Cannot access documents since last update - CryptPad is failing to load OnlyOffice

[james]

Hello @sansguidon

@SansGuidon said in Cannot access documents since last update - CryptPad is failing to load OnlyOffice:

Since last update

What update are you referring to?
A Cloudron update or an app update?

[SansGuidon]

@james said in Cannot access documents since last update - CryptPad is failing to load OnlyOffice:

Hello @sansguidon

@SansGuidon said in Cannot access documents since last update - CryptPad is failing to load OnlyOffice:

Since last update

What update are you referring to?
A Cloudron update or an app update?

Thanks for the answer! In fact here I'm not 100% sure of the when. It has been a few days maybe more than a week I'm not sure as I don't use the app daily and the notifications history for updates in cloudron is not keeping lot of info since v9. But I have read on their GitHub that they made a release few weeks ago. So either it's that either a cloudron update? Difficult to tell. Maybe I could try to rollback to a previous package version?

[archos]

Hi, we have the same issue. Confirmed on both Firefox and Chrome.
curl -I shows the root cause:

GET /extensions.js?ver=2026.2.0-1772167481346
→ 301 redirect to http://<redacted>/extensions.js/?ver=...

Content-Security-Policy: Nastavení stránky zablokovalo provedení skriptu (script-src-elem) na http://<redacted>/extensions.js/?ver=2026.2.0-1772167481346, protože porušuje direktivu „script-src 'self' 'unsafe-eval' 'unsafe-inline' resource: https://<redacted>"
Zdroj na adrese "https://<redacted>/extensions.js?ver=2026.2.0-1772167481346" byl zablokován kvůli rozdílnému MIME typu ("text/html") (X-Content-Type-Options: nosniff).
URI zdroje <script> není v tomto dokumentu povolen: „https://<redacted>/extensions.js?ver=2026.2.0-1772167481346".
Uncaught TypeError: can't access property "DocEditor", window.DocsAPI is undefined
    startOO https://<redacted>/common/onlyoffice/inner.js?ver=2026.2.0-1772167481346:2544

Nginx adds a trailing slash and downgrades HTTPS to HTTP. HSTS catches it and switches back to HTTPS, but the URL is now /extensions.js/ instead of /extensions.js → server returns HTML instead of JS → CSP blocks it → OnlyOffice fails to load.

[james]

Hello @sansguidon and @archos

I reproduced the issue and found a solution.
An app update will be available soon.

[joseph]

A new package is out that should fix the problem.

[archos]

Hi, thanks for the update. The new package seems to fix the issue for new documents, but older documents still fail to open with the same error.

[SansGuidon]

@joseph said:

A new package is out that should fix the problem.

Thanks everyone ! Did anyone successfully try the update for opening files on its drive? I've only tried on mobile but I hit the same error message in the frontend about a script failing to load.

[james]

Hello @archos and @sansguidon
Please ensure this is not a caching issue of your browser.

[SansGuidon]

@james said:

Hello @archos and @sansguidon
Please ensure this is not a caching issue of your browser.

Thanks for the advice, so after checking in two other browsers I confirm the issue persists independently from caching

[james]

Hello @sansguidon
Thanks for the report.
I will have to look into it again.

Please share what browser, what browser version and what operating system is used.
Also, if any extensions are installed please also list them or confirm that the issue persists in a fresh browser session with no extensions.

[archos]

Hi, tested on Firefox 148.0 on Arch Linux and Safari on iOS. Issue persists in a private/incognito window with no extensions. Older documents still fail to open.

[SansGuidon]

@james said:

Hello @sansguidon
Thanks for the report.
I will have to look into it again.

Please share what browser, what browser version and what operating system is used.
Also, if any extensions are installed please also list them or confirm that the issue persists in a fresh browser session with no extensions.

I've tried from MacOs, Android, Vivaldi, Brave, LibreWolf. Same issue.
Would it help to share my logs or data??

[nichu42]

I experienced the same last week. I was able to work around the issue by duplicating the file (yes, there is only one file in my drive).

