Some times the Admin users can not modify a

teachh · 28 August 2024 13:01

Do you want to: When trying to edit a document with the Administrator user, sometimes with no pattern I get the following error:

Translated:
You do not have permissions to perform the action you are trying to do.
Please contact the document server administrator.

After that message appears, all the interface becomes lighter and I am not allowed to use anything but Download/Print… it is like having only Read permissions.

Document Server version: onlyoffice/documentserver:latest
This is my docker-compose.yaml

services:
  db:
    image: mariadb:10.11
    container_name: seafile-mysql
    environment:
      - MYSQL_ROOT_PASSWORD=?  # Requested, set the root's password of MySQL service.
      - MYSQL_LOG_CONSOLE=true
      - MARIADB_AUTO_UPGRADE=1
    volumes:
      - /opt/seafile-mysql/db:/var/lib/mysql  # Requested, specifies the path to MySQL data persistent store.
    networks:
      - seafile-net

  memcached:
    image: memcached:1.6.18
    container_name: seafile-memcached
    entrypoint: memcached -m 256
    networks:
      - seafile-net
          
  seafile:
    image: seafileltd/seafile-mc:latest
    container_name: seafile
    ports:
      - "8011:80"
      # - "1443:443"
    volumes:
      - /opt/seafile-data:/shared   # Requested, specifies the path to Seafile data persistent store.
    environment:
      - DB_HOST=db
      - DB_ROOT_PASSWD=?  # Requested, the value should be root's password of MySQL service.
      - TIME_ZONE=Europe/Madrid  # Optional, default is UTC. Should be uncomment and set to your local time zone.
      - SEAFILE_ADMIN_EMAIL=?# Specifies Seafile admin user, default is 'me@example.com'.
      - SEAFILE_ADMIN_PASSWORD=?     # Specifies Seafile admin password, default is 'asecret'.
      - SEAFILE_SERVER_LETSENCRYPT=false   # Whether to use https or not.
    depends_on:
      - db
      - memcached
    networks:
      - seafile-net
  oods:
    image: onlyoffice/documentserver:latest
    container_name: seafile-oods
    networks:
      - seafile-net
    environment:
      - JWT_ENABLED=true
      - JWT_SECRET=?

networks:
  seafile-net:

OS: Using Docker
Browser version: Last Google Chrome version
Additional information:
I’m using Seafile and I followed this documentation:

Seafile installation: Seafile Community Installation - Seafile Admin Manual
Onlyoffice implementation: OnlyOffice Integration - Seafile Admin Manual

The LOGS are:
==> /var/log/onlyoffice/documentserver/docservice/out.log <==
[2024-08-28T12:16:00.639] [WARN] [localhost] [231d9679f6c8f8a4e7aa] [05971ce5e9ea45bc9561c71fd1d8c184@auth.local11] nodeJS - conn.user.view||isCloseCoAuthoring access deny: type = getLock
[2024-08-28T12:16:08.784] [WARN] [localhost] [231d9679f6c8f8a4e7aa] [05971ce5e9ea45bc9561c71fd1d8c184@auth.local12] nodeJS - conn.user.view||isCloseCoAuthoring access deny: type = getLock
[2024-08-28T12:16:17.653] [WARN] [localhost] [231d9679f6c8f8a4e7aa] [05971ce5e9ea45bc9561c71fd1d8c184@auth.local13] nodeJS - conn.user.view||isCloseCoAuthoring access deny: type = getLock
[2024-08-28T12:18:26.487] [WARN] [localhost] [231d9679f6c8f8a4e7aa] [05971ce5e9ea45bc9561c71fd1d8c184@auth.local] nodeJS - UpdateVersion expired

teachh · 28 August 2024 13:04

This error occurs when trying to edit the document and you type something. If not, the error does not appears.

Constantine · 2 September 2024 07:25

Hello @teachh

Please share following:

Output of the command docker exec -it seafile-oods apt list --installed | grep onlyoffice;
All logs of Document Server in a single archive;
Exact version of Seafile.

teachh · 2 September 2024 12:52

Hello @Constantine

Here you have:

Output of the command docker exec -it seafile-oods apt list --installed | grep onlyoffice;

onlyoffice-documentserver/now 8.1.1-26 amd64 [installed,local]

All logs of Document Server in a single archive;
You can find the logs here: logs.log - Google Drive
Exact version of Seafile.
11.0.9

Thanks!

Constantine · 4 September 2024 10:10

Thanks for sharing the details. I see 403 errors in logs in particular that generally states that the requested file cannot be download due to restriction. Usually this means that the storage does not allow downloading the file or in some cases may indicate to the issue with Document Server configuration.

Please provide some more information:

Is HTTPS enabled for Document Server and Seafile?
Does this issue occur with specific files or all of them?
Do you use proxy services in your environment?
Do you have any issues with editing files from integrated test example?

