Make weboffice work with OCM #10700
Assignees
Labels
Comments
kobergj
added
the
Priority:p2-high
|
Tested with: Current behaviors:1. Collabora
2. OnlyOffice
|
|
Maybe the problem is in https://github.com/cs3org/reva/blob/master/pkg/ocm/storage/received/ocm.go#L390 ? Both Collabora and OnlyOffice are trying to set a lock on the file, and the request goes through the collaboration service to the reva gateway. I'm a bit lost from that point onward, but it's clear from the logs that the I assume that, after failing to get the lock, both Collabora |
|
I was able to successfully open a file in OnlyOffice that was shared with "edit" permissions. A file that was shared with "view only" permissions, failed this way: |
|
Fixed in |
github-project-automation
bot
moved this from In progress
to Done
in Infinite Scale Team Board
github-project-automation
bot
moved this from Done
to In progress
in Infinite Scale Team Board
|
So I thought. Need to have a look on latest comment |
|
@wkloucek is that even supposed to happen? I thought OnlyOffice cannot do ViewOnly. Only Collabora can. Is that wrong? |
From what I know, OnlyOffice can also open documents without offering to edit them. At least this is what happens if you only have read permissions on an office file. |
|
As far as I know, all office apps must support read-only, although the implementation might differ. |
|
This is what I took from a recent OnlyOffice /hosting discovery endpoint: <action name="view" ext="docx" urlsrc="https://xxx/hosting/wopi/word/view?<rs=DC_LLCC&><dchat=DISABLE_CHAT&><embed=EMBEDDED&><fs=FULLSCREEN&><hid=HOST_SESSION_ID&><rec=RECORDING&><sc=SESSION_CONTEXT&><thm=THEME_ID&><ui=UI_LLCC&><wopisrc=WOPI_SOURCE&>&"/>
<action name="embedview" ext="docx" urlsrc="https://xxx/hosting/wopi/word/view?embed=1&<rs=DC_LLCC&><dchat=DISABLE_CHAT&><embed=EMBEDDED&><fs=FULLSCREEN&><hid=HOST_SESSION_ID&><rec=RECORDING&><sc=SESSION_CONTEXT&><thm=THEME_ID&><ui=UI_LLCC&><wopisrc=WOPI_SOURCE&>&"/>
<action name="mobileView" ext="docx" urlsrc="https://xxx/hosting/wopi/word/view?mobile=1&<rs=DC_LLCC&><dchat=DISABLE_CHAT&><embed=EMBEDDED&><fs=FULLSCREEN&><hid=HOST_SESSION_ID&><rec=RECORDING&><sc=SESSION_CONTEXT&><thm=THEME_ID&><ui=UI_LLCC&><wopisrc=WOPI_SOURCE&>&"/>
<action name="edit" ext="docx" default="true" requires="locks,update" urlsrc="https://xxx/hosting/wopi/word/edit?<rs=DC_LLCC&><dchat=DISABLE_CHAT&><embed=EMBEDDED&><fs=FULLSCREEN&><hid=HOST_SESSION_ID&><rec=RECORDING&><sc=SESSION_CONTEXT&><thm=THEME_ID&><ui=UI_LLCC&><wopisrc=WOPI_SOURCE&>&"/>
<action name="mobileEdit" ext="docx" requires="locks,update" urlsrc="https://xxx/hosting/wopi/word/edit?mobile=1&<rs=DC_LLCC&><dchat=DISABLE_CHAT&><embed=EMBEDDED&><fs=FULLSCREEN&><hid=HOST_SESSION_ID&><rec=RECORDING&><sc=SESSION_CONTEXT&><thm=THEME_ID&><ui=UI_LLCC&><wopisrc=WOPI_SOURCE&>&"/>
<action name="editnew" ext="docx" requires="locks,update" urlsrc="https://xxx/hosting/wopi/word/edit?<rs=DC_LLCC&><dchat=DISABLE_CHAT&><embed=EMBEDDED&><fs=FULLSCREEN&><hid=HOST_SESSION_ID&><rec=RECORDING&><sc=SESSION_CONTEXT&><thm=THEME_ID&><ui=UI_LLCC&><wopisrc=WOPI_SOURCE&>&"/>
