diff --git a/go_cloud/api b/go_cloud/api index c0b2300..cf6ef34 100755 Binary files a/go_cloud/api and b/go_cloud/api differ diff --git a/go_cloud/internal/http/wopi_handlers.go b/go_cloud/internal/http/wopi_handlers.go index a034780..c07cc72 100644 --- a/go_cloud/internal/http/wopi_handlers.go +++ b/go_cloud/internal/http/wopi_handlers.go @@ -872,21 +872,17 @@ func collaboraProxyHandler(w http.ResponseWriter, r *http.Request, db *database. return } - // Build WOPISrc URL (without access_token - Collabora will use Authorization header) - wopiSrc := fmt.Sprintf("https://go.b0esche.cloud/wopi/files/%s", fileID) + // Build WOPISrc URL (include access_token for Collabora) + wopiSrc := fmt.Sprintf("https://go.b0esche.cloud/wopi/files/%s?access_token=%s", fileID, accessToken) // Get the correct Collabora editor URL from discovery (includes version hash) editorURL := getCollaboraEditorURL(collaboraURL) - // URL-encode the WOPISrc for use in the form action URL (Collabora requires this) - encodedWopiSrc := url.QueryEscape(wopiSrc) - - // Build the full Collabora URL with WOPISrc as query parameter - collaboraFullURL := fmt.Sprintf("%s?WOPISrc=%s", editorURL, encodedWopiSrc) + // WOPISrc is passed unencoded in the query parameter + collaboraFullURL := fmt.Sprintf("%s?WOPISrc=%s", editorURL, wopiSrc) // Return HTML page with auto-submitting form - // The form POSTs to Collabora with access_token in the body - // WOPISrc must be in the URL as a query parameter + // No access_token needed in body since it's in WOPISrc htmlContent := fmt.Sprintf(` @@ -904,7 +900,6 @@ func collaboraProxyHandler(w http.ResponseWriter, r *http.Request, db *database.

Loading Collabora Online...

-`, collaboraFullURL, accessToken, collaboraFullURL) +`, collaboraFullURL, collaboraFullURL) w.Header().Set("Content-Type", "text/html; charset=utf-8") // Don't set X-Frame-Options - this endpoint is meant to be loaded in an iframe