To test integrated example please go to Document Servers’ Welcome Page via its address, there you will find an instruction on how to enable example (if it is not enabled). Once enabled, press GO TO EXAMPLE on the same Welcome Page and try creating or uploading any document to it to test wether you can edit it.

teachh · 4 September 2024 14:48

1. Is HTTPS enabled for Document Server and Seafile?
No it is not. Cloudflare Tunnel is the entity that is providing the HTTPS.
2. Does this issue occur with specific files or all of them?
This issue can occur with any file and it does not have a pattern. Meaning that a file that had this error, after a short time or using incognito will work.
3. Do you use proxy services in your environment?
I’m using Cloudflare Tunnel as a Reverse Proxy.
4. Do you have any issues with editing files from integrated test example?
When creating a file and trying to access I get a blank page:

The logs after trying to access:

==> /var/log/onlyoffice/documentserver/nginx.error.log <==
2024/09/04 14:37:09 [error] 8740#8740: *3544 connect() failed (111: Unknown error) while connecting to upstream, client: 172.18.0.5, server: , request: "GET /example/ HTTP/1.1", upstream: "http://127.0.0.1:3000/", host: "oods", referrer: "https://myweb.com/onlyofficeds/welcome/"
2024/09/04 14:37:09 [error] 8740#8740: *3544 connect() failed (111: Unknown error) while connecting to upstream, client: 172.18.0.5, server: , request: "GET /example/ HTTP/1.1", upstream: "http://127.0.0.1:3000/", host: "oods", referrer: "https://myweb.com/onlyofficeds/welcome/"

My nginx configuration is:

# -*- mode: nginx -*-
# Auto generated at 03/01/2024 15:26:25

# Required for only office document server
map $http_x_forwarded_proto $the_scheme {
    default $http_x_forwarded_proto;
    "" $scheme;
}
map $http_x_forwarded_host $the_host {
    default $http_x_forwarded_host;
    "" $host;
}
map $http_upgrade $proxy_connection {
    default upgrade;
    "" close;
}

server {
    listen 80;
    server_name myweb.com;

    client_max_body_size 10m;

    location / {
        proxy_pass http://127.0.0.1:8000/;
        proxy_read_timeout 310s;
        proxy_set_header Host $http_host;
        proxy_set_header Forwarded "for=$remote_addr;proto=$scheme";
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Connection "";
        proxy_http_version 1.1;

        client_max_body_size 0;
        access_log      /var/log/nginx/seahub.access.log seafileformat;
        error_log       /var/log/nginx/seahub.error.log;
    }

    location /seafhttp {
        rewrite ^/seafhttp(.*)$ $1 break;
        proxy_pass http://127.0.0.1:8082;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        client_max_body_size 0;
        proxy_connect_timeout  36000s;
        proxy_read_timeout  36000s;
        proxy_request_buffering off;
        access_log      /var/log/nginx/seafhttp.access.log seafileformat;
        error_log       /var/log/nginx/seafhttp.error.log;
    }

    location /notification/ping {
        proxy_pass http://127.0.0.1:8083/ping;
        access_log      /var/log/nginx/notification.access.log seafileformat;
        error_log       /var/log/nginx/notification.error.log;
    }

    location /notification {
        proxy_pass http://127.0.0.1:8083/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        access_log      /var/log/nginx/notification.access.log seafileformat;
        error_log       /var/log/nginx/notification.error.log;
    }

    location /seafdav {
        proxy_pass         http://127.0.0.1:8080;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host $server_name;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout  1200s;
        client_max_body_size 0;

        access_log      /var/log/nginx/seafdav.access.log seafileformat;
        error_log       /var/log/nginx/seafdav.error.log;
    }

    location /media {
        root /opt/seafile/seafile-server-latest/seahub;
    }

    location /onlyofficeds/ {
        proxy_pass http://oods/;
        proxy_http_version 1.1;
        client_max_body_size 100M;
        proxy_read_timeout 3600s;
        proxy_connect_timeout 3600s;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $proxy_connection;
        proxy_set_header X-Forwarded-Host $the_host/onlyofficeds;
        proxy_set_header X-Forwarded-Proto $the_scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

server {
    listen 443;
    server_name test.kadimaenergy.es;

    client_max_body_size 10m;

    location / {
        proxy_pass http://127.0.0.1:8000/;
        proxy_read_timeout 310s;
        proxy_set_header Host $http_host;
        proxy_set_header Forwarded "for=$remote_addr;proto=$scheme";
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Connection "";
        proxy_http_version 1.1;

        client_max_body_size 0;
        access_log      /var/log/nginx/seahub.access.log seafileformat;
        error_log       /var/log/nginx/seahub.error.log;
    }

    location /seafhttp {
        rewrite ^/seafhttp(.*)$ $1 break;
        proxy_pass http://127.0.0.1:8082;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        client_max_body_size 0;
        proxy_connect_timeout  36000s;
        proxy_read_timeout  36000s;
        proxy_request_buffering off;
        access_log      /var/log/nginx/seafhttp.access.log seafileformat;
        error_log       /var/log/nginx/seafhttp.error.log;
    }

    location /notification/ping {
        proxy_pass http://127.0.0.1:8083/ping;
        access_log      /var/log/nginx/notification.access.log seafileformat;
        error_log       /var/log/nginx/notification.error.log;
    }

