Request Method: MKCOL - 405 Method not allowed

[alinmear]

Steps to reproduce

1. Drag'n'Drop Folder with multiple Subfolders and Files for Upload

Expected behaviour

The Folder gets uploaded without problems.

Actual behaviour

After a short period of time the client hangs, consuming alot of cpu and cycling

Server configuration

Operating system: Red Hat Enterprise Linux Server 7.7 (Maipo)

Web server: Apache/2.4.41 (IUS)

Database: mysql Ver 15.1 Distrib 10.1.41-MariaDB, for Linux (x86_64) using readline 5.1

PHP version: PHP 7.2.21

Nextcloud version: 16.0.4

Updated from an older Nextcloud/ownCloud or fresh install: fresh install

Where did you install Nextcloud from: https://github.com/nextcloud/server/archive/16.0.4.zip

Signing status:

Signing status

``` No errors have been found. ```

List of activated apps:

App list

``` Enabled: - activity: 2.9.1 - admin_audit: 1.6.0 - cloud_federation_api: 0.2.0 - comments: 1.6.0 - dav: 1.9.2 - federatedfilesharing: 1.6.0 - files: 1.11.0 - files_pdfviewer: 1.5.0 - files_retention: 1.5.1 - files_rightclick: 0.13.0 - files_sharing: 1.8.0 - files_trackdownloads: 1.5.0 - files_trashbin: 1.6.0 - files_versions: 1.9.0 - groupfolders: 4.0.5 - jsloader: 1.0.2 - logreader: 2.1.0 - lookup_server_connector: 1.4.0 - notifications: 2.4.1 - oauth2: 1.4.2 - password_policy: 1.6.0 - privacy: 1.0.0 - provisioning_api: 1.6.0 - recommendations: 0.4.0 - serverinfo: 1.6.0 - sharebymail: 1.6.0 - systemtags: 1.6.0 - theming: 1.7.0 - theming_customcss: 1.3.0 - twofactor_backupcodes: 1.5.0 - user_ldap: 1.6.0 - user_saml: 2.3.1 - workflowengine: 1.6.0 Disabled: - accessibility - encryption - federation - files_external - files_texteditor - files_videoplayer - firstrunwizard - gallery - nextcloud_announcements - support - survey_client - updatenotification - viewer ```

Nextcloud configuration:

Config report

``` { "system": { "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "localhost", "nc.mydomain.int.local", "nc.mydomain.com" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "16.0.3.0", "overwrite.cli.url": "http:\/\/localhost", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "mysql.utf8mb4": true, "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "instanceid": "***REMOVED SENSITIVE VALUE***", "proxy": "http:\/\/proxy.mydomain.com:8080", "maintenance": false, "ldapIgnoreNamingRules": false, "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory", "log_type": "syslog", "logfile=": "", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": "6379" }, "memcache.locking": "\\OC\\Memcache\\Redis", "memcache.local": "\\OC\\Memcache\\Redis", "filelocking.enabled": false, "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_domain": "***REMOVED SENSITIVE VALUE***", "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "default_language": "de", "default_locale": "de_DE", "knowledgebaseenabled": false, "check_data_directory_permissions": false, "trashbin_retention_obligation": "5,5" } } ```

Are you using external storage, if yes which one: nfs

Are you using encryption: no

Are you using an external user-backend, if yes which one: LDAP

LDAP configuration (delete this part if not used)

Details

``` ```

Client configuration

Browser: Chrome Version 76.0.3809.100 (Offizieller Build) (32-Bit), FF 68.0.1esr (32-Bit)

Operating system: Win10

Logs

Web server error log

Web server error log

Insert your webserver log here

Nextcloud log (data/nextcloud.log)

Nextcloud log

Browser log

Browser log

NonUnicode	Normal	Main.js	libs	Regular	getstoragestats.php	reveal.js	Regular	Regular	3.7.0	vscode-reveal	Main.js	getstoragestats.php?dir=%2F	plugin	Main.js	libs	Main.js	math	reveal.js	jax	3.7.0	output	plugin	HTML-CSS	math	fonts	jax	Neo-Euler	getstoragestats.php?dir=%2F	
Request URL: https://nc.mydomain.com/remote.php/dav/files/userid/vscode-reveal/libs/reveal.js/3.7.0/plugin/math
Request Method: MKCOL
Status Code: 405 Method Not Allowed
Remote Address: 194.8.61.81:443
Referrer Policy: no-referrer
Allow: OPTIONS, GET, HEAD, DELETE, PROPFIND, PUT, PROPPATCH, COPY, MOVE, REPORT
Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Length: 247
Content-Security-Policy: default-src 'none';
Content-Type: application/xml; charset=utf-8
Date: Tue, 23 Jul 2019 05:56:31 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=15
Pragma: no-cache
Referrer-Policy: no-referrer
Server: Apache/2.4.39
Strict-Transport-Security: max-age=31536000
Strict-Transport-Security: max-age=31536000
Vary: Cookie
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Robots-Tag: none
X-XSS-Protection: 1; mode=block
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Cookie: __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; ocqmladiy7z7=66jkutsoltm7a65ure008sc6p9; oc_sessionPassphrase=Cso2XqYDuLD5btD4jS%2BDbwqNAfeJdOXJIj4d4XaQwZbRvRDM4VxOOwSdvAZZ1hbdQMymCn0UOTucxbAXtk9jVeiuzEOukvKwXJTLIn%2Fv2JnaVwUWMCSFGapoKTM2sZyM
Host: nc.mydomain.com
Origin: https://nc.mydomain.com
requesttoken: gzjzHXJ4lsZmO5tgH1NczyDYpEFCI0EU6R/tX5XLL+g=:y0mRKBdIp6FNfsI2eRZkrmv31zg3WzFFnjSZbaGSFoE=
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
X-Requested-With: XMLHttpRequest

[kesselb]

Anything in the nextcloud log?