It clearly advertises
Yeah, OnlyOffice might not support that ultra safe zero trust view mode... |
|
@jvillafanez Can it be a malformed access token? {
"header": {
"alg": "HS256",
"typ": "JWT"
},
"payload": {
"iss": "ocis.ocm.owncloud.test",
"aud": [
"reva"
],
"exp": 1737813854,
"iat": 1737727454,
"user": {
"id": {
"idp": "ocis.ocm.owncloud.test",
"opaque_id": "MDRmOWZiYTEtNDlkZC00OWU2LTgwNDItMmZhYTkwYjYwYjZkQGh0dHBzOi8vb2Npcy5vY20ub3duY2xvdWQudGVzdA==",
"type": 6
},
"display_name": "View Only user for admin"
},
"scope": {
"resourceinfo:storage_id:\"89f37a33-858b-45fa-8890-a1f2b27d90e1\" opaque_id:\"L29jaXMub2R0\" space_id:\"3ef0f16b-87a6-4c6b-a0fd-71f748743edf\"": {
"resource": {
"decoder": "json",
"value": "eyJpZCI6eyJzdG9yYWdlSWQiOiI4OWYzN2EzMy04NThiLTQ1ZmEtODg5MC1hMWYyYjI3ZDkwZTEiLCAib3BhcXVlSWQiOiJMMjlqYVhNdWIyUjAiLCAic3BhY2VJZCI6IjNlZjBmMTZiLTg3YTYtNGM2Yi1hMGZkLTcxZjc0ODc0M2VkZiJ9LCAicGF0aCI6Im9jaXMub2R0In0="
},
"role": 3
}
}
},
"signature": "zb0ZHM-ZSZMNBf--haV4JNoBmMDU1TwnlgxQpgu6B70"
}When the document opened in a r/w the access token is: {
"header": {
"alg": "HS256",
"typ": "JWT"
},
"payload": {
"iss": "https://ocis.owncloud.test",
"aud": [
"reva"
],
"exp": 1737813853,
"iat": 1737727453,
"user": {
"id": {
"idp": "https://ocis.owncloud.test",
"opaque_id": "4c34b266-1dc3-4ee8-956b-edb89d312728",
"type": 1
},
"username": "admin",
"mail": "[email protected]",
"display_name": "Admin",
"uid_number": 99,
"gid_number": 99
},
"scope": {
"user": {
"resource": {
"decoder": "json",
"value": "eyJwYXRoIjoiLyJ9"
},
"role": 1
}
}
},
"signature": "3Ch-SUA6R9JMIjzipid4onBA88fl1oTxEG8Up7KyoHg"
}The error a collaboration: ocis |
I don't think so. That's the decoded view-only token for a local account. |
|
ViewOnly token seems to be the issue. Without it everything works fine. We need to find out why we need it and why it doesn't work for ocm. |
|
If I understand correct, the ViewOnly token has been added as a part of the
|
|
Ah. Maybe we have a misunderstanding here? |
|
@jvillafanez could you have a look at cs3org/reva#5055? Imo the check if there should be a SecureView token is wrong, but maybe I'm misunderstanding something? |
|
As far as I understand the change, does it mean that if the user has permission to download the file, that user won't be able to request secure view? Kind of side question: should the view-only token contain just a change in the user's scope or permission? I expect the user in the access token and the view-only token to be the same, but I'm not sure if this is the case. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When getting a federated share I need to able to edit it in the weboffice.
This ticket is to find out if there is an issue with this and if yes fix it.
Working collaboratively on one file is not in scope of this ticket.
Current behaviour: File is opened in read-only mode.
The text was updated successfully, but these errors were encountered: