[Bug]: Failed normalising HREF: can't access property "replace", e is undefined

[quenenni]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Hello,

Since I upgraded a cloud to v33.0.6, when I share by link a folder (existing folder share links too), I have this error if the user who use the link is not connected to the cloud.

With version 33.0.6, the error msg was "This operation is forbidden".

I then upgraded the cloud to v33.0.7 and now the error is "Failed normalising HREF: can't access property "replace", e is undefined"

I don't have this problem with shared files for connected and unconnected users, only with shared folders for unconnected users.

Thank you.

Steps to reproduce

1. Create a share on a folder (external shares -> create share link)
2. test the link in a new private window

Expected behavior

See the content of the shared folder.

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "trusted_domains": [
            "cloud.xxxx.be"
        ],
        "activity_expire_days": 30,
        "appstoreenabled": true,
        "appstore.experimental.enabled": false,
        "auth.bruteforce.protection.enabled": true,
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "data-fingerprint": "",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "",
        "dbtype": "mysql",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "default_language": "fr",
        "default_phone_region": "be",
        "hashingCost": 10,
        "htaccess.RewriteBase": "\/",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "integrity.check.disabled": false,
        "logfile": "\/var\/log\/nextcloud\/xxxx.log",
        "loglevel": 0,
        "logtimezone": "Europe\/Brussels",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "sendmail",
        "mail_smtpport": 25,
        "maintenance": false,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "dbindex": 1,
            "timeout": 1.5
        },
        "minimum.supported.desktop.version": "2.1.0",
        "mysql.utf8mb4": true,
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "preview_libreoffice_path": "\/usr\/bin\/libreoffice",
        "preview_max_filesize_image": 25,
        "secret": "***REMOVED SENSITIVE VALUE***",
        "simpleSignUpLink.shown": false,
        "trashbin_retention_obligation": "auto, 30",
        "updatechecker": true,
        "upgrade.disable-web": true,
        "version": "33.0.7.1",
        "versions_retention_obligation": "auto, 90",
        "overwrite.cli.url": "https:\/\/cloud.xxxx.be\/",
        "mail_sendmailmode": "smtp",
        "maintenance_window_start": 2,
}

List of activated Apps

Enabled:
  - activity: 6.0.0
  - app_api: 33.0.0
  - audioplayer: 3.9.0
  - calendar: 6.5.2
  - circles: 33.0.0
  - cloud_federation_api: 1.17.0
  - comments: 1.23.0
  - contacts: 8.7.5
  - dav: 1.36.0
  - electronicsignatures: 3.0.8
  - epubviewer: 1.9.7
  - external: 8.0.1
  - federatedfilesharing: 1.23.0
  - files: 2.5.0
  - files_downloadlimit: 5.1.0
  - files_pdfviewer: 6.0.0
  - files_reminders: 1.6.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - forms: 5.3.5
  - impersonate: 4.0.0
  - integration_docusign: 4.2.0
  - lookup_server_connector: 1.21.0
  - music: 3.1.1
  - notifications: 6.0.0
  - oauth2: 1.21.0
  - onlyoffice: 10.1.2
  - password_policy: 5.0.0
  - photos: 6.0.0
  - polls: 9.1.4
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - related_resources: 4.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - spreed: 23.0.9
  - systemtags: 1.23.0
  - terms_of_service: 4.7.1
  - text: 7.0.1
  - theming: 2.8.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_totp: 15.0.0
  - user_status: 1.13.0
  - viewer: 6.0.0
  - webhook_listeners: 1.5.0
  - welcome: 3.0.0
  - workflowengine: 2.15.0
Disabled:
  - admin_audit: 1.23.0 (installed 1.11.0)
  - bruteforcesettings: 6.0.0 (installed 2.2.0)
  - collectives: 4.4.2 (installed 4.4.2)
  - contactsinteraction: 1.14.1 (installed 1.2.0)
  - dashboard: 7.13.0 (installed 7.7.0)
  - deck: 1.17.4 (installed 1.17.4)
  - encryption: 2.21.0
  - federation: 1.23.0 (installed 1.2.0)
  - files_external: 1.25.1 (installed 1.16.1)
  - firstrunwizard: 6.0.0 (installed 2.1)
  - logreader: 6.0.0 (installed 2.10.0)
  - nextcloud_announcements: 5.0.0 (installed 1.0)
  - privacy: 5.0.0 (installed 1.8.0)
  - recommendations: 6.0.0 (installed 1.0.0)  
  - richdocuments: 10.3.0 (installed 10.3.0)  
  - serverinfo: 5.0.0 (installed 1.17.0)
  - support: 5.0.0 (installed 1.0.0)
  - survey_client: 5.0.0 (installed 1.15.0)   
  - suspicious_login: 11.0.0
  - twofactor_nextcloud_notification: 7.0.0   
  - updatenotification: 1.23.0 (installed 1.1.1)
  - user_ldap: 1.24.0
  - weather_status: 1.13.0 (installed 1.1.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"A7S4a68wr7JrCBgBENQF","level":0,"time":"2026-07-29T17:05:28+02:00","remoteAddr":"1.2.3.4ceTWnkyd/","scriptName":"/public.php","message":"No read permissions","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0","version":"33.0.7.1","exception":{"Exception":"OCA\\DAV\\Connector\\Sabre\\Exception\\Forbidden","Message":"No read permissions","Code":0,"Trace":[{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/lib/SystemTag/SystemTagPlugin.php","line":220,"function":"getChildren","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"preloadCollection","class":"OCA\\DAV\\SystemTag\\SystemTagPlugin","type":"->"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/lib/Connector/Sabre/PropFindPreloadNotifyPlugin.php","line":44,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"collectionPreloadNotifier","class":"OCA\\DAV\\Connector\\Sabre\\PropFindPreloadNotifyPlugin","type":"->"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/dav/lib/DAV/Server.php","line":1052,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/dav/lib/DAV/Server.php","line":984,"function":"getPropertiesByNode","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/dav/lib/DAV/Server.php","line":1664,"function":"getPropertiesIteratorForPath","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/dav/lib/DAV/Server.php","line":1644,"function":"writeMultiStatus","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/http/lib/Sapi.php","line":81,"function":"Sabre\\DAV\\{closure}","class":"Sabre\\DAV\\Server","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/dav/lib/DAV/Server.php","line":490,"function":"sendResponse","class":"Sabre\\HTTP\\Sapi","type":"::"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/lib/Connector/Sabre/Server.php","line":212,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/appinfo/v2/publicremote.php","line":174,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/mnt/disque_sde2/nextcloud/instances/xxxx/public.php","line":90,"args":["/mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/appinfo/v2/publicremote.php"],"function":"require_once"}],"File":"/mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/lib/Connector/Sabre/Directory.php","Line":259,"message":"No read permissions","exception":"{\"class\":\"OCA\\DAV\\Connector\\Sabre\\Exception\\Forbidden\",\"message\":\"No read permissions\",\"code\":0,\"file\":\"/mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/lib/Connector/Sabre/Directory.php:259\",\"trace\":\"#0 /mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/lib/SystemTag/SystemTagPlugin.php(220): OCA\\DAV\\Connector\\Sabre\\Directory->getChildren()\\n#1 /mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): OCA\\DAV\\SystemTag\\SystemTagPlugin->preloadCollection()\\n#2 /mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/lib/Connector/Sabre/PropFindPreloadNotifyPlugin.php(44): Sabre\\DAV\\Server->emit()\\n#3 /mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): OCA\\DAV\\Connector\\Sabre\\PropFindPreloadNotifyPlugin->collectionPreloadNotifier()\\n#4 /mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/dav/lib/DAV/Server.php(1052): Sabre\\DAV\\Server->emit()\\n#5 /mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/dav/lib/DAV/Server.php(984): Sabre\\DAV\\Server->getPropertiesByNode()\\n#6 /mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/dav/lib/DAV/Server.php(1664): Sabre\\DAV\\Server->getPropertiesIteratorForPath()\\n#7 /mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/dav/lib/DAV/Server.php(1644): Sabre\\DAV\\Server->writeMultiStatus()\\n#8 /mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/http/lib/Sapi.php(81): Sabre\\DAV\\Server->Sabre\\DAV\\{closure}()\\n#9 /mnt/disque_sde2/nextcloud/instances/xxxx/3rdparty/sabre/dav/lib/DAV/Server.php(490): Sabre\\HTTP\\Sapi::sendResponse()\\n#10 /mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/lib/Connector/Sabre/Server.php(212): Sabre\\DAV\\Server->invokeMethod()\\n#11 /mnt/disque_sde2/nextcloud/instances/xxxx/apps/dav/appinfo/v2/publicremote.php(174): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#12 /mnt/disque_sde2/nextcloud/instances/xxxx/public.php(90): require_once('...')\\n#13 {main}\"}","CustomMessage":"No read permissions"}}

Additional info

In the browser console, I have these errors:

