Per-share CSP (Edit CSP) is saved but never delivered — the default fallback CSP is always served

[damanti-me]

Summary

Setting a per-share Content-Security-Policy via the Files sidebar ("Edit CSP") appears to save
successfully and persists, but raw responses still carry the hardcoded strict default CSP
instead of the configured override. As a result, media files served via /raw/{token} are
blocked by media-src data: and do not play in mobile browsers (Safari/Chrome).

Environment

• Nextcloud core: 33.0.7 (status.php reports version: "33.0.7.1")
• App: files_sharing_raw (0.7.1)
• Hosting: managed instance, no access to config/ — relying on the DB-backed per-share CSP feature
• Root-URL alias active (/raw/{token} canonical; /apps/files_sharing_raw/{token} returns 307 to it)

Steps to reproduce

1. Create a public share for a folder (or a single file) and enable "Enable raw link".
2. In the Files sidebar, open the ⋯ menu next to the raw link row → Edit CSP and
   select the "Audio / Video" preset (default-src 'none'; media-src 'self' data: blob:; ...), then Save.
3. Confirm the value persists: reopening "Edit CSP" still shows the audio policy (it does not revert).
4. Request a raw file:

   curl -I "https://host/raw/{token}/path/to/file.mp3"
   

Expected behavior

The Content-Security-Policy response header reflects the stored per-share override, e.g.:

Content-Security-Policy: default-src 'none'; media-src 'self' data: blob:; img-src 'self' data:; form-action 'none'

Actual behavior

The response always carries the hardcoded fallback CSP (regardless of the saved override, and
also on a single-file share):

Content-Security-Policy: sandbox; default-src 'none'; style-src data: 'unsafe-inline'; img-src data:; media-src data:; font-src data:; frame-src data:

Verified by copying the header directly from the response; no upstream proxy/cache is in front
(no Via/Age/X-Cache), and appending a cache-buster query string does not change it.

Impact

• Audio/video files are refused by mobile browsers: Safari reports
  “Refused to load … because it does not appear in the media-src directive of the Content Security Policy”
  and shows a spinner instead of a player (media downloads to disk on other clients).
• The DB-backed per-share CSP feature (the only option on managed hosting without shell access)
  is effectively non-functional.

[ernolf]

@damanti-me,

thank you, your report was accurate. The CSP was stored and served correctly, but clicking "Update share" afterwards sent an update without the CSP field, which overwrote the stored value.

Fixed with #54, please update to 0.7.2