From 70039a828875252be00bb03d672398cec52807e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Leon=20B=C3=B6sche?= Date: Tue, 13 Jan 2026 14:50:24 +0100 Subject: [PATCH] Fix Collabora WOPI: Put WOPISrc in URL query param, not form body --- go_cloud/internal/http/wopi_handlers.go | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/go_cloud/internal/http/wopi_handlers.go b/go_cloud/internal/http/wopi_handlers.go index 92e6468..c0b8aac 100644 --- a/go_cloud/internal/http/wopi_handlers.go +++ b/go_cloud/internal/http/wopi_handlers.go @@ -6,8 +6,7 @@ import ( "fmt" "io" "net/http" - - //"net/url" + "net/url" "strings" "sync" "time" @@ -752,9 +751,16 @@ func collaboraProxyHandler(w http.ResponseWriter, r *http.Request, db *database. // Get the correct Collabora editor URL from discovery (includes version hash) editorURL := getCollaboraEditorURL(collaboraURL) + // URL-encode the WOPISrc for use in the form action URL + encodedWopiSrc := url.QueryEscape(wopiSrc) + + // Build the full Collabora URL with WOPISrc as query parameter + // Collabora expects: cool.html?WOPISrc= + collaboraFullURL := fmt.Sprintf("%s?WOPISrc=%s", editorURL, encodedWopiSrc) + // Return HTML page with auto-submitting form - // The form POSTs to Collabora from within an iframe to work around CSP frame-ancestors restrictions - // The iframe is hosted on the same domain as the embedded page, allowing the POST to complete + // The form POSTs to Collabora with access_token in the body + // WOPISrc must be in the URL as a query parameter htmlContent := fmt.Sprintf(` @@ -772,7 +778,6 @@ func collaboraProxyHandler(w http.ResponseWriter, r *http.Request, db *database.

Loading Collabora Online...

-`, editorURL, wopiSrc, accessToken, editorURL) +`, collaboraFullURL, accessToken, collaboraFullURL) w.Header().Set("Content-Type", "text/html; charset=utf-8") // Don't set X-Frame-Options - this endpoint is meant to be loaded in an iframe w.WriteHeader(http.StatusOK) w.Write([]byte(htmlContent)) - fmt.Printf("[COLLABORA-PROXY] Served HTML form: file=%s user=%s wopi_src=%s editor_url=%s\n", fileID, userID.String(), wopiSrc, editorURL) + fmt.Printf("[COLLABORA-PROXY] Served HTML form: file=%s user=%s wopi_src=%s editor_url=%s\n", fileID, userID.String(), wopiSrc, collaboraFullURL) }