Public-link file drop: anonymous upload returns 500 on both dogfoods (no server log line) #678

New issue

Closed

opened 2026-09-23 03:20:42 +00:00 by Cordy · 0 comments

Cordy commented

2026-09-23 03:20:42 +00:00

Owner

Found by the #656 QA pass (v0.6.247, both dogfoods).

Matrix row: §4 Sharing — "Public link upload (file drop) | Folder link with uploads allowed | Anonymous upload lands in folder".

Steps

As nikola-test, create _qa/drop/, then use the row ⋮ → Share → Public link with Expires 1 hour and Allow uploads (file drop) checked → Create link.
Open the link. The page shows "drop · empty", a file input with an Upload button, and a "Drop files here to upload" zone.
Drop a small text file (qa-anon-drop.txt, about 40 B) on the zone.

Expected: the file lands in _qa/drop/.
Seen: the zone text becomes "Upload failed (500)". The pod logs show POST /s/<token> status=500 dur_ms=2–92 bytes_in≈230 and nothing else: no error line explaining the 500.

files-bao: 500 at 03:19:11Z and 03:19:31Z.
files: 500 at 03:20:18Z.

The file-input + Upload button path (a native form POST) instead navigates to a bare plain-text page reading upload failed, with no styling and no way back other than the browser's Back.

Notes:

The file was injected as a File via DataTransfer (the same object a real drag produces). The server's 500 is independent of how the client built the request, but Nikola may want one manual drag to confirm.
bytes_in≈230 is a plain multipart body. If the drop is meant to be encrypted client-side ("The file is encrypted for this link"), the page may be sending plaintext that the server then rejects badly. Either way, a 500 without a log line is itself worth fixing.
Copy: the folder's public-link section still says "The file is encrypted for this link."
/favicon.ico 404s on share pages.

Screenshot: 678-file-drop-500.jpg

Found by the #656 QA pass (v0.6.247, both dogfoods). **Matrix row:** §4 Sharing — "Public link upload (file drop) | Folder link with uploads allowed | Anonymous upload lands in folder". **Steps** 1. As nikola-test, create `_qa/drop/`, then use the row ⋮ → Share → Public link with Expires 1 hour and **Allow uploads (file drop)** checked → Create link. 2. Open the link. The page shows "drop · empty", a file input with an Upload button, and a "Drop files here to upload" zone. 3. Drop a small text file (`qa-anon-drop.txt`, about 40 B) on the zone. **Expected:** the file lands in `_qa/drop/`. **Seen:** the zone text becomes **"Upload failed (500)"**. The pod logs show `POST /s/<token> status=500 dur_ms=2–92 bytes_in≈230` and nothing else: no error line explaining the 500. - files-bao: 500 at 03:19:11Z and 03:19:31Z. - files: 500 at 03:20:18Z. The file-input + **Upload** button path (a native form POST) instead navigates to a bare plain-text page reading `upload failed`, with no styling and no way back other than the browser's Back. Notes: - The file was injected as a `File` via `DataTransfer` (the same object a real drag produces). The server's 500 is independent of how the client built the request, but Nikola may want one manual drag to confirm. - `bytes_in≈230` is a plain multipart body. If the drop is meant to be encrypted client-side ("The file is encrypted for this link"), the page may be sending plaintext that the server then rejects badly. Either way, a 500 without a log line is itself worth fixing. - Copy: the folder's public-link section still says "The **file** is encrypted for this link." - `/favicon.ico` 404s on share pages. **Screenshot:** `678-file-drop-500.jpg`