[Bug]: Prevent upload of file wih invalid characters via bulk upload

[mgallien]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• Nextcloud Server is running on 64bit capable CPU, PHP and OS.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Plain old wedav upload prevents uploading files with \ or / in their names.
Bulk upload does not prevent them but then they are improperly handled leading to the desktop client deleting files.

Steps to reproduce

1. Enable bulk upload
2. Connect a desktop client
3. Create a local file with such name test\hello.md
4. Wait for it to be uploaded
5. Sync again and see that the server is not reporting it as an existing file
6. Desktop client deletes the local file

Expected behavior

1. Enable bulk upload
2. Connect a desktop client
3. Create a local file with such name test\hello.md
4. Expect an error telling this file is not uploaded

Installation method

None

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

Enabled:
  - activity: 2.17.0
  - circles: 25.0.0
  - cloud_federation_api: 1.8.0
  - comments: 1.15.0
  - contactsinteraction: 1.6.0
  - dashboard: 7.5.0
  - dav: 1.24.0
  - federatedfilesharing: 1.15.0
  - federation: 1.15.0
  - files: 1.20.1
  - files_pdfviewer: 2.6.0
  - files_sharing: 1.17.0
  - files_trashbin: 1.15.0
  - files_versions: 1.18.0
  - lookup_server_connector: 1.13.0
  - notifications: 2.13.1
  - oauth2: 1.13.0
  - photos: 2.0.1
  - provisioning_api: 1.15.0
  - settings: 1.7.0
  - sharebymail: 1.15.0
  - support: 1.8.0
  - systemtags: 1.15.0
  - text: 3.6.0
  - theming: 2.0.1
  - twofactor_backupcodes: 1.14.0
  - updatenotification: 1.15.0
  - user_oidc: 1.3.1
  - user_status: 1.5.0
  - viewer: 1.9.0
  - weather_status: 1.5.0
  - workflowengine: 2.7.0
Disabled:
  - admin_audit
  - encryption
  - end_to_end_encryption
  - files_external
  - files_lock
  - groupfolders
  - spreed
  - testing
  - user_ldap

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

[mgallien]

@artonge

[szaimen]

Hi, which nc version?

[datenangebot]

Hi, which nc version?

Was tested at nc25

[Rello]

With the upcoming release of the desktop client (version 3.16.3), the bulk upload feature will be temporarily disabled.

We understand that some of you may rely on this feature, and this decision wasn't made lightly. However, we've encountered ongoing technical issues involving the interaction between the client, server, and underlying systems—including network stack and Qt dependencies—that impact the stability of the feature.

In prioritizing a smoother and more reliable experience for all users, we believe it's best to disable bulk upload for now. The overall benefit of the feature does not currently outweigh the potential for disruption.

If you're unable to update to version 3.16.3 right away, we recommend manually disabling the feature on the server side to avoid any issues:
🔧 How to disable bulk upload on the server →

We appreciate your understanding and are continuing to work on improving the experience.

nextcloud/desktop#8140