    location /notification {
        proxy_pass http://127.0.0.1:8083/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        access_log      /var/log/nginx/notification.access.log seafileformat;
        error_log       /var/log/nginx/notification.error.log;
    }

    location /seafdav {
        proxy_pass         http://127.0.0.1:8080;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host $server_name;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout  1200s;
        client_max_body_size 0;

        access_log      /var/log/nginx/seafdav.access.log seafileformat;
        error_log       /var/log/nginx/seafdav.error.log;
    }

    location /media {
        root /opt/seafile/seafile-server-latest/seahub;
    }

    location /onlyofficeds/ {
        proxy_pass http://oods/;
        proxy_http_version 1.1;
        client_max_body_size 100M;
        proxy_read_timeout 3600s;
        proxy_connect_timeout 3600s;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $proxy_connection;
        proxy_set_header X-Forwarded-Host $the_host/onlyofficeds;
        proxy_set_header X-Forwarded-Proto $the_scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Thanks a lot!

teachh · 4 September 2024 14:58

A possible reason I have blank page is because this resource can not be loaded:

Sorry for second message but I can not attach 2 images for now .

Constantine · 9 September 2024 14:43

This error could mean that Document Servers’ address was changed or defined incorrectly. Considering that integrated test example returns such result, please try creating new file again and then share logs of Document Server.

In general, we haven’t tested deployment in such environment.

teachh · 1 October 2024 18:23

Sorry for late response.

This does not generate any ERROR logs.

Another interesting thing is that the error mentioned at the beginning of the discussion generates a 403:

[2024-10-01T09:40:37.237] [ERROR] [localhost] [a4e41883a465a259e4f6] [3079971af9364dd29bf563f7f5ffc7ae@auth.local] nodeJS - error downloadFile:url=https://example.com/seafhttp/files/e4501101-0f1d-4241-a4a6-e9d594404d0d/BDD.xlsx;attempt=3;code:null;connect:null Error: Error response: statusCode:403; headers:{"date":"Tue, 01 Oct 2024 09:40:37 GMT","content-type":"text/plain","content-length":"43","connection":"keep-alive","content-encoding":"gzip","cf-cache-status":"BYPASS","report-to":"{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=Mzl0zhh9mBHa2Jif720v%2FHBP43hmuwdjfOQb31A%2Bo9A51xxTRaTFJgxoWq54n7kZdCO0iZY%2BkY%2FRHePCsWw1%2FfRp7cBDzfmo1lqhikjuZu42TWMCqeGOAMa%2BaLuozhbNBUY2lGOiLjHD24vjEXNnow%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}","nel":"{\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}","vary":"Accept-Encoding","server":"cloudflare","cf-ray":"8cbb7e03add5cbd3-MAD"};
    at Request.fResponse (/snapshot/server/Common/sources/utils.js)
    at Request.emit (node:events:527:28)
    at Request.onRequestResponse (/snapshot/server/Common/node_modules/request/request.js:1066:10)
    at ClientRequest.emit (node:events:527:28)
    at HTTPParser.parserOnIncomingClient (node:_http_client:631:27)
    at HTTPParser.parserOnHeadersComplete (node:_http_common:128:17)
    at TLSSocket.socketOnData (node:_http_client:494:22)
    at TLSSocket.emit (node:events:527:28)
    at addChunk (node:internal/streams/readable:315:12)
    at readableAddChunk (node:internal/streams/readable:289:9)
    at TLSSocket.Readable.push (node:internal/streams/readable:228:10)
    at TLSWrap.onStreamRead (node:internal/stream_base_commons:190:23)

Constantine · 3 October 2024 10:39

This is actually an ERROR log so Document Server does generate such logs.

Please provide an update on the situation - do I understand correctly that Document Server still opens some files and then prompts warning when you are trying to type anything in the document and that integrated test example still does not work?

Since Docker is used, I have to ask wether you are proxying traffic to localhost or local address or to backend IP?

teachh · 9 October 2024 14:33

Hi,

After a month observing the different errors, I think that the issue is combining Seafile+Onlyoffice with Cloudflare tunnel. My guess is that the Cache is generating all this errors. How can I disable and check if this is the case?

Thanks!

Constantine · 10 October 2024 11:00

Not quite understand what cache you are referring to.

Since proxy is used, I’d recommend checking out this article to see if it is configured correctly for Document Server:

teachh · 17 October 2024 17:57

Hi Constantine,

After a bit more of a month I found the solution. The configuration was set it up properly but the issue was Cloudflare.

Cloudflare was blocking some requests with a 403 (Forbidden) error for this documents that are large. This is because of the Cache of Cloudflare and the restricted request size of Cloudflare Tunnel. Blocking the cache for my page in Cloudflare solved my issue.

Thanks a lot for the support and I hope that this answer saves time for someone that is having the same issue!

Constantine · 17 October 2024 18:37

That’s a good news, I’m glad that you’ve managed to find the solution.
I’ll close this case as solved then. Thanks for sharing the details!