Skip to content

fix(richdocuments): gate conversion with SecureViewService check#5635

Open
chrip wants to merge 2 commits into
mainfrom
fix/richdocuments-secureview-conversion-bypass
Open

fix(richdocuments): gate conversion with SecureViewService check#5635
chrip wants to merge 2 commits into
mainfrom
fix/richdocuments-secureview-conversion-bypass

Conversation

@chrip
Copy link
Copy Markdown
Contributor

@chrip chrip commented May 5, 2026

Server-side conversion bypassed the Secure View / watermark restriction that the viewer enforces, allowing a user with view-only secure access to download a clean copy via the conversion API. Reuse SecureViewService (same logic the viewer uses) to deny conversion for files that should be secured. Handle the documented NotFoundException so a cache miss surfaces as a clear, translated error instead of a 500.

  • Resolves: #
  • Target version: main

Summary

TODO

  • [ x] If the file is secured, the "Save as..." is not possible because this could bypass the security. We could hide the menu entry in this case. Would need changes in apps/files/src/actions/convertAction.ts

Checklist

  • Code is properly formatted
  • [x ] Sign-off message is added to all commits
  • Documentation (manuals or wiki) has been updated or is not required

Comment thread lib/Conversion/ConversionProvider.php
@juliusknorr juliusknorr force-pushed the fix/richdocuments-secureview-conversion-bypass branch from de711e7 to 6d71a90 Compare May 13, 2026 17:53
@github-actions
Copy link
Copy Markdown
Contributor

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)

chrip and others added 2 commits May 20, 2026 14:33
Server-side conversion bypassed the Secure View / watermark restriction
that the viewer enforces, allowing a user with view-only secure access
to download a clean copy via the conversion API. Reuse SecureViewService
(same logic the viewer uses) to deny conversion for files that should be
secured. Handle the documented NotFoundException so a cache miss surfaces
as a clear, translated error instead of a 500.

Signed-off-by: Christoph Schaefer <christoph.schaefer@nextcloud.com>
Confirmed: with the tryOpen=false change applied, the conversion is blocked with the translated "Conversion is blocked because the file is protected by Secure View." message in the log, instead of the ForbiddenException 500 that occurs with the default tryOpen=true (because fopen() on the SecureView wrapper throws). Accepting the suggestion. Thanks!

Co-authored-by: Elizabeth Danzberger <elizabeth@elzody.dev>
Signed-off-by: Christoph Schaefer <christoph.schaefer@nextcloud.com>
@juliusknorr juliusknorr force-pushed the fix/richdocuments-secureview-conversion-bypass branch from 6d71a90 to dde412f Compare May 20, 2026 12:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants