fix(JSRecourceLocator): Add missing slash after server root

[susnux]

• Resolves: [Bug]: open_basedir restriction in effect #44358

Summary

The OC::$SERVERROOT is always returned without a trailing slash, so we need to add a slash between server root and apps directory.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[susnux]

/backport to stable28

[thorsten-schwartz]

Hi all,
so what does this mean "added to backportbot"? It is neither in the daily builds nor in the stable brunch for nc 28. I think this is a major bug. No one can open a file with it's mobile.

So maybe someone can explain when it will be fixed in nc 28.

Thanks Thorsten

[susnux]

It is neither in the daily builds nor in the stable brunch for nc 28.

What do you mean with daily builds? This is already merged in the stable28 branch and will be released with 28.0.5, see the PR on stable28: #44413

[thorsten-schwartz]

Thank you for your quick reply. The release procedure was not quite clear to me here.
I thought bugs are fixed asap in the daily builds. From my point of view, this is a major bug. No user with a mobile and Nextcloud client can currently open files.

That's what I mean by daily builds:

https://download.nextcloud.com/server/

Greetings Thorsten

[susnux]

I thought bugs are fixed asap in the daily builds.

It is fixed in the daily builds, I checked nextcloud-28-daily-2024-04-07 and it is included.

[thorsten-schwartz]

Maybe I cannot update from daily....

I changed in config.php to
'updater.release.channel' => 'daily',

php ./updater/updater.phar
Nextcloud Updater - version: v28.0.2rc2-1-gba2e50f dirty

Current version is 28.0.4.

Update to Nextcloud daily available. (channel: "daily")
Following file will be downloaded automatically: https://download.nextcloud.com/server/daily/latest-stable28.zip
Open changelog ↗

Steps that will be executed:
[✔] Check for expected files
[✔] Check for write permissions
[✔] Create backup
[✔] Downloading
[✔] Verify integrity
[✔] Extracting
[✔] Enable maintenance mode
[✔] Replace entry points
[✔] Delete old files
[✔] Move new files in place
[✔] Done

Continue update? [y/N] y

Info: Pressing Ctrl-C will finish the currently running step and then stops the updater.

[✔] Check for expected files
[✔] Check for write permissions
[✔] Create backup
[✔] Downloading
[✔] Verify integrity
[✔] Extracting
[✔] Enable maintenance mode
[✔] Replace entry points
[✔] Delete old files
[✔] Move new files in place
[✔] Done

Update of code successful.

Should the "occ upgrade" command be executed? [Y/n]
Nextcloud is already latest version

Keep maintenance mode active? [y/N]
Maintenance mode already disabled

Maintenance mode is disabled

....
same behaviour with failure. What am I doing wrong?

Thanks Thorsten

[joshtrichards]

Oh I see the confusion.

Technically your installation's code has been updated to the daily. You can verify by checking for a change in lib/private/Template/JSResourceLocator.php in your environment. Should match the one here in the PR.

The daily builds of stable releases (maintenance releases) will never trigger the needUpgrade() version check used by occ upgrade if the starting point is the latest trailing version (e.g. v28.0.4) because the version string in the daily build isn't bumped. It'll always look like the same version once deployed... Fortunately it's basically irrelevant - there are rarely db migrations or required app upgrades for daily maintenance releases. Only the code update (the piece handled by the updater.phar) is important if there aren't any db changes.

If you're curious, you can see the README for the Updater which has a bit more on the details associated with the Updater and the associated occ upgrade piece: https://github.com/nextcloud/updater?tab=readme-ov-file#how-it-works

EDIT: I guess at some point we could start bumping the patch level for daily stable builds:

server/version.php

Lines 29 to 33 in f89dabb

	// We only can count up. The 4. digit is only for the internal patch level to trigger DB upgrades
	// between betas, final and RCs. This is _not_ the public version number. Reset minor/patch level
	// when updating major/minor version number.
	$OC_Version = [28, 0, 4, 1];

This would only be important if we had a maintenance release with a db migration (which is highly unusual) and if we wanted to make sure it worked for the daily's too.

[thorsten-schwartz]

Hi. Now I understand. Thanks for your detailed information. Thorsten Am 08.04.24 um 23:12 schrieb Josh:

…

Oh I see the confusion. Technically your installation's code has been updated to the daily. You can verify by checking for a change in |lib/private/Template/JSResourceLocator.php| in your environment. Should match the one here in the PR <https://github.com/nextcloud/server/pull/44408/files>. The daily builds of stable releases (maintenance releases) will never trigger the |needUpgrade()| <https://github.com/nextcloud/server/blob/5ddba78dc9920b766d38082826bb04556e5982a7/lib/private/legacy/OC_Util.php#L1133> version check used by |occ upgrade| if the starting point is the latest trailing version (e.g. v28.0.4) because the version string <https://github.com/nextcloud/server/blob/f89dabb828e782af51992633c9fd57b593a2d5cb/version.php#L33> in the daily build isn't bumped. It'll always look like the same version once deployed... Fortunately it's basically irrelevant - there are rarely db migrations or required app upgrades for daily /maintenance/ releases. Only the code update (the piece handled by the |updater.phar| is important. If you're curious, you can see the README for the Updater which has a bit more on the details associated with the Updater and the associated |occ upgrade| piece: https://github.com/nextcloud/updater?tab=readme-ov-file#how-it-works