Action_InsertGraphic does not seem to work anymore with 25.04. releases

[rhafer]

Describe the Bug

We're trying to get the Action_InsertGraphic feature working between OpenCloud and Collabora Online and while we hat some success with "older" Collabora releases (e.g. 24.04.8.x still seem to work). We're unable to get it working with the latest release.

Steps to Reproduce

Our work is still in progress. So reproducing requires some yet unmerged code mainly: opencloud-eu/opencloud#1191 and opencloud-eu/web#924. (Collabora is configured to allow downloads from the OpenCloud instance by adding it to net.lok_allow in coolwsd.xml.

1. Go to 'Insert' -> 'Insert Image'
2. Select an image in the OpenCloud File Picking popup
3. Nothing happens

Expected Behavior

The image is inserted into the opened document.

Actual Behavior

Nothing visible happens

Additional Context

When enabling addition logging via:

<lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav</lokit_sal_log>

With 25.04.x The only thing I get in the collabora logs is:

2025-07-10:14:27:17.325:info:ucb.ucp.webdav:22:42:ucb/source/ucp/webdav-curl/webdavcontent.cxx:435: >>>>> Content::execute: start: command: open, env: present

With the 24.04.8.x release where the feature is working for us I get much more:

2025-07-10:14:30:15.200:info:ucb.ucp.webdav:28:42:ucb/source/ucp/webdav-curl/webdavcontent.cxx:436: >>>>> Content::execute: start: command: open, env: present
2025-07-10:14:30:15.200:info:ucb.ucp.webdav.curl:28:42:include/systools/curlinit.hxx:76: curl version: 8.10.1 x86_64-pc-linux-gnu features: 512e439d ssl: OpenSSL/3.0.15 libz: 1.2.13
2025-07-10:14:30:15.200:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:1511: OPTIONS: /remote.php/dav/spaces/08c8eb8d-fc28-4e99-b7ae-d562d5872313$d0a7bb53-78dd-418e-84e7-d84cf365f1cc/heic0205_450.jpg?oc-jwt-sig=eyJhbGciOiJIUzI1NiI...
2025-07-10:14:30:15.201:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: Host cloud.opencloud.test:443 was resolved.

2025-07-10:14:30:15.201:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: IPv6: (none)

2025-07-10:14:30:15.201:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: IPv4: 10.89.2.2

2025-07-10:14:30:15.201:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0:   Trying 10.89.2.2:443...

2025-07-10:14:30:15.202:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: ALPN: curl offers http/1.1

2025-07-10:14:30:15.203:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_OUT 5
2025-07-10:14:30:15.203:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: TLSv1.3 (OUT), TLS handshake, Client hello (1):

2025-07-10:14:30:15.203:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_OUT 512
2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0:  CAfile: /etc/ssl/certs/ca-certificates.crt

2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0:  CApath: /tmp/user/docs/p5BBXvlYVIniSaIt/New file.odt.certs

2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 5
2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: TLSv1.3 (IN), TLS handshake, Server hello (2):

2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 122
2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 5
2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 5
2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 1
2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):

2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 21
2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 5
2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 1
2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: TLSv1.3 (IN), TLS handshake, Certificate (11):

2025-07-10:14:30:15.220:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 879
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 5
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 1
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: TLSv1.3 (IN), TLS handshake, CERT verify (15):

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 264
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 5
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 1
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: TLSv1.3 (IN), TLS handshake, Finished (20):

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_IN 36
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_OUT 5
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_OUT 1
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_OUT 5
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_OUT 1
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: TLSv1.3 (OUT), TLS handshake, Finished (20):

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:325: debug log: 0x7f5a58006af0: CURLINFO_SSL_DATA_OUT 36
2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519 / RSASSA-PSS

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: ALPN: server accepted http/1.1

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: Server certificate:

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0:  subject: CN=TRAEFIK DEFAULT CERT

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0:  start date: Jul 10 14:29:25 2025 GMT

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0:  expire date: Jul 10 14:29:25 2026 GMT

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0:  subjectAltName does not match hostname cloud.opencloud.test

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: SSL: no alternative certificate subject name matches target hostname 'cloud.opencloud.test'

2025-07-10:14:30:15.221:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:286: debug log: 0x7f5a58006af0: closing connection #0

2025-07-10:14:30:15.222:warn:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:936: curl_easy_perform failed: (60) SSL: no alternative certificate subject name matches target hostname 'cloud.opencloud.test'
2025-07-10:14:30:15.222:info:ucb.ucp.webdav.curl:28:42:ucb/source/ucp/webdav-curl/CurlSession.cxx:1324: DAVException; (first) 0 bytes of data received:
2025-07-10:14:30:15.222:warn:ucb.ucp.webdav:28:42:ucb/source/ucp/webdav-curl/webdavcontent.cxx:4058: OPTIONS - DAVException: DAV_HTTP_TIMEOUT or DAV_HTTP_CONNECT for URL <https://cloud.opencloud.test/

[meven]

It seems to be a case where the SSL server certificate uses doesn't match its hostname cloud.opencloud.test.

https://stackoverflow.com/questions/20842970/curl-fix-curl-51-ssl-error-no-alternative-certificate-subject-name-matches

[rhafer]

@meven Thanks for the hint. We fixed the certificate issue and got the feature working with the 24.04.8.x release. But even with fixed certificates the newer releases are still not working and we just get that

2025-07-10:14:27:17.325:info:ucb.ucp.webdav:22:42:ucb/source/ucp/webdav-curl/webdavcontent.cxx:435: >>>>> Content::execute: start: command: open, env: present

line in the logs.

[rhafer]

Update: I did some more digging here. And it seems the issue is somehow related to podman. Lauching my stack in docker the Action_InsertGraphic thing is working just fine.

I still haven't found what exactly the problem is with podman yet (I can't get it to work there neither rootless nor rootful), but something seems to prevent the image download, I don't even see a request going out.

[meven]

Update: I did some more digging here. And it seems the issue is somehow related to podman. Lauching my stack in docker the Action_InsertGraphic thing is working just fine.

I still haven't found what exactly the problem is with podman yet (I can't get it to work there neither rootless nor rootful), but something seems to prevent the image download, I don't even see a request going out.

Could you share the complete (from the container start) collabora online logs when this fail in podman.
With logging to debug https://sdk.collaboraonline.com/docs/installation/Configuration.html#logging

[kulmann]

Another update: I've tried collabora/code:25.04.7.1.1 and it worked with self signed certificates in docker for Mac.

I did not test on podman. @rhafer Could you try it on podman? CODE was bumped to this version in the opencloud compose repo today.