nextcloud/server · error · OCP\AppFramework\OCS\OCSForbiddenException

Permission denied to download file

Error message

Permission denied to download file

What it means

Error "Permission denied to download file" thrown in nextcloud/server.

Source

Thrown at apps/dav/lib/Controller/DirectController.php:86

		$file = $userFolder->getFirstNodeById($fileId);

		if (!$file) {
			throw new OCSNotFoundException();
		}

		if ($expirationTime <= 0 || $expirationTime > (60 * 60 * 24)) {
			throw new OCSBadRequestException('Expiration time should be greater than 0 and less than or equal to ' . (60 * 60 * 24));
		}

		if (!($file instanceof File)) {
			throw new OCSBadRequestException('Direct download only works for files');
		}

		$event = new BeforeDirectFileDownloadEvent($userFolder->getRelativePath($file->getPath()));
		$this->eventDispatcher->dispatchTyped($event);

		if ($event->isSuccessful() === false) {
			throw new OCSForbiddenException('Permission denied to download file');
		}

		//TODO: at some point we should use the directdownlaod function of storages
		$direct = new Direct();
		$direct->setUserId($this->userId);
		$direct->setFileId($fileId);

		$token = $this->random->generate(60, ISecureRandom::CHAR_ALPHANUMERIC);
		$direct->setToken($token);
		$direct->setExpiration($this->timeFactory->getTime() + $expirationTime);

		$this->mapper->insert($direct);

		$url = $this->urlGenerator->getAbsoluteURL('remote.php/direct/' . $token);

		return new DataResponse([
			'url' => $url,
		]);

View on GitHub (pinned to ecdeb153ff)

When it happens

Trigger: Thrown at apps/dav/lib/Controller/DirectController.php:86 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/9580e9ce9bb5f66f. Report an issue: GitHub.