Upload an attachment to a card API broken after updating to Nextcloud v33.0.5 & Deck v1.17.3 #8053

Activity

1. grnd-alt

   added

   bug

   needs info

   on Jun 15, 2026
2. grnd-alt commented on Jun 15, 2026

   

   grnd-alt

   on Jun 15, 2026

   Member

   More actions

   Hey thanks for reporting that. Could you please also share the request and response body, to check what exactly is going wrong? Thanks a lot.
3. user8446 commented on Jun 15, 2026

   

   user8446

   on Jun 15, 2026

   Author

   More actions

   Hi normally the server will respond with a message, but in this case no message, just HTTP/2 400. Here is the request and verbose output from cURL:

   curl --request POST --insecure --verbose --url "https://<redacted>/index.php/apps/deck/api/v1.1/boards/14/stacks/181/cards/1224/attachments" `
       --user "$APIKEY" `
       --header "OCS-APIRequest: true" `
       --header "Accept: application/json" `
       --form "file=@C:\Users\<redacted>\test.pdf" `
       --form "type=file"
   

   Note: Unnecessary use of -X or --request, POST is already inferred.
   *   Trying <redacted>...
   * ALPN: curl offers h2,http/1.1
   * TLSv1.3 (OUT), TLS handshake, Client hello (1):
   * SSL Trust: peer verification disabled
   * TLSv1.3 (IN), TLS handshake, Server hello (2):
   * TLSv1.3 (IN), TLS handshake, Unknown (8):
   * TLSv1.3 (IN), TLS handshake, Certificate (11):
   * TLSv1.3 (IN), TLS handshake, CERT verify (15):
   * TLSv1.3 (IN), TLS handshake, Finished (20):
   * TLSv1.3 (OUT), TLS handshake, Finished (20):
   * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / [blank] / UNDEF
   * ALPN: server accepted h2
   * Server certificate:
   *   subject: CN=*.<redacted>
   *   start date: May  9 06:20:49 2026 GMT
   *   expire date: Aug  7 06:20:48 2026 GMT
   *   issuer: C=US; O=Let's Encrypt; CN=E7
   *   Certificate level 0: Public key type ? (256/128 Bits/secBits), signed using ecdsa-with-SHA384
   *   Certificate level 1: Public key type ? (384/192 Bits/secBits), signed using ecdsa-with-SHA384
   * OpenSSL verify result: 14
   *  SSL certificate verification failed, continuing anyway!
   * Established connection to <redacted> (<redacted> port <redacted>) from 10.9.8.100 port 57980 
   * using HTTP/2
   * Server auth using Basic with user 'admin'
   * [HTTP/2] [1] OPENED stream for https://<redacted>/index.php/apps/deck/api/v1.1/boards/14/stacks/181/cards/1224/attachments
   * [HTTP/2] [1] [:method: POST]
   * [HTTP/2] [1] [:scheme: https]
   * [HTTP/2] [1] [:authority: <redacted>]
   * [HTTP/2] [1] [:path: /index.php/apps/deck/api/v1.1/boards/14/stacks/181/cards/1224/attachments]
   * [HTTP/2] [1] [authorization: Basic <redacted>]
   * [HTTP/2] [1] [user-agent: curl/8.20.0]
   * [HTTP/2] [1] [ocs-apirequest: true]
   * [HTTP/2] [1] [accept: application/json]
   * [HTTP/2] [1] [content-length: 6278]
   * [HTTP/2] [1] [content-type: multipart/form-data; boundary=------------------------2OalRU7IZ6WSfHBVSWrz6J]
   > POST /index.php/apps/deck/api/v1.1/boards/14/stacks/181/cards/1224/attachments HTTP/2
   > Host: <redacted>
   > Authorization: Basic <redacted>
   > User-Agent: curl/8.20.0
   > OCS-APIRequest: true
   > Accept: application/json
   > Content-Length: 6278
   > Content-Type: multipart/form-data; boundary=------------------------2OalRU7IZ6WSfHBVSWrz6J
   > 
   * upload completely sent off: 6278 bytes
   < HTTP/2 400 
   < date: Mon, 15 Jun 2026 13:30:15 GMT
   < server: Apache
   < x-request-id: 24lhUDxBaQ7sGnXRRwLl
   < cache-control: no-cache, no-store, must-revalidate
   < content-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
   < feature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
   < x-robots-tag: noindex, nofollow
   < x-user-id: admin
   < set-cookie: oc_sessionPassphrase=sMeHYaS8tLsMT%2BH%2FxKaIinyk06PTUknABSpYQqz396lRHLUpkOPvPGdaU79JRh4WK4douD06NTDgD7mJ9c8hs9Lwq%2FntQA1xJGIEKs1Zo%2Bxg9uYax%2BuO4UfuIIppj%2FQX; path=/; secure; HttpOnly; SameSite=Lax
   < set-cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
   < set-cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
   < set-cookie: ocqszvhqb1d8=tr98dtufcmalsg335bh5kf5l9r; path=/; secure; HttpOnly; SameSite=Lax
   < x-content-type-options: nosniff
   < x-frame-options: SAMEORIGIN
   < x-permitted-cross-domain-policies: none
   < referrer-policy: no-referrer
   < content-length: 0
   < content-type: text/html; charset=UTF-8
   < alt-svc: h3="<redacted>"; ma=86400
   < 
   * Connection #0 to host <redacted> left intact
   
   

   👀React with 👀1Reacted by pixeledi
4. user8446 commented on Jul 3, 2026

   

   user8446

   on Jul 3, 2026

   Last edited by user8446

   Author

   More actions

   Hi just reporting that I am now on deck v1.17.4 v1.18.2 and the issue still persists, thank you
5. Somebodyisnobody commented on Jul 17, 2026

   

   Somebodyisnobody

   on Jul 17, 2026

   Contributor

   More actions

   @grnd-alt please see also #8123 and the corresponding PR #8156
6. user8446

   closed this as completedon Jul 29, 2026