Trying to access array offset on value of type bool at apps/files_external/lib/Lib/Storage/SFTP.php #41159

harrykipper · 2024-01-12T20:31:06Z

When uploading, modifying or deleting a file in the SFTP external storage the log is spammed with the message below. This doesn't seem to have user facing consequences, but in a very large installation the logs become huge. The first two errors appear both when using the web interface and a desktop client, the third related to RSAStore.php only seems to be triggered by desktop apps.

We recently updated from 10.3.2 to 10.13.4, and PHP went from 7.2 to 7.4. The issue didn't seem to exist with the old version.

"remoteAddr":"XXX","user":"testuser","app":"PHP","method":"PUT","url":"/remote.php/dav/files/testuser/SFTP/New%20folder/testfile.jpg","message":"Trying to access array offset on value of type bool at /owncloud/webapp/owncloud-10.13.4/apps/files_external/lib/Lib/Storage/SFTP.php#325"

"remoteAddr":"XXX","user":"testuser","app":"PHP","method":"PUT","url":"/remote.php/dav/files/testuser/SFTP/New%20folder/testfile.jpg","message":"Trying to access array offset on value of type bool at /owncloud/webapp/owncloud-10.13.4/apps/files_external/lib/Lib/Storage/SFTP.php#331"

"app":"PHP","method":"PROPFIND","url":"/remote.php/dav/files/testuser/","message":"Trying to access array offset on value of type null at /owncloud/webapp/owncloud-10.13.4/apps/files_external/lib/Lib/RSAStore.php#107"

The nextcloud people seem to have solved this by adding a couple of checks to the filetype() function in SFTP.php. I tried it and it seems to work for me, the error is gone. Here’s what they do:

public function filetype($path) {
              try {
                      $stat = $this->getConnection()->stat($this->absPath($path));
                      if (!is_array($stat) || !array_key_exists('type', $stat)) {
                              return false;
                      }
                      if ((int) $stat['type'] === NET_SFTP_TYPE_REGULAR) {
                              return 'file';
                      }
                      if ((int) $stat['type'] === NET_SFTP_TYPE_DIRECTORY) {
                              return 'dir';
                      }
              } catch (\Exception $e) {
              }
              return false;
      }

Steps to reproduce

Set up SFTP storage with the files_external app
Upload some files into the SFTP directory, either via the web interface or a desktop app
The operation completes but the log is spammed with the error

Expected behaviour

No error should be logged

Actual behaviour

The log is spammed with the error above:

Server configuration

Operating system:
Rocky Linux 8.8

Web server:
Apache 2.4.37

Database:
Mysql 10.11.6

PHP version:
7.4

ownCloud version: (see ownCloud admin page)
10.13.4.1

Updated from an older ownCloud or fresh install:
Updated from 10.3.2

Where did you install ownCloud from:
Installed manually using the minimal server package from website

Signing status (ownCloud 9.0 and above):

Login as admin user into your ownCloud and access 

paste the results into https://gist.github and puth the link here.

No errors have been found.

The content of config/config.php:

'instanceid' => 'xxx',
'passwordsalt' => 'xxx',
'secret' => 'xxx',
'trusted_domains' =>
array (
0 => 'ourdomain',
),
'datadirectory' => '/owncloud/data-production',
'overwrite.cli.url' => 'ourdomain',
'dbtype' => 'mysql',
'version' => '10.13.4.1',
'dbname' => 'cloud_dev',
'dbhost' => 'xxxx',
'dbtableprefix' => 'oc_',
'dbuser' => 'user',
'dbpassword' => 'passwd',
'installed' => true,
'mail_smtpmode' => 'smtp',
'mail_from_address' => 'NOREPLY',
'mail_domain' => 'ourdomain',
'mail_smtphost' => 'internalmailrelay.ourdomain',
'mail_smtpport' => '25',
'forcessl' => true,
'ldapIgnoreNamingRules' => false,
'loglevel' => 3,
'logtimezone' => 'UTC',
'knowledgebaseenabled' => false,
'maintenance' => false,
'filelocking.enabled' => true,
'memcache.distributed' => '\OC\Memcache\Redis',
'memcache.local' => '\OC\Memcache\Redis',
'memcache.locking' => '\OC\Memcache\Redis',
'redis' =>
array (
'host' => '/var/run/redis/redis.sock',
'port' => 0,
),
'trashbin_retention_obligation' => 'auto',
'integrity.ignore.missing.app.signature' =>
array (
0 => 'theme-ours',
),
'allow_user_to_change_mail_address' => ''

