[Bug]: Logs filled with A non-numeric value encountered at /var/www/html/apps/dav/lib/Files/FileSearchBackend.php#485

[jgielstra]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Seems like the next cloud mac client is sending some "Invalid" webdav query paramters.

The server is throwing an error rather than handling the bad data gracefully.. The castValue() function
https://github.com/nextcloud/server/blob/master/apps/dav/lib/Files/FileSearchBackend.php#L484C1-L485C23

Should perhaps test is_numeric() rather than just 0+$val

Steps to reproduce

Expected behavior

Assuming this is coming from Next cloud MAcOS client
[PHP] Warning: A non-numeric value encountered at /var/www/html/apps/dav/lib/Files/FileSearchBackend.php#485
SEARCH /remote.php/dav/
from 172.56.90.125 by jgielstra at Sep 30, 2025, 4:07:16 PM

Looking in the code https://github.com/nextcloud/server/blob/6fc190ef4c266bf9a54cff316382f21b2ab75e55/apps/dav/lib/Files/FileSearchBackend.php#L484C1-L485C23

Should we check that it is numeric is_numeric().. Be happy to submit a PR if wanted

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "skylab.lan",
            "cloud.chromis.ddns.net"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "default_phone_region": "us",
        "dbtype": "mysql",
        "version": "32.0.0.13",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "app_install_overwrite": [],
        "loglevel": 2,
        "maintenance": false,
        "theme": "",
        "allow_local_remote_servers": true,
        "overwrite.cli.url": "https:\/\/cloud.chromis.ddns.net",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwritehost": "cloud.chromis.ddns.net",
        "overwriteprotocol": "https",
        "overwritewebroot": "\/",
        "overwritecondaddr": "^172\\.23\\.0\\.\\d+`$",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "admin"
        ],
        "twofactor_enforced_excluded_groups": [],
        "maintenance_window_start": 1,
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\Krita"
        ],
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_smtpport": "587",
        "mail_smtpauth": 1,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***"
    }
}
{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "skylab.lan",
            "cloud.chromis.ddns.net"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "default_phone_region": "us",
        "dbtype": "mysql",
        "version": "32.0.0.13",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "app_install_overwrite": [],
        "loglevel": 2,
        "maintenance": false,
        "theme": "",
        "allow_local_remote_servers": true,
        "overwrite.cli.url": "https:\/\/cloud.chromis.ddns.net",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwritehost": "cloud.chromis.ddns.net",
        "overwriteprotocol": "https",
        "overwritewebroot": "\/",
        "overwritecondaddr": "^172\\.23\\.0\\.\\d+`$",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "admin"
        ],
        "twofactor_enforced_excluded_groups": [],
        "maintenance_window_start": 1,
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\Krita"
        ],
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_smtpport": "587",
        "mail_smtpauth": 1,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***"
    }
}

