403 error when loading thumbnail for shared document (non-owner user)

[thomas-zic]

Describe the bug

I am encountering an issue with LibreSign where a user cannot see the document thumbnail when the document is shared with them. The thumbnail request fails with a 403 error, while the document owner can see it without any issue.

To reproduce

Steps to reproduce
User A uploads a document and creates a LibreSign request
User A shares the document with User B (or adds User B as a participant)
User B logs into Nextcloud
User B tries to view the document list (LibreSign interface)
The thumbnail is not displayed for User B

Actual behavior
The browser console shows a 403 error on the thumbnail endpoint:
/ocs/v2.php/apps/libresign/api/v1/file/thumbnail/<file_id>?x=128&y=128&mimeFallback=true&a=1

Additional observations
The document itself is accessible in Nextcloud Files for User B
The issue seems specific to LibreSign API permissions
The owner (User A) can see the thumbnail without any problem
The error consistently returns HTTP 403 (forbidden), not 404

Expected behavior

User B (who has access to the document) should be able to see the thumbnail just like User A.

Screenshots

No response

Environment information

Nextcloud version: 32
LibreSign version: 12.4.2
Deployment: Docker

Additional context

No response

[vitormattos]

Hello @thomas-zic !

This issue has now been fixed in PR #7539 and the fix will be included in the next release.

Your report helped us identify an access-control problem in LibreSign’s thumbnail endpoint for documents visible to signers/non-owner participants. We adjusted the thumbnail access flow so authorized signer users can load previews correctly, and we also added regression coverage to help prevent this from happening again.

Thank you for the clear report and reproduction steps. If LibreSign is useful to you or your organization, please consider becoming a recurring supporter of the project. Ongoing funding is what allows us to keep maintaining fixes like this and continue long-term development.

If you would also like to help, starring the repository and leaving a review on the Nextcloud App Store is always appreciated

[thomas-zic]

Hello @vitormattos, I updated to version 12.4.4, but the thumbnail request still fails. Maybe the fix hasn't been released yet? If not, when will it be?

[vitormattos]

I reopened the issue and will investigate further. Could you check your nextcloud.log during the process and extract any entries related to LibreSign, or any other entries that might be related to this scenario?

[thomas-zic]

I deleted all the previous documents and tried to add the requested new document; the thumbnail appears.
So I think that if a document was requested before the update, the problem must still exist.
Sorry, but since I no longer have the old requests without thumbnails, I no longer see the error in the logs.

[vitormattos]

Sounds like cached old thumbnails.
Can we consider this issue resolved?

[thomas-zic]

I think so; if it happens again, I'll report the bug again. Thanks !!