[alinmear]

@kesselb nothing relevant and no errors. Behaviour can be reproduced on another instance too. I downloaded the vscode reveal plugin from https://github.com/evilz/vscode-reveal/archive/Version-3.4.0.zip; unzipped it and uploaded it via drag'n'drop.

[solracsf]

Experiencing same here, nothing on Nextcloud logs but on Nginx logs:

176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite/oakes-grotesk-semi-bold HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite/oakes-grotesk-semi-bold/webfonts HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite/oakes-grotesk-semi-bold-italic HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite/oakes-grotesk-semi-bold-italic HTTP/1.1" 405 
176.177.xxx.xxx - -  "MKCOL /remote.php/dav/files/user/TEST%202/folder/oakes-grotesk-complete-family-webfont-lite/oakes-grotesk-semi-bold-italic/webfonts HTTP/1.1" 405 

[simonspa]

Same issue here. I also observe a hanging of the client, a very high CPU load on the server, and ultimately a failed upload. This only happens with very specific files (or file types? Some XML files seem problematic) but for both web interface and Android client alike.

The request looks like this:

MKCOL /remote.php/dav/uploads/<user>/e4567724630610c8db3f14f9063d752d HTTP/1.1
Authorization: Basic <hash>
Host: cloud.domain.tld
User-Agent: Mozilla/5.0 (Android) Nextcloud-android/3.9.2
Cookie: oc0e7rzi20xo=<cookie>;oc_sessionPassphrase=<passphrase>; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; oc0e7rzi20xo=<cookie>
Content-Length: 0

The response from Nextcloud is:

HTTP/1.1 405
Content-Security-Policy: default-src 'none';
Expires: Thu, 19 Nov 1981 08:52:00 GMT
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Allow: OPTIONS, GET, HEAD, DELETE, PROPFIND, PUT, PROPPATCH, COPY, MOVE, REPORT
Connection: keep-alive
Content-Type: application/xml; charset=utf-8
Date: Tue, 24 Dec 2019 16:33:33 GMT
Server: nginx
X-Frame-Options: SAMEORIGIN

Somehow MKCOL is not among the allows methods reported by the server here?

[simonspa]

Here are my installation details (17.0.2):

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.domain.tld"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "data-fingerprint": "58897020af7835d5d5eebe9f70033c28",
        "dbtype": "mysql",
        "version": "17.0.2.1",
        "overwrite.cli.url": "https:\/\/cloud.domain.tld",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "3306",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "htaccess.RewriteBase": "\/",
        "mail_smtpsecure": "ssl",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "logtimezone": "Europe\/Berlin",
        "log_rotate_size": "104857600",
        "mail_smtpauthtype": "LOGIN",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0
        },
        "memcache.local": "\\OC\\Memcache\\APCu",
        "maintenance": false,
        "preview_max_y": 2048,
        "preview_max_x": 2048,
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "mail_smtpauth": 1,
        "simpleSignUpLink.shown": false,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "knowledgebaseenabled": false,
        "loglevel": 2,
        "filelocking.enabled": "true",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "updater.release.channel": "stable",
        "activity_expire_days": 90,
        "mail_smtpmode": "smtp",
        "theme": ""
    }
}

[kesselb]

Are you able to reproduce this with a test instance? Please describe how to reproduce this issue.

$ curl -I --user admin:admin -X OPTIONS https://nextcloud.test/remote.php/dav
HTTP/2 200 
server: nginx/1.15.8
date: Sat, 28 Dec 2019 22:20:41 GMT
content-type: text/html; charset=UTF-8
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-security-policy: default-src 'none';
allow: OPTIONS, GET, HEAD, DELETE, PROPFIND, PUT, PROPPATCH, COPY, MOVE, REPORT, SEARCH
dav: 1, 3, extended-mkcol, access-control, calendarserver-principal-property-search, nc-calendar-search, nc-enable-birthday-calendar
ms-author-via: DAV
accept-ranges: bytes
dasl: <DAV:basicsearch>
referrer-policy: no-referrer
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-robots-tag: none
x-xss-protection: 1; mode=block

A options request to example.com/remote.php/dav will produce a similar output. If your output is very different (e.g. dav: 1, 3, extended-mkcol, is missing) the webserver (or a module / security list / you name it) is probably interfering the request.

[simonspa]

Running the curl command you provided against my instance returns the same methods allowed as your example:

HTTP/2 200 
server: nginx
date: Mon, 30 Dec 2019 16:11:59 GMT
content-type: text/html; charset=UTF-8
content-length: 0
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
<cookies>
content-security-policy: default-src 'none';
allow: OPTIONS, GET, HEAD, DELETE, PROPFIND, PUT, PROPPATCH, COPY, MOVE, REPORT, SEARCH
dav: 1, 3, extended-mkcol, access-control, calendarserver-principal-property-search, nc-calendar-search, nc-enable-birthday-calendar
ms-author-via: DAV
accept-ranges: bytes
dasl: <DAV:basicsearch>
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-robots-tag: none
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer

The test instance creation currently does not work ("an error occurred during execution"), I will try again later and report if and how to reproduce.