List of activated Apps

Enabled:
  - activity: 5.0.0-dev.0
  - admin_audit: 1.22.0
  - analytics: 6.0.1
  - assistant: 2.9.0
  - bruteforcesettings: 5.0.0-dev.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contacts: 8.0.4
  - contactsinteraction: 1.13.1
  - dashboard: 7.12.0
  - dav: 1.34.2
  - deck: 1.16.0
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.0
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0-dev.0
  - integration_openai: 3.7.1
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - mail: 5.5.10
  - nextcloud_announcements: 4.0.0-dev.0
  - notes: 4.12.3
  - notifications: 5.0.0-dev.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0-dev.0
  - related_resources: 3.0.0-dev.0
  - richdocumentscode: 25.4.504
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - support: 4.0.0-dev.0
  - survey_client: 4.0.0-dev.0
  - suspicious_login: 10.0.0-dev.0
  - systemtags: 1.22.0
  - text: 6.0.0-dev.0
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - twofactor_totp: 14.0.0
  - updatenotification: 1.22.0
  - viewer: 5.0.0-dev.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - app_api: 32.0.0 (installed 2.4.0)
  - circles: 32.0.0 (installed 29.0.0-dev)
  - encryption: 2.20.0 (installed 2.16.0)
  - files_external: 1.24.0
  - richdocuments: 9.0.1 (installed 9.0.1)
  - spreed: 22.0.0 (installed 22.0.0)
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - user_ldap: 1.23.0
  - user_status: 1.12.0 (installed 1.9.0)
  - weather_status: 1.12.0 (installed 1.9.0)
Enabled:
  - activity: 5.0.0-dev.0
  - admin_audit: 1.22.0
  - analytics: 6.0.1
  - assistant: 2.9.0
  - bruteforcesettings: 5.0.0-dev.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contacts: 8.0.4
  - contactsinteraction: 1.13.1
  - dashboard: 7.12.0
  - dav: 1.34.2
  - deck: 1.16.0
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.0
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0-dev.0
  - integration_openai: 3.7.1
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - mail: 5.5.10
  - nextcloud_announcements: 4.0.0-dev.0
  - notes: 4.12.3
  - notifications: 5.0.0-dev.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0-dev.0
  - related_resources: 3.0.0-dev.0
  - richdocumentscode: 25.4.504
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - support: 4.0.0-dev.0
  - survey_client: 4.0.0-dev.0
  - suspicious_login: 10.0.0-dev.0
  - systemtags: 1.22.0
  - text: 6.0.0-dev.0
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - twofactor_totp: 14.0.0
  - updatenotification: 1.22.0
  - viewer: 5.0.0-dev.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - app_api: 32.0.0 (installed 2.4.0)
  - circles: 32.0.0 (installed 29.0.0-dev)
  - encryption: 2.20.0 (installed 2.16.0)
  - files_external: 1.24.0
  - richdocuments: 9.0.1 (installed 9.0.1)
  - spreed: 22.0.0 (installed 22.0.0)
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - user_ldap: 1.23.0
  - user_status: 1.12.0 (installed 1.9.0)
  - weather_status: 1.12.0 (installed 1.9.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{
  "reqId": "kC4EkTn9e6tjbofmJLgk",
  "level": 2,
  "time": "2025-09-30T21:07:16+00:00",
  "remoteAddr": "172.56.90.125",
  "user": "jgielstra",
  "app": "PHP",
  "method": "SEARCH",
  "url": "/remote.php/dav/",
  "message": "A non-numeric value encountered at /var/www/html/apps/dav/lib/Files/FileSearchBackend.php#485",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36",
  "version": "32.0.0.13",
  "data": {
    "app": "PHP"
  },
  "id": "68f0fc1dc5516"
}

Additional info

No response

[namob]

I have the same warning logs since I updated to 32

{
  "reqId": "aWNpkvokB7j1NNRliuNt",
  "level": 2,
  "time": "2025-10-16T15:06:19+00:00",
  "remoteAddr": "10.0.12.63",
  "user": "user",
  "app": "PHP",
  "method": "SEARCH",
  "url": "/remote.php/dav/",
  "message": "A non-numeric value encountered at /config/www/nextcloud/apps/dav/lib/Files/FileSearchBackend.php#485",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0",
  "version": "32.0.0.13",
  "data": {
    "app": "PHP"
  },
  "id": "68f10dbdcc728"
}

[joshtrichards]

Should we check that it is numeric is_numeric().. Be happy to submit a PR if wanted

Agreed. Please do so. Thanks!

This problem may have popped up for you all recently as a result of #51592 (though it's not the underlying cause).

Cc: @susnux

[susnux]

I think this is the correct behavior, no?
Because we case the string value to number here, and if this exception is thrown then the client was sending an invalid value and we throw the correct exception.

Also this is only logged as information level, for production we recommend using warning as the default level.

[gpediesel]

I have the same log filled with : A non-numeric value encountered at /var/www/nextcloud/apps/dav/lib/Files/FileSearchBackend.php#485

I confirm that is a Mac user that cause this and after a while my Proxmox VE become offline completly (need to reboot or unplug replug to get back online)

[NordicRacoon]

same error here on my linux ubuntu portainer stack aio installation

[gpediesel]

The thing that could maybe be related if others can confirm, this started when a user uploaded a few .heic files.

[naelfe]

Same here.
{"reqId":"...","level":2,"time":"2025-10-25T10:35:51+00:00","remoteAddr":"...","user":"...","app":"PHP","method":"SEARCH","url":"/remote.php/dav/","message":"A non-numeric value encountered at /config/www/nextcloud/apps/dav/lib/Files/FileSearchBackend.php#485","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0","version":"32.0.1.2","data":{"app":"PHP"}}

640x in 30minutes. Running NC 32.0.1.2 as docker with PG 17.6 (docker as well).
Upgraded from the latest 31 patch yesterday.