Error shown when file upload receives 403 references "access control" + never includes any additional explanation text sent on by server(s)

[grnd-alt]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When uploading a file and the proxy has a file-filter rule in place to block the upload by sending a 403. Netflix UI says: Operation is blocked by access control indicating that it's the files_accesscontrol app who blocks

Error is caused by this line: https://github.com/nextcloud/server/blob/master/apps/files/src/views/FilesList.vue#L604
the server sends response content as well but it's only checked for the 403 code.

I know it's a very niche issue so LMK if that needs fixing.

Steps to reproduce

1. block file uploads with proxy rule
2. upload file
3. see error Operation blocked by access control

Expected behavior

more clear error message

Nextcloud Server version

master

[joshtrichards]

When uploading a file and the proxy has a file-filter rule in place to block the upload by sending a 403.

Can you elaborate this? What precisely are you doing on your reverse proxy?

[grnd-alt]

@joshtrichards the reverse proxy blocks http puts/posts that contain specific file types (e.g.) zips. The blocking is done by returning a 403 instead of forwarding to the nextcloud service.

An example config would look something like that.

if ($request_method ~* "(POST|PUT)") {
            if ($content_type ~* "(multipart/form-data|application/zip)") {
                     return 403;
            }
}

nextcloud FE than does not check if the content but just the http error code, which leads to displaying upload blocked by files_accesscontrol

[joshtrichards]

This doesn't sound a like a bug though. It's behaving as designed. :-)

A 403 just means local policy is denying access. That's it. We don't specifically say anything about files_accesscontrol (and we generate 403s for various reasons).

Maybe an enhancement request though so I'll leave it open.