[Bug]: External storage (WebDAV): weak ETags W/"..." are stored with a leftover quote, causing 412 Precondition Failed and conflict copies #66473

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

Title: External storage (WebDAV): weak ETags W/"..." are stored with a leftover quote, causing 412 Precondition Failed and conflict copies

Bug description

When a WebDAV external storage returns weak ETags (e.g. Apache mod_dav right after a write: W/"1ae3-65da9078143af"), lib/private/Files/Storage/DAV.php strips only the surrounding double quotes:

$etag = trim($response['{DAV:}getetag'], '"');
For a weak ETag this leaves W/"1ae3-65da9078143af (with a stray quote) in oc_filecache. Desktop clients that receive the file from the server then send an If-Match value that never equals the stored ETag. Every upload of that file fails with 412 Precondition Failed, and the client creates a new conflict copy on each attempt.

It affects files that one device writes and another device edits afterwards. Uploads that follow on the same device succeed.

Steps to reproduce

Mount a WebDAV external storage whose server returns weak ETags after writes (in our case, an Apache-based storage box).
Upload a file from device A (desktop client).
On device B, let the client download it, edit it and sync.
The upload from device B gets 412. The client creates a conflict copy. Retries fail the same way.
Expected behavior

Weak ETags are normalized (the W/ prefix and quotes removed) before they are stored and compared, so that uploads from other devices succeed.

Actual behavior

oc_filecache.etag contains W/"- (with a leftover quote). Uploads from other devices get 412 repeatedly.

Workaround / proposed fix

At both places in DAV.php where trim(..., '"') is applied to {DAV:}getetag (35.0.2: lines 927 and 1107), add:

if (str_starts_with($etag, 'W/"')) { $etag = substr($etag, 3); }
We have run this locally since 12.10.2026 (33.0.9, 34.0.4, 34.0.5, 35.0.2). It fixed the 412 loops; existing weak values in oc_filecache had to be normalized once. Since 34.0.5 the new daily code-integrity job (correctly) reports the patched file. A fix upstream would let us drop the local patch.

Similar normalization is proposed for the Android library in nextcloud/android-library#2139.

Installation method: Web installer / updater (archive) Nextcloud Server version: 35.0.2 (also seen on 33.0.9 and 34.0.4) Operating system: Ubuntu 24.04 PHP engine version: 8.3 Web server: Apache (mod_php) Database: MySQL 8.4 Additional info: external storage files_external, backend WebDAV, filesystem_check_changes = 0. Desktop clients 35.0.0 (macOS) and 35.0.1 (Windows).

Steps to reproduce

1.Mount a WebDAV external storage whose server returns weak ETags after writes (in our case, an Apache-based storage box).
Upload a file from device A (desktop client).
On device B, let the client download it, edit it and sync.
The upload from device B gets 412. The client creates a conflict copy. Retries fail the same way.
Expected behavior

Weak ETags are normalized (the W/ prefix and quotes removed) before they are stored and compared, so that uploads from other devices succeed.
2.
3.

Expected behavior

Weak ETags are normalized (the W/ prefix and quotes removed) before they are stored and compared, so that uploads from other devices succeed.

Nextcloud Server version

35

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response