Server: NC12: apps outside of nextcloud's root directory result in "ResourceLocator can not find a web root"

[philfry]

This bug is similar to #5057

Steps to reproduce

1. move apps from /var/www/nextcloud/apps to /var/www/nextcloud-apps
2. change config to

'apps_paths' =>  
  array (
    0 =>  
    array (
      'path' => '/var/www/nextcloud-apps',
      'url' => '/apps',
      'writable' => true,
    ),  
  ), 

1. set alias in httpd.conf:

Alias /apps /var/www/nextcloud-apps

Expected behaviour

No errors in log, no ui glitches

Actual behaviour

css is not loaded, errors in log:

{"reqId":"...","level":3,"time":"2017-06-07T16:17:26+02:00","remoteAddr":"xxx","user":"xxx","app":"lib","method":"GET","url":"\/index.php\/apps\/files\/","message":"ResourceLocator can not find a web root (root: \/var\/www\/nextcloud-apps\/files, file: index.php\/css\/files\/merged.css, webRoot: , throw: true)","userAgent":"Mozilla\/5.0 (X11; Fedora; Linux x86_64; rv:53.0) Gecko\/20100101 Firefox\/53.0","version":"12.0.0.29"}

Server configuration

Operating system:
CentOS 7

Web server:
httpd 2.4

Database:
mariadb 10.2.6

PHP version:
7.1.5

Nextcloud version:
12.0.0

Updated from an older Nextcloud/ownCloud or fresh install:
updated from 11.0.3

Where did you install Nextcloud from:
https://download.nextcloud.com/server/releases/nextcloud-12.0.0.zip

Signing status:

Alle Checks bestanden.

...

[jospoortvliet]

@philfry does the patch from https://github.com/nextcloud/server/issues/5057#issuecomment-304533654 fix it? Then this would also be fixed by https://github.com/nextcloud/server/pull/5252

[philfry]

@jospoortvliet no, unfortunately the patch didn't solve the problem.
I'll do some debugging later, maybe I can find where the webroot gets lost.

[philfry]

Since the bug is not caused by a symlink the realpath fix won't help here.

As far as I understood the exception raises in lib/private/Template/CSSResourceLocator.php because there's no mappings entry of the relocated app directories /var/www/nextcloud-apps/....

I don't see any way to append other directories to these mappings as they seem to be hardcoded.
They get initialized in lib/private/Template/ResourceLocator.php (constructor) by findStylesheetFiles in lib/private/TemplateLayout.php with array(\OC::$SERVERROOT => \OC::$WEBROOT).

btw - since NC 9 does not have these resource appending functions having the apps outside of NC's webroot is working fine with NC 9.

[derkostka]

I can confirm that an apps directory outside the DocumentRoot is not possible anymore. Even the webroot fix does not apply, as stated above. Aliasing the directory or put a symlink does not work either, so #5252 does not help, this is a different issue.

[blizzz]

What is the motivation to move out the apps? This scenario is not very well tested unfortunately, and – nowadays – does not bring many advantages.

[philfry]

@blizzz
As there are no pre-packaged nextcloud releases for rhel/centos/SL/fedora/... yet it makes upgrading way easier. When having 3rd party apps and the config file outside of the nextcloud root folder all I have to do is to wipe the nextcloud folder and unpack the archive file for a clean nextcloud installation.

[kyrofa]

What exactly is broken here: moving the default apps out of the root, or ANY item in apps_paths being outside the root? The Nextcloud snap uses the latter for user-installed apps as the snap itself (including the default apps) is read-only.

[jospoortvliet]

So it is needed for the Snap as well as packages for various distributions.

[skjnldsv]

Can someone try this on master? There was a lot of fixes about the webroot detection lately and I'm not sure if the changes have been backported! :)

[skjnldsv]

Tried, master13 is working.
It's probably a stable12 issue :)

[skjnldsv]

@dmp1ce did you tried stable12@latest?

[dmp1ce]

@skjnldsv I'm on wonderfall/nextcloud:latest from Docker Hub. I just updated my image version still getting this issue.

