Unable to upload attachments from the description popover

[jurgenhaas]

Describe the bug

When selecting a card and editing notes, I'd like to add attachments to them. When clicking on the folder icon in the editor area, it opens a popup with the expected title but nothing else. The only thing I can do is closing that popup again. Here is how that looks like:

To Reproduce

Steps to reproduce the behavior:

1. Go to '/index.php/apps/deck/#!/board/4/'
2. Click on a card
3. Click in the description field
4. Click on the folder icon in that text area
5. See the area

Expected behavior

Navigation through files in the NC instance is expected where I could select one or more existing files.

Client details:

• OS: Ubuntu 18.04
• Browser Chrome and Firefox
• Version latest stable versions
• Device: desktop

Operating system: Ubuntu 18.04

Web server: Apache

Database: MySQL

PHP version: 7.2.19

Nextcloud version: 16.0.3

Where did you install Nextcloud from: From source

List of activated apps:

  - accessibility: 1.2.0
  - activity: 2.9.1
  - admin_audit: 1.6.0
  - announcementcenter: 3.5.1
  - apporder: 0.7.1
  - audioplayer: 2.7.2
  - bookmarks: 1.0.6
  - bruteforcesettings: 1.4.0
  - calendar: 1.7.0
  - circles: 0.17.5
  - cloud_federation_api: 0.2.0
  - comments: 1.6.0
  - contacts: 3.1.3
  - cookbook: 0.1.7
  - dashboard: 6.0.0
  - dav: 1.9.2
  - deck: 0.6.4
  - external: 3.3.0
  - federatedfilesharing: 1.6.0
  - federation: 1.6.0
  - files: 1.11.0
  - files_automatedtagging: 1.6.0
  - files_downloadactivity: 1.5.0
  - files_fulltextsearch: 1.3.2
  - files_fulltextsearch_tesseract: 1.3.0
  - files_pdfviewer: 1.5.0
  - files_readmemd: 1.1.0
  - files_rightclick: 0.13.0
  - files_sharing: 1.8.0
  - files_texteditor: 2.8.0
  - files_trashbin: 1.6.0
  - files_versions: 1.9.0
  - files_videoplayer: 1.5.0
  - firstrunwizard: 2.5.0
  - flowupload: 0.1.2
  - fulltextsearch: 1.3.4
  - fulltextsearch_elasticsearch: 1.3.4
  - gallery: 18.3.0
  - gpxedit: 0.0.11
  - gpxmotion: 0.0.9
  - gpxpod: 4.0.1
  - group_everyone: 0.1.2
  - groupfolders: 4.0.4
  - impersonate: 1.3.0
  - logreader: 2.1.0
  - lookup_server_connector: 1.4.0
  - metadata: 0.9.0
  - news: 14.0.0-alpha0
  - nextcloud_announcements: 1.5.0
  - notes: 3.0.0
  - notifications: 2.4.1
  - oauth2: 1.4.2
  - password_policy: 1.6.0
  - passwords: 2019.7.2
  - phonetrack: 0.5.2
  - polls: 0.10.2
  - previewgenerator: 2.1.0
  - privacy: 1.0.0
  - provisioning_api: 1.6.0
  - rainloop: 6.0.2
  - ransomware_detection: 0.5.2
  - ransomware_protection: 1.4.0
  - recommendations: 0.4.0
  - registration: 0.4.6
  - richdocuments: 3.3.13
  - serverinfo: 1.6.0
  - sharebymail: 1.6.0
  - sharerenamer: 2.6.0
  - social: 0.2.6
  - spreed: 6.0.2
  - support: 1.0.0
  - survey_client: 1.4.0
  - systemtags: 1.6.0
  - tasks: 0.11.0
  - text: 1.0.1
  - theming: 1.7.0
  - twofactor_backupcodes: 1.5.0
  - twofactor_totp: 2.1.2
  - updatenotification: 1.6.0
  - viewer: 1.0.0
  - workflowengine: 1.6.0

Browser log

Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src"). 3 deck:1:1
Content Security Policy: The page's settings blocked the loading of a resource at eval ("script-src"). deck.js:39154:6
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src"). deck:39:41581
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src"). deck:41130:17
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src"). deck:39:41581
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src"). deck:41130:17
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src"). deck:39:41581
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src"). deck:41130:17
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src"). deck:39:41581
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src"). deck:41130:17

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[juliusknorr]

Hm, I cannot reproduce that. Can you retry with 0.6.5?

[jurgenhaas]

Unfortunately, this is stil the same behavior on 0.6.5

[ghosttable]

Are You running any script blocker? Noscript umatrix privacy badger ublock origin, anything?

[jurgenhaas]

Yes, I do run uBlock origin and Privacy badger but none of them is blocking anything on my own domains. I've just checked again and there is no blocking.

Maybe the new browser blocking does? I heard that firefox introduced some built-in blocking too but I can't tell where I could find the logs of what is blocked.

[juliusknorr]

Anyone able to provide me with a test account?

[jurgenhaas]

What's interesting, I went to about:config in FF and went to security.csp.enable and turned it of. Now, when reloading the deck the wanrings in the console are gone. However, the problem with adding attachments remains the same.

[juliusknorr]

The warnings are most likely only related to the javascript code checking if such a csp is actually enabled.

[jurgenhaas]

@juliushaertl I've just created a test account on my site and an invite should be in your inbox.

[juliusknorr]

Thanks, just tested and it works fine there for me as well. Could you check the network tab when you try to add a attachment on the card that fails for you? There should be a request like this:

[jurgenhaas]

Hmm, that's interesting. I was loggin into the site with a brand new user account as well and it wasn't working. Also, there is no request like this in the network tab either. So that leads towards the idea that it is either browser or local network related.

[juliusknorr]

Strange, the request should still be triggered if it would be network related.

[juliusknorr]

Just to be sure, the attachments tab shows them just fine?

[jurgenhaas]

That's true, regarding the network issue. I've also tried several different browsers, even without any addons installed. And I'm getting the same issue everywhere.

The attachments tab only allows upload of attachments not the selection of existing files in NC. But yes, that works and the uploaded attachment is then shown in that tab.

[juliusknorr]

Maybe there is a confusion with the flow here, it is currently not possible to upload attachments from the popover. That only allows selecting them. 🙈 Maybe that is the issue

[jurgenhaas]

Oh my goodness. You're right. My expectation was that the attachment tab allows me to upload new attachments and that adding attachments to a card description would allow me to select attachments from NC. I can confirm, that selecting from previous uploads does indeed work in the popup.

So, does that mean that uploading in the attachment tab is not card related? Although the tab is in the card? That's a bit confusing then.

Are you planning that existing files from NC can be attached to cards?

[juliusknorr]

So, does that mean that uploading in the attachment tab is not card related? Although the tab is in the card? That's a bit confusing then.

It is card related, both the tab and the sidebar tab show the same list of attachments for the current card. Its just that uploading new ones is only possible though the tab at the moment. Yes, this is definitely something that needs improvement.

The ticket for attaching files from the Nextcloud Files app is here: #564

[jurgenhaas]

Thanks a lot @juliushaertl

[juliusknorr]

Fixed with #2035