Skip to content

Comparing document versions hangs forever ("Cannot read properties of undefined (reading 'split')" in Viewer.vue, CSP blocks Collabora inline script) #5881

Description

@ehora

Environment

  • Nextcloud: 34.0.1
  • richdocuments (Nextcloud Office): 11.0.1
  • Collabora Online (Docker collabora/code): 26.04.2.1.1
  • Deployment: Docker Compose, Nextcloud + Collabora behind a reverse proxy (Traefik) doing TLS termination, wopi_url/server_name both set to the public HTTPS hostname (not the internal Docker network address)
  • Browser tested: Chrome 150 and Firefox (both reproduce)
  • Comparison: the identical action works correctly against an unrelated Nextcloud 31.0.6 Enterprise instance (different provider, also using Collabora) — normal document open/edit/save works fine on both instances, only version comparison is affected on 34.0.1

Steps to reproduce

  1. Open any Office document (tested with a plain .docx) that has at least two saved versions.
  2. Files app → file → Details → Versions tab.
  3. Click the "⋮" menu on an older version → "Compare to current version".

Expected

A read-only, side-by-side comparison view of the two versions opens in the Viewer.

Actual

The loading spinner never resolves. Network log shows the entire WOPI handshake (token request → CheckFileInfo → GetFile → settings) repeating in full roughly every ~30 seconds — the client appears to retry the whole sequence indefinitely rather than displaying an error.

Browser console output

Viewer.vue:718 Uncaught (in promise) TypeError: Cannot read properties of undefined (reading 'split')
    at o.openFileInfo (Viewer.vue:718:1)
    at o.fileInfo (Viewer.vue:462:1)
    ...
open @ Viewer.js:322
compare @ Viewer.js:364
compareVersion @ FilesVersionsSidebarTab.vue:274
...
compareVersion @ VersionEntry.vue:309

Immediately before this, the embedded Collabora frame logs a CSP violation:

Executing inline script violates the following Content Security Policy directive
'script-src 'self' 'unsafe-eval''. Either the 'unsafe-inline' keyword, a hash
('sha256-XOKVOFK7V9e6jZNxqxXAysnMDxOlDWPKzWhBg2PT2Os='), or a nonce ('nonce-...')
is required to enable inline execution. The action has been blocked.

(URL: https://<host>/browser/<build>/cool.html?WOPISrc=...&lang=de&closebutton=1&revisionhistory=1&permission=readonly)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions