OCP AutoloadNotAllowedException

[ThisIsQasim]

Steps to reproduce

1. Upgrade user_external app from admin panel
2. Run the updater in web UI
3. Server breaks down

Expected behaviour

Everything should keep working

Actual behaviour

Can't login or use occ command

Affected Authentication backend

Using IMAP backend

Server configuration

Operating system:
Docker debian

Web server:
apache
Database:
MySQL
PHP version:
7.1
Nextcloud version: (see Nextcloud admin page)
15
Updated from an older Nextcloud/ownCloud or fresh install:
update
Where did you install Nextcloud from:
Docker hub

Logs

Nextcloud log (data/nextcloud.log)

Nextcloud log

An unhandled exception has been thrown:
OCP\AutoloadNotAllowedException: Autoload path not allowed: /var/www/html/apps/user_external/lib/imap.php in /var/www/html/lib/autoloader.php:137
Stack trace:
#0 /var/www/html/lib/autoloader.php(162): OC\Autoloader->isValidPath('/var/www/html/a...')
#1 [internal function]: OC\Autoloader->load('OC_User_IMAP')
#2 [internal function]: spl_autoload_call('OC_User_IMAP')
#3 /var/www/html/lib/private/legacy/user.php(138): class_exists('OC_User_IMAP')
#4 /var/www/html/lib/base.php(721): OC_User::setupBackends()
#5 /var/www/html/lib/base.php(1068): OC::init()
#6 /var/www/html/console.php(46): require_once('/var/www/html/l...')
#7 /var/www/html/occ(11): require_once('/var/www/html/c...')
#8 {main}[

[ThisIsQasim]

It starts working if I disable the OC\Autoloader->isValidPath check in lib/autoload.php

[virtualroot]

Same over here, I changed isValidPath to return true and authentication starts working again.

        return true; // throw new AutoloadNotAllowedException($fullPath);

Nextcloud log (data/nextcloud.log)

Nextcloud log

{"reqId":"wqAxKZ1gzmbhMEuONpAy","level":3,"time":"2019-01-08T18:26:00+00:00","remoteAddr":"91.64.-.-","user":"--","app":"index","method":"GET","url":"\/","message":{"Exception":"OCP\\AutoloadNotAllowedException","Message":"Autoload path not allowed: \/var\/www\/html\/apps\/user_external\/lib\/imap.php","Code":0,"Trace":[{"file":"\/var\/www\/html\/lib\/autoloader.php","line":162,"function":"isValidPath","class":"OC\\Autoloader","type":"->","args":["\/var\/www\/html\/apps\/user_external\/lib\/imap.php"]},{"function":"load","class":"OC\\Autoloader","type":"->","args":["OC_User_IMAP"]},{"function":"spl_autoload_call","args":["OC_User_IMAP"]},{"file":"\/var\/www\/html\/lib\/private\/legacy\/user.php","line":138,"function":"class_exists","args":["OC_User_IMAP"]},{"file":"\/var\/www\/html\/lib\/base.php","line":721,"function":"setupBackends","class":"OC_User","type":"::","args":[]},{"file":"\/var\/www\/html\/lib\/base.php","line":1068,"function":"init","class":"OC","type":"::","args":[]},{"file":"\/var\/www\/html\/index.php","line":40,"args":["\/var\/www\/html\/lib\/base.php"],"function":"require_once"}],"File":"\/var\/www\/html\/lib\/autoloader.php","Line":137,"CustomMessage":"--"},"userAgent":"Mozilla\/5.0 (X11; Linux x86_64; rv:64.0) Gecko\/20100101 Firefox\/64.0","version":"15.0.0.10"}

[violoncelloCH]

thank you for reporting!
strange, looks like what happened to me here: nextcloud/server#12506 (comment)
strange, that it happened for you with the regular update.
Can you check apps/user_external/appinfo/info.xml for max-version=? @ThisIsQasim @virtualroot
@virtualroot are you also running it in docker?

[virtualroot]

👋 @violoncelloCH

apps/user_external/appinfo/info.xml, Where I changed max-version following #4 to fix 0.4.0 on Nextcloud 15.

        <dependencies>
                <nextcloud min-version="13" max-version="15" />
        </dependencies>
        <version>0.4</version>

I notice I have an user_external folder in custom_apps and custom_apps/user_external/appinfo/info.xml says different.

        <dependencies>
                <nextcloud min-version="15" max-version="15" />
        </dependencies>
        <version>0.5.0</version>

@virtualroot are you also running it in docker?

Yes, I have the same setup described by @ThisIsQasim in #32 (comment)

[violoncelloCH]

@virtualroot hmm, looks like your manually overwritten apps/user_external/appinfo/info.xml leads to the problem (I fixed this with nextcloud/server#12506 (comment) but that's probably not possible in a docker container; you could probably just remove the old version in apps/ as you have the new one in custom_apps/) and the version from apps/ also "overwrites" or conflicts with the one in custom_apps/.

Normally the update from the appstore simply overwrites the version installed before and all would be fine, the problem comes with the custom_apps folder which seems to be standard in docker.

[ThisIsQasim]

@violoncelloCH The Docker container comes bundled with version 0.4.0 in apps/user_external folder which generates the mentioned error. Things start working once you remove apps/user_external folder. I have checked and it looks like the tarball provided by NextCloud is bundling the user_external app.

[ThisIsQasim]

For now, I have fixed it by using my own Dockerfile

FROM nextcloud:latest
RUN rm -rf /var/www/html/apps/user_external

[violoncelloCH]

Yes, 15.0.0 comes bundled with 0.4 which is not compatible with 15 (what happened by accident). This is why we unbundle it, 15.0.1 won't ship user_external anymore.
I created nextcloud/docker#598 to make sure docker version 15.0.1 will explicitly remove user_external v0.4 from apps/.
So this issue should be fixed with 15.0.1...

[violoncelloCH]

@ThisIsQasim @virtualroot Can you test if an update to 15.0.1 correctly removes user_external from apps/? (as soon as 15.0.1 is also available for docker)

[ThisIsQasim]

@violoncelloCH I'll report back once 15.0.1 is released for docker

[violoncelloCH]

thank you! @ThisIsQasim
wait for 15.0.2, 15.0.1 still included user_external by accident...
15.0.2 was released today...

[ThisIsQasim]

I just upgraded to 15.0.2 and I can confirm that the user_external is no longer bundled. Thank you for taking prompt action.

[violoncelloCH]

Thank you for reporting back!

[virtualroot]

Upgrade works as expected, thanks @violoncelloCH for your help!