[ERROR] viewer: Could not register handler 
Object { app: "viewer", level: 0, error: "The handler is already registered", handler: {…} }
index.mjs:47:17
    log index.mjs:47
    error index.mjs:65
    registerHandler Viewer.js:89
    beforeMount Viewer.vue:526
    beforeMount Viewer.vue:525
    (Asynchrone : EventListener.handleEvent)
    beforeMount Viewer.vue:522
    VueJS 16
    <anonyme> main.js:32

Uncaught TypeError: can't access property "value", document.getElementById(...) is null
    <anonymous> https://cloud.xxxx.be/apps/audioplayer/js/sharing/sharing.js?v=ec881d36-82:17
    EventListener.handleEvent* https://cloud.xxxx.be/apps/audioplayer/js/sharing/sharing.js?v=ec881d36-82:15
sharing.js:17:29
    <anonyme> https://cloud.xxxx.be/apps/audioplayer/js/sharing/sharing.js?v=ec881d36-82:17
    (Asynchrone : EventListener.handleEvent)
    <anonyme> https://cloud.xxxx.be/apps/audioplayer/js/sharing/sharing.js?v=ec881d36-82:15

[ERROR] files: Error while fetching content 
Object { app: "files", level: 0, error: Layerr }
[index.mjs:47:17](webpack:///nextcloud/node_modules/@nextcloud/logger/dist/index.mjs)
    log index.mjs:47
    error index.mjs:65
    fetchContent FilesList.vue:386
    mounted FilesList.vue:306
    VueJS 11
    43327 main.ts:33
    Webpack 5
        o
        r
        O
        <anonyme>
        <anonyme>

No error in the network tab, all requests return a code 200
Here ou can see the Nginx logs (nothing in error.log)
´´´
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:10 +0200] "GET /s/7DEgRS8LBBHo8xn HTTP/2.0" 200 16812 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "-"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:10 +0200] "GET /js/core/merged-template-prepend.js?v=ec881d36-82 HTTP/2.0" 200 3426 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "-"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:10 +0200] "GET /apps/theming/theme/dark.css?plain=1&v=3e36a4e8 HTTP/2.0" 200 1472 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "3.11"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:10 +0200] "GET /apps/theming/theme/light.css?plain=0&v=3e36a4e8 HTTP/2.0" 200 1473 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "3.15"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:10 +0200] "GET /apps/theming/theme/dark-highcontrast.css?plain=0&v=3e36a4e8 HTTP/2.0" 200 1554 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "3.01"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:10 +0200] "GET /apps/theming/theme/default.css?plain=1&v=3e36a4e8 HTTP/2.0" 200 1462 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "3.17"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:10 +0200] "GET /apps/theming/theme/dark.css?plain=0&v=3e36a4e8 HTTP/2.0" 200 1485 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "3.09"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:10 +0200] "GET /apps/theming/theme/opendyslexic.css?plain=0&v=3e36a4e8 HTTP/2.0" 200 322 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "2.01"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:10 +0200] "GET /apps/theming/theme/light-highcontrast.css?plain=0&v=3e36a4e8 HTTP/2.0" 200 1500 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "3.05"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:11 +0200] "GET /apps/theming/theme/light.css?plain=1&v=3e36a4e8 HTTP/2.0" 200 1462 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "3.17"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:11 +0200] "GET /apps/theming/image/logoheader?v=82 HTTP/2.0" 200 3308 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "3.04"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:11 +0200] "GET /apps/theming/theme/dark-highcontrast.css?plain=1&v=3e36a4e8 HTTP/2.0" 200 1539 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "3.03"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:11 +0200] "GET /apps/theming/theme/light-highcontrast.css?plain=1&v=3e36a4e8 HTTP/2.0" 200 1484 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "3.07"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:11 +0200] "GET /avatar/guest/%3F/64/dark?guestFallback=true HTTP/2.0" 201 656 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "-"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:11 +0200] "GET /ocs/v2.php/apps/terms_of_service/terms HTTP/2.0" 200 1950 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "-"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:11 +0200] "PROPFIND /public.php/dav/files/7DEgRS8LBBHo8xn/ HTTP/2.0" 207 508 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "-"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:12 +0200] "GET /apps/theming/favicon/files?v=7cb27f67 HTTP/2.0" 200 19574 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "1.11"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:12 +0200] "GET /apps/theming/icon/files?v=7cb27f67 HTTP/2.0" 200 5971 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "-"
cloud.xxxx.be 1.2.3.4 - - [29/Jul/2026:17:41:12 +0200] "GET /index.php/apps/files/preview-service-worker.js HTTP/2.0" 200 5359 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0" "2.74"