From ea19f135defd5b7c4aa6061dcfed08358fcde0a9 Mon Sep 17 00:00:00 2001
From: Mohit Marathe <mohit.marathe@collabora.com>
Date: Tue, 26 Aug 2025 13:41:31 +0530
Subject: [PATCH 1/2] send wopiSettingBaseUrl to cool iframe

It will be used to fetch settings from the in-app settings dialog.

Signed-off-by: Mohit Marathe <mohit.marathe@collabora.com>
---
 src/view/Office.vue | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/view/Office.vue b/src/view/Office.vue
index 7dc430b922..da89ab2a24 100644
--- a/src/view/Office.vue
+++ b/src/view/Office.vue
@@ -55,6 +55,7 @@
 			<input name="theme" :value="formData.theme" type="hidden">
 			<input name="buy_product" value="https://nextcloud.com/pricing" type="hidden">
 			<input name="host_session_id" :value="formData.hostSessionID" type="hidden">
+			<input name="wopi_setting_base_url" :value="formData.wopiSettingBaseUrl" type="hidden">
 		</form>
 		<iframe :id="iframeId"
 			ref="documentFrame"
@@ -93,6 +94,7 @@ import { getRandomId } from '../helpers/index.js'
 import {
 	getNextcloudUrl,
 	getWopiUrl,
+	getConfigFileUrl,
 } from '../helpers/url.js'
 import PostMessageService from '../services/postMessage.tsx'
 import FilesAppIntegration from './FilesAppIntegration.js'
@@ -198,6 +200,7 @@ export default {
 				cssVariables: generateCSSVarTokens(),
 				theme: getCollaboraTheme(),
 				hostSessionID: 'nextcloud ' + OC.config.version + ' - richdocuments ' + getCapabilities().version,
+				wopiSettingBaseUrl: getConfigFileUrl(),
 			},
 		}
 	},

From cc10d8a8f4244f2ec6f58b622d0a6aec1b128d5c Mon Sep 17 00:00:00 2001
From: Mohit Marathe <mohit.marathe@collabora.com>
Date: Tue, 26 Aug 2025 13:44:38 +0530
Subject: [PATCH 2/2] wopi: allow to fetch settings from inside the document

using the accessToken created for loading office document.

Signed-off-by: Mohit Marathe <mohit.marathe@collabora.com>
---
 lib/Controller/WopiController.php | 2 +-
 lib/Middleware/WOPIMiddleware.php | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/Controller/WopiController.php b/lib/Controller/WopiController.php
index dbb8b62288..b473aec535 100644
--- a/lib/Controller/WopiController.php
+++ b/lib/Controller/WopiController.php
@@ -414,7 +414,7 @@ public function getSettings(string $type, string $access_token): JSONResponse {
 
 		try {
 			$wopi = $this->wopiMapper->getWopiForToken($access_token);
-			if ($wopi->getTokenType() !== Wopi::TOKEN_TYPE_SETTING_AUTH) {
+			if ($wopi->getTokenType() !== Wopi::TOKEN_TYPE_SETTING_AUTH && $wopi->getTokenType() !== Wopi::TOKEN_TYPE_USER) {
 				return new JSONResponse(['error' => 'Invalid token type'], Http::STATUS_BAD_REQUEST);
 			}
 
diff --git a/lib/Middleware/WOPIMiddleware.php b/lib/Middleware/WOPIMiddleware.php
index 26447dd4de..988698c740 100644
--- a/lib/Middleware/WOPIMiddleware.php
+++ b/lib/Middleware/WOPIMiddleware.php
@@ -63,7 +63,7 @@ public function beforeController($controller, $methodName) {
 			return;
 		}
 
-		if (str_contains($this->request->getRequestUri(), '/wopi/settings/upload')) {
+		if (str_contains($this->request->getRequestUri(), '/wopi/settings')) {
 			return;
 		}