TypeError when guest users access public shares in same browser session

[hweihwang]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

1. Create a guest account (e.g., Guest1)
2. As a regular user, share some files with the guest account
3. As the same regular user, create a public share link for a .txt file with "Hide download" enabled and "Custom permissions = Read"
4. In a browser window, log in to Nextcloud with the guest account (Guest1)
5. You see the files/folders shared by the regular user
6. In the same browser window but in a new tab, open the public link previously created
7. Check the Nextcloud logs for errors

Expected behaviour

The public share should load normally, displaying the shared file content even when accessed by a logged-in guest user in the same browser session.

Actual behaviour

A TypeError is thrown and the public share fails to load. The file content is not displayed and errors appear in the Nextcloud logs.

Error message:

OCA\Guests\FilteredNavigationManager::__construct(): Argument #1 ($user) must be of type OCP\IUser, null given, called in /data/nextcloud/apps/guests/lib/RestrictionManager.php on line 92

Server configuration

Web server: Apache/Nginx

Database: MySQL/Maria/SQLite/PostgreSQL

PHP version: 8.1/8.2/8.3

Nextcloud version: 31.0.7 Enterprise (affects other versions)

List of activated apps

Guests app must be enabled for this issue to occur.
Run: sudo -u www-data php occ app:list

Nextcloud configuration

Standard configuration with Guests app enabled.
Run: sudo -u www-data php occ config:list system

Nextcloud logs

{"reqId":"wu3PYjFSVQC04R70xg39","level":3,"time":"2025-07-13T01:17:15+02:00","remoteAddr":"x.x.x.x","user":"--","app":"public","method":"PROPFIND","url":"/public.php/dav/files/9MNwF4GiXKrKWLJ","message":"OCA\\Guests\\FilteredNavigationManager::__construct(): Argument #1 ($user) must be of type OCP\\IUser, null given, called in /data/nextcloud/apps/guests/lib/RestrictionManager.php on line 92","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0","version":"31.0.7.2","exception":{"Exception":"TypeError","Message":"OCA\\Guests\\FilteredNavigationManager::__construct(): Argument #1 ($user) must be of type OCP\\IUser, null given, called in /data/nextcloud/apps/guests/lib/RestrictionManager.php on line 92","Code":0,"Trace":[{"file":"/data/nextcloud/apps/guests/lib/RestrictionManager.php","line":92,"function":"__construct","class":"OCA\\Guests\\FilteredNavigationManager","type":"->"}],"File":"/data/nextcloud/apps/guests/lib/FilteredNavigationManager.php","Line":23}}

Browser

Browser name: Chrome/Firefox/Safari/Edge

Browser version: Any recent version

Operating system: Windows/Ubuntu/Mac

Browser log

No specific browser errors - the issue occurs server-side during public share access.
Network requests to public share URLs may show 500 Internal Server Error responses.

Root Cause Analysis

This issue occurs due to a timing problem in the Guests app's service registration:

1. When a guest user logs in, the Guests app registers filtered services including FilteredNavigationManager
2. When accessing a public share, Nextcloud activates incognito mode (\OC_User::setIncognitoMode(true))
3. This causes $this->userSession->getUser() to return null during service instantiation
4. The FilteredNavigationManager constructor expects an IUser object but receives null

Problematic code in apps/guests/lib/RestrictionManager.php:

$this->server->registerService(INavigationManager::class, function () use ($navManager) {
    return new FilteredNavigationManager($this->userSession->getUser(), $navManager, $this->whitelist);
    //                                   ^^^ Returns null due to incognito mode
});

[skjnldsv]

This line have been added 7 years ago, I'm surprised this wan't caught sooner 🙈

[skjnldsv]

If you can @hweihwang , please try the fix from #1364

[kesselb]

This line have been added 7 years ago, I'm surprised this wan't caught sooner 🙈

I'm also surprised ;)

I cannot replicate the problem dev system as https://github.com/nextcloud/server/blob/eaae5e16d8303f5ac0f940cd93c712a4bf080ecc/public.php#L76 already boots the guest app and then we still have the session because setIncognitoMode is called a few lines later 🤷

[kesselb]

Got the feedback that the patch resolves the problem.

@skjnldsv Could you release a new version including the patch when time allows?

[skjnldsv]

yes