504 error when adding collaborators to album (& character in the user's display name causing problems)

[mhzawadi]

Describe the bug
Sharing an album with a user throws an error

To Reproduce
Steps to reproduce the behavior:

• make new album
• add some photos
• share with a user
• get an error

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: MacOS
• Browser Opera
• Version 102.0.4880.56

Browser log

ConsoleLogger.js:59 [ERROR] photos: Failed to update properties of testing with {"collaborators":[{"id":"geoff","label":"Geoff & Claire","type":0}]}. {app: 'photos', uid: 'matt', level: 0, error: Error: Invalid response: 400
    at i (https://horwood.cloud/apps/photos/js/photos-main.js?v=b6127�~@�}
value @ ConsoleLogger.js:59
value @ ConsoleLogger.js:85
updateAlbum @ albums.js:327
await in updateAlbum (async)
(anonymous) @ vuex.esm.js:851
p.dispatch @ vuex.esm.js:516
dispatch @ vuex.esm.js:406
C.forEach.n.<computed> @ vuex.esm.js:1064
handleSetCollaborators @ AlbumContent.vue:423
click @ AlbumContent.vue:1
Mt @ vue.runtime.esm.js:3017
n @ vue.runtime.esm.js:1815
click @ index.module.js:2
Mt @ vue.runtime.esm.js:3017
n @ vue.runtime.esm.js:1815
i._wrapper @ vue.runtime.esm.js:7473

Additional context
This only happens with a single user on my system, they dont seem any different to all the other users I have. This even happens with a new album with nothing in it

[artonge]

Hey, thanks for the report. Could you check if there is some relevant entries in the server log ?

When you say that it only appens with one user, is the user the owner or the receiver of the shared album ?

What is the state of the album after the error, is it inaccessible ? I'd the collaborator list empty ?

[mhzawadi]

Hi @artonge

The user is the receiver of the album, the other way round works fine.
The album is still accessible and the list of collaborators is still empty.

The good news, is I have got an error in the logs that I couldnt find last time

{"reqId":"rxIGVgHMN8ljaBNaQiA4","level":0,"time":"2023-09-28 07:14:52","remoteAddr":"IP","user":"ME","app":"webdav","method":"PROPPATCH","url":"/remote.php/dav/photos/matt/albums/testing","message":"xmlParseEntityRef: no name\n on line 8, column 59","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 OPR/102.0.0.0","version":"27.1.1.0","exception":{"Exception":"Sabre\\DAV\\Exception\\BadRequest","Message":"xmlParseEntityRef: no name\n on line 8, column 59","Code":0,"Trace":[{"file":"//path/to/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpPropPatch","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[["Sabre\\HTTP\\Request"],["Sabre\\HTTP\\Response"]]},{"file":"//path/to/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->","args":["method:PROPPATCH",[["Sabre\\HTTP\\Request"],["Sabre\\HTTP\\Response"]]]},{"file":"//path/to/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":253,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[["Sabre\\HTTP\\Request"],["Sabre\\HTTP\\Response"]]},{"file":"//path/to/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":321,"function":"start","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"//path/to/nextcloud/apps/dav/lib/Server.php","line":365,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"//path/to/nextcloud/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\\DAV\\Server","type":"->","args":[]},{"file":"//path/to/nextcloud/remote.php","line":172,"args":["//path/to/nextcloud/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"//path/to/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","Line":369,"Previous":{"Exception":"Sabre\\Xml\\LibXMLException","Message":"xmlParseEntityRef: no name\n on line 8, column 59","Code":0,"Trace":[{"file":"//path/to/nextcloud/3rdparty/sabre/xml/lib/Service.php","line":181,"function":"parse","class":"Sabre\\Xml\\Reader","type":"->","args":[]},{"file":"//path/to/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":367,"function":"expect","class":"Sabre\\Xml\\Service","type":"->","args":[["{DAV:}propertyupdate"],"<?xml version=\"1.0\"?>\n\t\t\t\t\t\t\t<d:propertyupdate xmlns:d=\"DAV:\"\n\t\t\t\t\t\t\t\txmlns:oc=\"http://owncloud.org/ns\"\n\t\t\t\t\t\t\t\txmlns:nc=\"http://nextcloud.org/ns\"\n\t\t\t\t\t\t\t\txmlns:ocs=\"http://open-collaboration-services.org/ns\">\n\t\t\t\t\t\t\t<d:set>\n\t\t\t\t\t\t\t\t<d:prop>\n\t\t\t\t\t\t\t\t\t<nc:collaborators>[{\"id\":\"geoff\",\"label\":\"Geoff & Claire\",\"type\":0}]</nc:collaborators>\n\t\t\t\t\t\t\t\t</d:prop>\n\t\t\t\t\t\t\t</d:set>\n\t\t\t\t\t\t\t</d:propertyupdate>"]},{"file":"//path/to/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpPropPatch","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[["Sabre\\HTTP\\Request"],["Sabre\\HTTP\\Response"]]},{"file":"//path/to/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->","args":["method:PROPPATCH",[["Sabre\\HTTP\\Request"],["Sabre\\HTTP\\Response"]]]},{"file":"//path/to/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":253,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[["Sabre\\HTTP\\Request"],["Sabre\\HTTP\\Response"]]},{"file":"//path/to/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":321,"function":"start","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"//path/to/nextcloud/apps/dav/lib/Server.php","line":365,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"//path/to/nextcloud/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\\DAV\\Server","type":"->","args":[]},{"file":"//path/to/nextcloud/remote.php","line":172,"args":["//path/to/nextcloud/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"//path/to/nextcloud/3rdparty/sabre/xml/lib/Reader.php","Line":71},"message":"xmlParseEntityRef: no name\n on line 8, column 59","exception":{},"CustomMessage":"xmlParseEntityRef: no name\n on line 8, column 59"}}

[artonge]

I was able to reproduce. Looks like the & character in the user's display name is causing some issue with the XML parser. Maybe we need to encode the JSON object before sending it. Do you think you could take a look?

[mhzawadi]

can confirm @artonge that the & is killing the process, can this be looked at please?

[artonge]

This won't be prioritized, so if you can look at it, then go ahead.