Well, no. Other apps could be updated without problem and i should not be able to access /nextcloud/data/ as there is user-data stored. The question remains, why new is not able to update but every other app is.

EDIT: Or do you suggest deleting and reinstalling the news app?

I had trouble updating several apps including News after upgrading from 19.0.7 to 20.0.6. After uninstalling apps, I am still unable to reinstall News (and Social) because of an extracting error, which is the same error I got when trying to update.

So deleting and reinstalling doesn't appear to be the answer either, unless you do more manual mucking around (eg erase all the relevant directories and database entries).

[Grotax]

Without logs we can't figure out anything.

[SMillerDev]

Keep in mind that installing apps is not up to the app itself so bugs there need to be reported to nextcloud/server.

[anoymouserver]

It may be related to https://github.com/nextcloud/server/pull/25335 which prevents apps from downloading/installing.

[SMillerDev]

Closing this as it's likely a server bug

[natrius]

Whats different to every other app? Because I was able to update about 4-10 other apps without problem. Just news is making a problem. Will look for the logs and I would prefer that the issue stays open until then.

[saimn]

Same error here after upgrading to Nextcloud 20 and trying to upgrade News from 14.2.2 to 15.1.1
The logs show this:

[core] Error: Exception: Could not extract app news at <<closure>>

0. /...nextcloud/lib/private/Installer.php line 198
   OC\Installer->downloadApp("*** sensitive parameter replaced ***", false)
1. /...nextcloud/apps/settings/lib/Controller/AppSettingsController.php line 532
   OC\Installer->updateAppstoreApp("*** sensitive parameters replaced ***")
2. /...nextcloud/lib/private/AppFramework/Http/Dispatcher.php line 169
   OCA\Settings\Controller\AppSettingsController->updateApp("*** sensitive parameters replaced ***")
3. /...nextcloud/lib/private/AppFramework/Http/Dispatcher.php line 100
   OC\AppFramework\Http\Dispatcher->executeController(OCA\Settings\Con ... {}, "updateApp")
4. /...nextcloud/lib/private/AppFramework/App.php line 152
   OC\AppFramework\Http\Dispatcher->dispatch(OCA\Settings\Con ... {}, "updateApp")
5. /...nextcloud/lib/private/Route/Router.php line 309
   OC\AppFramework\App::main("OCA\\Settings\\ ... r", "updateApp", OC\AppFramework\ ... {}, {appId: "*** sen ... "})
6. /...nextcloud/lib/base.php line 1008
   OC\Route\Router->match("/settings/apps/update/news")
7. /...nextcloud/index.php line 37
   OC::handleRequest()

GET /settings/apps/update/news

[Mannshoch]

Same error here. All other app could get updated

(I uninstalled the app and tried to reinstall it again)

[settings] Error: Exception: Could not extract app news at <<closure>>

0. .../apps/settings/lib/Controller/AppSettingsController.php line 445
   OC\Installer->downloadApp("news")
1. .../lib/private/AppFramework/Http/Dispatcher.php line 169
   OCA\Settings\Controller\AppSettingsController->enableApps(["news"], [])
2. .../lib/private/AppFramework/Http/Dispatcher.php line 100
   OC\AppFramework\Http\Dispatcher->executeController(OCA\Settings\Con ... {}, "enableApps")
3. .../lib/private/AppFramework/App.php line 152
   OC\AppFramework\Http\Dispatcher->dispatch(OCA\Settings\Con ... {}, "enableApps")
4. .../lib/private/Route/Router.php line 309
   OC\AppFramework\App::main("OCA\\Settings\\ ... r", "enableApps", OC\AppFramework\ ... {}, {_route: "settin ... "})
5. .../lib/base.php line 1008
   OC\Route\Router->match("/settings/apps/enable")
6. .../index.php line 37
   OC::handleRequest()

POST /settings/apps/enable

[trendless]

I tried a completely fresh install of NC 20.0.6 and every app I've installed via the webui works except for News and Social, which both fail the same way:

[Grotax]

This is a Issue on the Server side, we can't do anything to fix it, the archive is not corrupt or broken, nothing else has changed.
Apparently it's a new bug that was introduced lately into the server.

You may manually download the news.tar.gz file and install it on your server, if that is too complicated for you wait for a new release of nextcloud.

Please don't post any "I also have this issue" posts anymore else I will lock the issue.

[woefe]

The problem is in https://github.com/nextcloud/3rdparty/commit/099e537a03d162302c2366f7d53088d5bf623c4c. The fix for the out-of-path write vulnerability is probably too restrictive?

[anoymouserver]

We've implemented a workaround in the latest v15.2.2 release which should solve the extraction issue until the 3rd party dependencies are fixed.
Special thanks to @woefe for finding and reporting the real cause!