Log in to the web-UI with an administrator account and click on
'admin' -> 'Generate Config Report' -> 'Download ownCloud config report'
This report includes the config.php settings, the list of activated apps
and other details in a well sanitized form.

or 

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your ownCloud installation folder

*ATTENTION:* Do not post your config.php file in public as is. Please use one of the above
methods whenever possible. Both, the generated reports from the web-ui and from occ config:list
consistently remove sensitive data. You still may want to review the report before sending.
If done manually then it is critical for your own privacy to dilligently
remove *all* host names, passwords, usernames, salts and other credentials before posting.
You should assume that attackers find such information and will use them against your systems.

List of activated apps:

activity:
- Version: 2.7.2
- Path: /owncloud/webapp/owncloud-10.13.4/apps/activity
- comments:
  - Version: 0.3.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/comments
- configreport:
  - Version: 0.2.2
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/configreport
- dav:
  - Version: 0.7.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/dav
- federatedfilesharing:
  - Version: 0.5.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/federatedfilesharing
- federation:
  - Version: 0.1.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/federation
- files:
  - Version: 1.6.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/files
- files_external:
  - Version: 0.9.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/files_external
- files_mediaviewer:
  - Version: 1.0.5
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/files_mediaviewer
- files_sharing:
  - Version: 0.14.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/files_sharing
- files_texteditor:
  - Version: 2.6.1
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/files_texteditor
- files_trashbin:
  - Version: 0.9.1
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/files_trashbin
- files_versions:
  - Version: 1.3.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/files_versions
- firstrunwizard:
  - Version: 1.3.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/firstrunwizard
- market:
  - Version: 0.8.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/market
- notifications:
  - Version: 0.6.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/notifications
- provisioning_api:
  - Version: 0.5.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/provisioning_api
- systemtags:
  - Version: 0.3.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/systemtags
- theme-ours:
  - Version: 1.0.3
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/theme-uoe
- user_ldap:
  - Version: 0.18.0
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/user_ldap
    Disabled:
- encryption:
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/encryption
- external:
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/external
- updatenotification:
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/updatenotification
- user_external:
  - Path: /owncloud/webapp/owncloud-10.13.4/apps/user_external

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your ownCloud installation folder.

Are you using external storage, if yes which one: local/smb/sftp/...
SFTP

Are you using encryption: yes/no
NO

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
LDAP

LDAP configuration (delete this part if not used)

With access to your command line run e.g.:
sudo -u www-data php occ ldap:show-config
from within your ownCloud installation folder

Without access to your command line download the data/owncloud.db to your local
computer or access your SQL server remotely and run the select query:
SELECT * FROM `oc_appconfig` WHERE `appid` = 'user_ldap';


Eventually replace sensitive data as the name/IP-address of your LDAP server or groups.

Client configuration

Browser:

Operating system:

Logs

Web server error log

Insert your webserver log here

ownCloud log (data/owncloud.log)

Insert your ownCloud log here

Browser log

Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log 
c) ...

The text was updated successfully, but these errors were encountered:

DeepDiver1975 · 2024-04-26T08:02:54Z

feel free to open a pull request. THX

Fixes owncloud#41159

harrykipper added a commit to harrykipper/owncloud_core that referenced this issue Apr 26, 2024

Add checks to SFTP.php

7017de4

Fixes owncloud#41159

harrykipper linked a pull request Apr 26, 2024 that will close this issue

Add type checks to SFTP.php #41240

Open

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Trying to access array offset on value of type bool at apps/files_external/lib/Lib/Storage/SFTP.php #41159

Trying to access array offset on value of type bool at apps/files_external/lib/Lib/Storage/SFTP.php #41159

harrykipper commented Jan 12, 2024 •

edited

DeepDiver1975 commented Apr 26, 2024

Trying to access array offset on value of type bool at apps/files_external/lib/Lib/Storage/SFTP.php #41159

Trying to access array offset on value of type bool at apps/files_external/lib/Lib/Storage/SFTP.php #41159

Comments

harrykipper commented Jan 12, 2024 • edited

Steps to reproduce

Expected behaviour

Actual behaviour

Server configuration

LDAP configuration (delete this part if not used)

Client configuration

Logs

Web server error log

ownCloud log (data/owncloud.log)

Browser log

DeepDiver1975 commented Apr 26, 2024

harrykipper commented Jan 12, 2024 •

edited