[Bug]: Original file version of Word .docx file corrupt after restoring it from file version history; file versions disappear

[hitWebLux]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When the original version of a .docx file is restored from version history, downloaded and opened in MS Word, there is an error about the file being corrupted. It can then be restored easily in MS Word.

Further Investigation:

I created a few additional versions of the original file by slightly modifying the content and uploading it using the same name an location again. I randomly restored different versions, downloaded them and compared their hashes.

Observations:

• When restoring the original file the first and second time, it has a different hash than the original file
• When restoring the original file the third time, it has its original hash again. For this file, MS Word also doesn't complain anymore
• When restoring different versions and downloading them, sometimes MS Edge reports that these files cannot be downloaded. They are however stored in my "Downloads" folder with a .crdownload file extension AND have their expected file hashes.

Get-FileHash * | sort -Property Path

Algorithm Hash                                                              Path
--------- ----                                                              ----
SHA256    7A0325585A963A3CE9DFA400EB99E3E917AEF05B0FDE27CA23E3E67520F2245A  .\original.docx
SHA256    DFDCF4C6B9DF4A2970221B82A74E7B90CDA7503F6E21781E83A38B85E9494F2B  .\originalRestored.docx
SHA256    DFDCF4C6B9DF4A2970221B82A74E7B90CDA7503F6E21781E83A38B85E9494F2B  .\originalRestoredAgain.docx
SHA256    7A0325585A963A3CE9DFA400EB99E3E917AEF05B0FDE27CA23E3E67520F2245A  .\originalRestoredAgainAgain.docx
																		    
SHA256    084FF1136744E5C87AD79B505099168DF9C63CF2D5DF250EE1C4E49709086A16  .\v1.docx
SHA256    084FF1136744E5C87AD79B505099168DF9C63CF2D5DF250EE1C4E49709086A16  .\v1Restored.crdownload
SHA256    084FF1136744E5C87AD79B505099168DF9C63CF2D5DF250EE1C4E49709086A16  .\v1Restored.docx
																		    
SHA256    6BF6829680E47037CD1C3A33C3CCBD54751A92874EC3EB5A48959B263EE7D227  .\v2.docx
SHA256    6BF6829680E47037CD1C3A33C3CCBD54751A92874EC3EB5A48959B263EE7D227  .\v2Restored.crdownload
																		    
SHA256    55B9713EC14B045E246E8EDEBE550C04768ECCA160FC087F27AEF31186AA7118  .\v3.docx
SHA256    55B9713EC14B045E246E8EDEBE550C04768ECCA160FC087F27AEF31186AA7118  .\v3Restored.crdownload

I repeated the procedure for a new word file created with Word 2016 to check if my original file was causing the issues:

• I uploaded the file and replaced it consecutively with different versions without restoring or touching it otherwise in between the uploads
• After having created 4 versions including the original, I tried to restore the original version
• It failed with an nextcloud error reading like "File version could not be restored" (was german)
• While restoring different versions of the file, some versions just disappeared from the file version history

Steps to reproduce

1. Upload a .docx file
2. Edit the file locally with MS Word
3. Upload the edited file again using the same name and location
4. Choose to keep the new file, which creates a new version of the file
5. Restore the original file from the versions tab
6. Download the restored original file
7. Open the file locally with MS Word and/or compare its hash with the local original file

Expected behavior

The original version of the file can be opened in MS Word without errors.
The restored version has the same file hash as the original version.

Nextcloud Server version

30

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

[juliusknorr]

We managed to reproduce this today and noticed that the file size is not properly updated in some cases. This only happens with encryption it seems, tested today on stable29

Steps to reproduce

• Create new file, open with onlyoffice (first version 790B)
• Write a first sentence
• Close file wait for it to be saved
  • See versions in db and filecache (second version ~25KB)
• Open file again and add an image to have a recognisable size difference
• Close file, wait for it to be saved
  • See versions in db and filecache (third version ~300KB)
• Restore version 2
• ✅ Download works, filecache size of the file is consistent
• Restore version 3
• ⚠️ Download results in a corrupted file, onlyoffice may break due to that, filecache size is still the one form version 2
• Alternative when restoring version 1 instead of 3 it works
  • When restoring version 3 again afterwards it breaks with the wrong size again

[juliusknorr]

Interesting, I can also reproduce with text, after restore of version 3 the size is also wrong but there I get a BadSignature exception, no such exception when downloading over webdav for the other case

{"reqId":"hbNa9TBGR8a1aw5upUoG","level":3,"time":"2025-01-10T09:31:08+00:00","remoteAddr":"192.168.21.4","user":"admin","app":"webdav","method":"GET","url":"/remote.php/webdav/a10.md","message":"Bad Signature","userAgent":"curl/8.7.1","version":"29.0.11.0","exception":{"Exception":"OCP\\Encryption\\Exceptions\\GenericEncryptionException","Message":"Bad Signature","Code":0,"Trace":[{"file":"/var/www/html/apps/encryption/lib/Crypto/Crypt.php","line":459,"function":"checkSignature","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/apps/encryption/lib/Crypto/Encryption.php","line":343,"function":"symmetricDecryptFileContent","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Files/Stream/Encryption.php","line":517,"function":"decrypt","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Files/Stream/Encryption.php","line":316,"function":"readCache","class":"OC\\Files\\Stream\\Encryption","type":"->","args":[]},{"function":"stream_read","class":"OC\\Files\\Stream\\Encryption","type":"->","args":[3575]},{"file":"/var/www/html/3rdparty/icewind/streams/src/Wrapper.php","line":55,"function":"fread","args":[null,8192]},{"file":"/var/www/html/3rdparty/icewind/streams/src/CallbackWrapper.php","line":96,"function":"stream_read","class":"Icewind\\Streams\\Wrapper","type":"->","args":[8192]},{"function":"stream_read","class":"Icewind\\Streams\\CallbackWrapper","type":"->","args":[8192]},{"file":"/var/www/html/3rdparty/sabre/http/lib/Sapi.php","line":110,"function":"stream_copy_to_stream","args":[null,null,3575]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php","line":490,"function":"sendResponse","class":"Sabre\\HTTP\\Sapi","type":"::","args":[{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/var/www/html/apps/dav/lib/Connector/Sabre/Server.php","line":61,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php","line":321,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->","args":[]},{"file":"/var/www/html/apps/dav/appinfo/v1/webdav.php","line":88,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"/var/www/html/remote.php","line":172,"args":["/var/www/html/apps/dav/appinfo/v1/webdav.php"],"function":"require_once"}],"File":"/var/www/html/apps/encryption/lib/Crypto/Crypt.php","Line":483,"Hint":"Bad Signature","message":"Bad Signature","exception":{},"CustomMessage":"Bad Signature"}}

In both cases manually fixing the version in the filecache works, so for some reason we do not restore the version properly in those cases.

cc @artonge @come-nc for versions/encryption

[juliusknorr]

It failed with an nextcloud error reading like "File version could not be restored" (was german)

This might be a case where the version retention has cleaned up versions in the mean time, the UI is not refreshing and when you click the restore button the version has been removed and therefore cannot be restored.

[come-nc]

Made me think of #49903 but stable29 was not affected by that.

[juliusknorr]

This should be resolved by #50299