[skjnldsv]

I need to try and investigate

[FreeMinded]

Is there a workaround to fix this until it's released?

[skjnldsv]

@FreeMinded @philfry @fhaefemeier @David-Development @tbrasser @dmp1ce @derkostka
Mind taking a look at https://github.com/nextcloud/server/pull/7061?

[philfry]

thanks @skjnldsv for your patch. Unfortunately it didn't help.

[kyrofa]

It doesn't sound like this is about ANY apps being outside of the webroot, but about the MAIN apps being outside of the webroot. Right? As I said previously, I'm able to use apps outside of the root, but that's leaving the main apps in the root. Indeed, this issue seemingly has nothing to do with symlinks.

[skjnldsv]

I can reproduce, This has to do with any apps beeing outside the webroot. But it does not seems to have something related to symlinks yeah :)

[kyrofa]

So you can reproduce this leaving the main apps alone and simply adding another apps_path that's outside of the webroot?

[skjnldsv]

Yep! :)

[skjnldsv]

@jospoortvliet Why does the snap uses an apps path outside the root?

[skjnldsv]

Okay, I don't see how we can fix this in server. This needs a webserver patch.
Nginx or appache can't serve a file outside its own defined root.

location /apps2/ {
    root /srv/http/;
} 

@FreeMinded @philfry @fhaefemeier @David-Development @tbrasser @dmp1ce @derkostka
Please take a look at the fix for docker (which should apply easily to any nginx conf, docker or not)
https://github.com/Wonderfall/dockerfiles/pull/264

[kyrofa]

@skjnldsv snaps are squashfs images, which by definition are read-only. In order to allow apps to be installable, we need a writable area. So we leave the default set of apps in the webroot and tell Nextcloud they're read-only, and then expose another dir that's writable. We do so with an Apache alias and Directory directive, though, which is probably why we don't see this issue. @philfry you mention that you use an alias, but don't mention the directory directive. Have you tried that?

[philfry]

@kyrofa here's my httpd config:

   <Directory /var/www/nextcloud-apps>
        Options +FollowSymLinks
        Require all granted
        AllowOverride None
        <IfModule xsendfile_module>
            SetEnv MOD_X_SENDFILE_ENABLED 1
            XSendFile On
        </IfModule>
        <IfModule dav_module>
            Dav off 
        </IfModule>
    </Directory>

    Alias /apps /var/www/nextcloud-apps

While you're using an extra apps directory, I move all the apps to nextcloud-apps.
I'll give your nextcloud config a try.
Thanks :)

[kyrofa]

Okay, I'm finally able to reproduce this in the snap. Weirdly, it doesn't affect all apps (e.g. the calendar works fine), but I see this using the Contacts app. I suspect it has something to do with apps that use scss versus those that don't.

While, yes, the Apache alias is required, as @philfry mentioned in one of the earlier comments, I've also traced this back to a lack of a mapping between the app root on disk to the app alias on the web server. Having an alias is not all that is required, Nextcloud needs to actually use it.

[kyrofa]

Alright, I've got a fix for this. I'll clean it up and propose it later tonight or first thing in the morning. Note that it is already fixed in master (thus NC13), targeting this fix for 12.0.4.

[Gymnae]

This bug is still appearing in NC13 RC2 with contacts, talk (spreed) & decks.

[skjnldsv]

@Gymnae please open a new issue with your config and log :)

[HaleyACS]

@blizzz
As there are no pre-packaged nextcloud releases for rhel/centos/SL/fedora/... yet it makes upgrading way easier. When having 3rd party apps and the config file outside of the nextcloud root folder all I have to do is to wipe the nextcloud folder and unpack the archive file for a clean nextcloud installation.

FYI - when using docker, and creating and updated image with base NC installation. If one does not have an external apps folder, admin needs to re-install each and every app again (which is a real pain). So yes - any fix is appreciated. Just saw that too happening using NC 17.0.5 and having updated one app (Deck).