[Bug]: "More than 1000 expressions in a list are not allowed on Oracle" in SyncLivePhotosListener::handleCacheEntriesRemovedEvent

[Marfix78]

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

When a large number of file cache entries (>1000) are removed at once during a folder rescan (e.g. triggered by a desktop client PROPFIND/sync on a folder with more than 1000 files), SyncLivePhotosListener::handleCacheEntriesRemovedEvent() collects all removed file IDs and passes them in a single call to LivePhotosService::getLivePhotoPeerIds(), which builds a single WHERE file_id IN (...) query via FilesMetadataManager::getMetadataForFiles() / MetadataRequestService::getMetadataFromFileIds().

This query is not chunked, so when more than 1000 file IDs are passed, Doctrine's QueryBuilder throws:

Doctrine\DBAL\Query\QueryException: More than 1000 expressions in a list are not allowed on Oracle.

This safety check is enforced by Doctrine regardless of the actual database in use — it happened on MySQL/MariaDB in my case, not Oracle.

This is the same long-standing class of bug already reported and fixed in other parts of the codebase for the same reason (unchunked IN() clauses), e.g. #28960, #41605, #26493, nextcloud/activity#1384, nextcloud/tables#1061 — but this specific occurrence in SyncLivePhotosListener/LivePhotosService::getLivePhotoPeerIds() does not appear to have been reported yet.

Unlike a purely cosmetic log error, the exception here is not caught: it propagates all the way up through Scanner::scan(), View::getCacheEntry(), and the Sabre DAV server, causing the PROPFIND request itself to fail — so the desktop client sync for the affected folder likely fails too.

Root cause

apps/files/lib/Listener/SyncLivePhotosListener.php, method handleCacheEntriesRemovedEvent():

​```php
public function handleCacheEntriesRemovedEvent(CacheEntriesRemovedEvent $cacheEntriesRemovedEvent): void {
$entries = $cacheEntriesRemovedEvent->getCacheEntryRemovedEvents();
$fileIds = [];
foreach ($entries as $entry) {
$fileIds[] = $entry->getFileId();
}

$peerFileIds = $this->livePhotosService->getLivePhotoPeerIds($fileIds); // <-- no chunking
...

}
​```

getLivePhotoPeerIds() ends up calling FilesMetadataManager::getMetadataForFiles() → MetadataRequestService::getMetadataFromFileIds(), which builds:

​sql SELECT file_id, json, sync_token FROM oc_files_metadata WHERE file_id IN (:dcValue1) ​

with the full, unchunked $fileIds array bound as a single parameter list.

Suggested fix

Chunk $fileIds (e.g. array_chunk($fileIds, 1000)) before calling getLivePhotoPeerIds(), or chunk inside MetadataRequestService::getMetadataFromFileIds() itself, consistent with how this was fixed in other parts of the codebase for the same underlying issue.

Steps to reproduce

1. Have a folder containing more than 1000 files.
2. Trigger a folder rescan/cache invalidation for that folder that removes more than 1000 cache entries at once (e.g. via desktop client sync, or occ files:scan on a large folder).
3. Observe the exception in nextcloud.log, and the PROPFIND request failing for the desktop client.

Expected behavior

Folders with more than 1000 files should sync/rescan without errors, regardless of whether Live Photos are involved.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

{"reqId":"2PvoruxVNMJ92Tg6lvvM","level":3,"time":"2026-09-21T10:54:28+00:00","remoteAddr":"192.168.100.19","user":"E964D18D-9AF6-483F-8970-6AA426B704CF","app":"core","method":"PROPFIND","url":"/remote.php/dav/files/E964D18D-9AF6-483F-8970-6AA426B704CF/Tecnico/MFP","scriptName":"/remote.php","message":"More than 1000 expressions in a list are not allowed on Oracle.","userAgent":"Mozilla/5.0 (Windows) mirall/34.0.4 (build 20260916) (Nextcloud, windows-10.0.26200 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"34.0.4.1","clientReqId":"6e7a8d54-de23-4020-b30d-17b74f2e3d3f","exception":{"Exception":"Doctrine\\DBAL\\Query\\QueryException","Message":"More than 1000 expressions in a list are not allowed on Oracle.","Code":0,"Trace":[{"file":"/var/www/html/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","line":256,"function":"prepareForExecute","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/FilesMetadata/Service/MetadataRequestService.php","line":117,"function":"executeQuery","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/FilesMetadata/FilesMetadataManager.php","line":150,"function":"getMetadataFromFileIds","class":"OC\\FilesMetadata\\Service\\MetadataRequestService","type":"->"},{"file":"/var/www/html/nextcloud/apps/files/lib/Service/LivePhotosService.php","line":43,"function":"getMetadataForFiles","class":"OC\\FilesMetadata\\FilesMetadataManager","type":"->"},{"file":"/var/www/html/nextcloud/apps/files/lib/Listener/SyncLivePhotosListener.php","line":98,"function":"getLivePhotoPeerIds","class":"OCA\\Files\\Service\\LivePhotosService","type":"->"},{"file":"/var/www/html/nextcloud/apps/files/lib/Listener/SyncLivePhotosListener.php","line":68,"function":"handleCacheEntriesRemovedEvent","class":"OCA\\Files\\Listener\\SyncLivePhotosListener","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php","line":57,"function":"handle","class":"OCA\\Files\\Listener\\SyncLivePhotosListener","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":220,"function":"__invoke","class":"OC\\EventDispatcher\\ServiceEventListener","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":56,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":73,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":86,"function":"dispatch","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/Cache/Cache.php","line":693,"function":"dispatchTyped","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/Cache/Cache.php","line":605,"function":"removeChildren","class":"OC\\Files\\Cache\\Cache","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/Cache/Scanner.php","line":246,"function":"remove","class":"OC\\Files\\Cache\\Cache","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/Cache/Scanner.php","line":523,"function":"removeFromCache","class":"OC\\Files\\Cache\\Scanner","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/Cache/Scanner.php","line":405,"function":"handleChildren","class":"OC\\Files\\Cache\\Scanner","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/Cache/Scanner.php","line":314,"function":"scanChildren","class":"OC\\Files\\Cache\\Scanner","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/View.php","line":1409,"function":"scan","class":"OC\\Files\\Cache\\Scanner","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/View.php","line":1453,"function":"getCacheEntry","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/Node/Root.php","line":149,"function":"getFileInfo","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/Node/LazyFolder.php","line":141,"function":"get","class":"OC\\Files\\Node\\Root","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Files/Node/Folder.php","line":115,"function":"get","class":"OC\\Files\\Node\\LazyFolder","type":"->"},{"file":"/var/www/html/nextcloud/apps/dav/lib/Connector/Sabre/Directory.php","line":540,"function":"get","class":"OC\\Files\\Node\\Folder","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php","line":86,"function":"getNodeForPath","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":971,"function":"getNodeForPath","class":"Sabre\\DAV\\Tree","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":1664,"function":"getPropertiesIteratorForPath","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":1649,"function":"writeMultiStatus","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":346,"function":"generateMultiStatus","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpPropFind","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/apps/dav/lib/Connector/Sabre/Server.php","line":215,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/apps/dav/lib/Server.php","line":434,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php","line":25,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/remote.php","line":152,"args":["/var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/html/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","Line":232,"message":"More than 1000 expressions in a list are not allowed on Oracle.","query":"SELECT `file_id`, `json`, `sync_token` FROM `*PREFIX*files_metadata` WHERE `file_id` IN (:dcValue1)","exception":"{\"class\":\"Doctrine\\DBAL\\Query\\QueryException\",\"message\":\"More than 1000 expressions in a list are not allowed on Oracle.\",\"code\":0,\"file\":\"/var/www/html/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php:232\",\"trace\":\"#0 /var/www/html/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php(256): OC\\DB\\QueryBuilder\\QueryBuilder->prepareForExecute()\\n#1 /var/www/html/nextcloud/lib/private/FilesMetadata/Service/MetadataRequestService.php(117): OC\\DB\\QueryBuilder\\QueryBuilder->executeQuery()\\n#2 /var/www/html/nextcloud/lib/private/FilesMetadata/FilesMetadataManager.php(150): OC\\FilesMetadata\\Service\\MetadataRequestService->getMetadataFromFileIds()\\n#3 /var/www/html/nextcloud/apps/files/lib/Service/LivePhotosService.php(43): OC\\FilesMetadata\\FilesMetadataManager->getMetadataForFiles()\\n#4 /var/www/html/nextcloud/apps/files/lib/Listener/SyncLivePhotosListener.php(98): OCA\\Files\\Service\\LivePhotosService->getLivePhotoPeerIds()\\n#5 /var/www/html/nextcloud/apps/files/lib/Listener/SyncLivePhotosListener.php(68): OCA\\Files\\Listener\\SyncLivePhotosListener->handleCacheEntriesRemovedEvent()\\n#6 /var/www/html/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php(57): OCA\\Files\\Listener\\SyncLivePhotosListener->handle()\\n#7 /var/www/html/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php(220): OC\\EventDispatcher\\ServiceEventListener->__invoke()\\n#8 /var/www/html/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php(56): Symfony\\Component\\EventDispatcher\\EventDispatcher->callListeners()\\n#9 /var/www/html/nextcloud/lib/private/EventDispatcher/EventDispatcher.php(73): Symfony\\Component\\EventDispatcher\\EventDispatcher->dispatch()\\n#10 /var/www/html/nextcloud/lib/private/EventDispatcher/EventDispatcher.php(86): OC\\EventDispatcher\\EventDispatcher->dispatch()\\n#11 /var/www/html/nextcloud/lib/private/Files/Cache/Cache.php(693): OC\\EventDispatcher\\EventDispatcher->dispatchTyped()\\n#12 /var/www/html/nextcloud/lib/private/Files/Cache/Cache.php(605): OC\\Files\\Cache\\Cache->removeChildren()\\n#13 /var/www/html/nextcloud/lib/private/Files/Cache/Scanner.php(246): OC\\Files\\Cache\\Cache->remove()\\n#14 /var/www/html/nextcloud/lib/private/Files/Cache/Scanner.php(523): OC\\Files\\Cache\\Scanner->removeFromCache()\\n#15 /var/www/html/nextcloud/lib/private/Files/Cache/Scanner.php(405): OC\\Files\\Cache\\Scanner->handleChildren()\\n#16 /var/www/html/nextcloud/lib/private/Files/Cache/Scanner.php(314): OC\\Files\\Cache\\Scanner->scanChildren()\\n#17 /var/www/html/nextcloud/lib/private/Files/View.php(1409): OC\\Files\\Cache\\Scanner->scan()\\n#18 /var/www/html/nextcloud/lib/private/Files/View.php(1453): OC\\Files\\View->getCacheEntry()\\n#19 /var/www/html/nextcloud/lib/private/Files/Node/Root.php(149): OC\\Files\\View->getFileInfo()\\n#20 /var/www/html/nextcloud/lib/private/Files/Node/LazyFolder.php(141): OC\\Files\\Node\\Root->get()\\n#21 /var/www/html/nextcloud/lib/private/Files/Node/Folder.php(115): OC\\Files\\Node\\LazyFolder->get()\\n#22 /var/www/html/nextcloud/apps/dav/lib/Connector/Sabre/Directory.php(540): OC\\Files\\Node\\Folder->get()\\n#23 /var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php(86): OCA\\DAV\\Connector\\Sabre\\Directory->getNodeForPath()\\n#24 /var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php(971): Sabre\\DAV\\Tree->getNodeForPath()\\n#25 /var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php(1664): Sabre\\DAV\\Server->getPropertiesIteratorForPath()\\n#26 /var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php(1649): Sabre\\DAV\\Server->writeMultiStatus()\\n#27 /var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php(346): Sabre\\DAV\\Server->generateMultiStatus()\\n#28 /var/www/html/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\CorePlugin->httpPropFind()\\n#29 /var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php(472): Sabre\\DAV\\Server->emit()\\n#30 /var/www/html/nextcloud/apps/dav/lib/Connector/Sabre/Server.php(215): Sabre\\DAV\\Server->invokeMethod()\\n#31 /var/www/html/nextcloud/apps/dav/lib/Server.php(434): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#32 /var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php(25): OCA\\DAV\\Server->exec()\\n#33 /var/www/html/nextcloud/remote.php(152): require_once('...')\\n#34 {main}\"}","CustomMessage":"More than 1000 expressions in a list are not allowed on Oracle."},"id":"6ab2a19f0872a"}

Additional info

No response

[solracsf]

Another trigger for this: the final assembly step of a chunked upload.

A 100 GiB file uploaded with chunked upload v2 at the default 100 MiB chunk size creates 1024 chunks. When MOVE .file assembles them, the chunk directory's cache entries are removed at once, so handleCacheEntriesRemovedEvent() receives 1024 file ids and hits the same unchunked IN list.

Nextcloud 35.0.0 (nextcloud:fpm), MariaDB 11.8, PHP 8.4, local storage, no Live Photos on the instance:

{"reqId":"Iz19ylYqNq1zHgX00Vel","level":3,"time":"2026-09-22T19:22:21+00:00","user":"admin",
 "app":"core","method":"MOVE","url":"/remote.php/dav/uploads/admin/bigtest-1790079129-1821/.file",
 "message":"More than 1000 expressions in a list are not allowed on Oracle.",
 "version":"35.0.0.10"}

Same trace: MetadataRequestService::getMetadataFromFileIds <- FilesMetadataManager::getMetadataForFiles <- LivePhotosService::getLivePhotoPeerIds <- SyncLivePhotosListener::handleCacheEntriesRemovedEvent.

Unlike the PROPFIND case, the request did not fail here: both of my 100 GiB uploads got 201 from the MOVE and the assembled files were byte-identical to the source, so on this path it only shows up as a logged error.

To reproduce, upload a file larger than ~97 GiB through chunked upload v2 (or lower files.chunked_upload.max_size so a smaller file exceeds 1000 chunks) and watch the log during the final MOVE .file.

Uploads may use up to 10000 chunks, so anything over 1000 chunks goes through this regardless of Live Photos. Chunking at IQueryBuilder::MAX_IN_PARAMETERS inside MetadataRequestService::getMetadataFromFileIds() rather than only at the caller would cover both paths, as #63887 suggests.