[SansGuidon]

Thanks for the suggestion! I can't copy a file, the context menu only appears with both a combination of clicking and hitting some trigger key, and then I cannot hit Copy as context menu disappears as soon as I release the mouse button. Annoying UX.

I've obtained more console log after removing the local data storage on my usual session:

sframe-boot.js?ver=1.11:46 Testing if CSP correctly blocks an 'eval' call
22:57:55.338 LessLoader.js?ver=2026.2.0-1772483278073:208 Compiling [/customize/src/less2/include/loading.less] took 92ms
22:57:55.507 LessLoader.js?ver=2026.2.0-1772483278073:208 Compiling [/common/onlyoffice/app-oo.less] took 180ms
22:57:55.666 jquery.min.js?ver=2026.2.0-1772483278073:2  Failed to load resource: the server responded with a status of 404 ()
send @ jquery.min.js?ver=2026.2.0-1772483278073:2
22:57:56.057 inner.js?ver=2026.2.0-1772483278073:2206 updated config Object
createOOConfig @ inner.js?ver=2026.2.0-1772483278073:2206
22:57:56.058 inner.js?ver=2026.2.0-1772483278073:2544 Uncaught TypeError: Cannot read properties of undefined (reading 'DocEditor')

[SansGuidon]

Any workaround for this? Shall I try to rollback the app version and if yes how ? I'm happy to just use an old version of the app if that can work, so I can at least re-open my files that I couldn't edit for 2 weeks now :-'(

EDIT, some tests/findings

$ curl -I https://<redacted>/common/onlyoffice/api.js
HTTP/2 404
server: nginx
date: Wed, 04 Mar 2026 23:10:17 GMT
content-type: text/html
content-length: 938
etag: "698ca1f6-3aa"

$ curl -I https://<redacted>/web-apps/apps/api/documents/api.js
HTTP/2 200
server: nginx
date: Wed, 04 Mar 2026 23:10:19 GMT
content-type: application/javascript
content-length: 17408
last-modified: Wed, 11 Feb 2026 15:36:22 GMT
etag: "698ca1f6-4400"
access-control-allow-origin: https://sandbox.<redacted>
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
content-security-policy: default-src 'none'; child-src <redacted>
accept-ranges: bytes
strict-transport-security: max-age=63072000
x-xss-protection: 1; mode=block
x-download-options: noopen
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
referrer-policy: same-origin

hypothesis:

• the package changed the OnlyOffice API path,
• but existing pads/config still reference the old /common/onlyoffice/api.js path.
• GET /web-apps/apps/api/documents/api.js → 200 (JS)
• GET /common/onlyoffice/api.js → 404
• existing files still try /common/onlyoffice/api.js and fail with DocEditor undefined.

I'm not sure what must be done here, a compatibility rule in nginx to forward old request to new endpoints? a migration script/step in the next app update for old files?

[joseph]

A fix is being worked on here - https://git.cloudron.io/packages/cryptpad-app/-/merge_requests/15 cc @nebulon @brutalbirdie

[SansGuidon]

Hi,
I see the fix has been merged and the latest update (1.13.2) was applied on my instance yet I cannot open my drive files maybe a workaround is needed to export our files and re-import them, I'm not sure what to do but it's frustrating to not access my files for a few weeks now.
I'm sorry to ask again for support, but it's very annoying.
Thanks in advance!

[nebulon]

I was able to reproduce the issue of not being able to open existing files, but new files work just fine. The main issue I found was that all existing documents strangely use a different access path. They all container ../dist/v8/... in their path, while new documents are at .../dist/v9/... the v8 calls all return 404, which seems to be the root cause.

Does anyone know how those e2e documents reference actual api versions? I wasn't able to find anything related to this upstream.

[archos]

New documents work without any issues, but there is a problem with older documents.

After the latest update, I managed to open an old document by right-clicking on it and selecting Create copy. The created copy then opens normally.

Maybe this can help someone as a temporary workaround until the bug is fully fixed.

[SansGuidon]

@archos the workaround is enough for me! Thanks