Nextcloud 12 doesn't work with chrome

[Dozecloud-llc]

Refused to load the script 'https://dozedrive.techpit.us/core,_search,_js,_search.js,qv==80f72f4212eec4…tion.js,qv==80f72f4212eec4a1f56eff63f8aa298b-46.pagespeed.jc.Sn9iowbSyz.js' because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'".

login:26 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-2Cuv3nOdurf4U1Cd0NldZ1tPEhZya7NRRyF+4Xz+q9Q='), or a nonce ('nonce-...') is required to enable inline execution.

login:27 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-b0pxxigGB/snH5pQj+cPR1OnFibawhGLFB6IkVwS6l8='), or a nonce ('nonce-...') is required to enable inline execution.

login:1 Refused to load the script 'https://dozedrive.techpit.us/apps,_files_pdfviewer,_js,_previewplugin.js,qv…46+index.php,_apps,_theming,_js,_theming,qv==46.pagespeed.jc.5kWWNObvXf.js' because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'".

login:29 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-bsHfbfnPi20zFfTMVzoOw39swT8SbwsdLR9w7DiIHfw='), or a nonce ('nonce-...') is required to enable inline execution.

login:30 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-p9x0hJBRZ2vfQ5Wcj3Ong1EdTwxdya+poUuMsCbFPWA='), or a nonce ('nonce-...') is required to enable inline execution.

login:31 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-gViXNGZqMLb1LScnLbR88TIzsDohzD+LqwxL83GRFPI='), or a nonce ('nonce-...') is required to enable inline execution.

login:32 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-4aAQ0gNoUF+GW6VDZJ9zF2GHzgrr2d33hm3//II8UQw='), or a nonce ('nonce-...') is required to enable inline execution.

login:33 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-mLs4teBps7KjIdY6Y+Zkr/xwzcBPt0k0Zw8UCSfhV04='), or a nonce ('nonce-...') is required to enable inline execution.

login:34 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-cAcXIUlRNVXPfD2BlzQkPtmV8uCDAx01akmULJHQv90='), or a nonce ('nonce-...') is required to enable inline execution.

login:35 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-O9AdL7HKNMft3iCqONfcWNqu5krO6xrzqP+4qCPhKto='), or a nonce ('nonce-...') is required to enable inline execution.

login:36 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-QFhanWbkYRPrTGi78hAdgFVHCtd+gKPOSEJK2//jCKg='), or a nonce ('nonce-...') is required to enable inline execution.

login:37 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-IC5BzwMGdz5Gv7xwqfvtWBP/ct51B48djooQ9CIv3aQ='), or a nonce ('nonce-...') is required to enable inline execution.

login:52 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-dShTB36WWaMdLDg/zwxd+8duyJ2GNLxe2469kXrXRb8='), or a nonce ('nonce-...') is required to enable inline execution.

merged-template-prepend.js,qv=80f72f4212eec4a1f56eff63f8aa298b-46.pagespeed.jm.OoY56xJxXE.js:1 Uncaught TypeError: OC.ContactsMenu is not a constructor
at setupContactsMenu (merged-template-prepend.js,qv=80f72f4212eec4a1f56eff63f8aa298b-46.pagespeed.jm.OoY56xJxXE.js:1)
at HTMLDocument.initCore (merged-template-prepend.js,qv=80f72f4212eec4a1f56eff63f8aa298b-46.pagespeed.jm.OoY56xJxXE.js:1)
at j (core.js,qv=80f72f4212eec4a1f56eff63f8aa298b-46.pagespeed.jm.BpE2vgi7cB.js:1)
at Object.fireWith [as resolveWith] (core.js,qv=80f72f4212eec4a1f56eff63f8aa298b-46.pagespeed.jm.BpE2vgi7cB.js:1)
at Function.ready (core.js,qv=80f72f4212eec4a1f56eff63f8aa298b-46.pagespeed.jm.BpE2vgi7cB.js:1)
at HTMLDocument.I (core.js,qv=80f72f4212eec4a1f56eff63f8aa298b-46.pagespeed.jm.BpE2vgi7cB.js:1)
login:54 Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.

login:64 Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'nonce-NGE0UmxDcWZ4d1hSYWJseUFONTVla1drblBxbXpKdmZsdXNiMkVzV2t0QT06aXNwZzl4UFlxVTYvSVAwUWRvZ2VQd0hsM3JQTnRNbUw1SzhyODM1OC91RT0=' 'unsafe-eval'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.

[milgner]

@jsargent7089 I just encountered the same issue. What did you to to fix it?

[yanyixing]

same issue

[milgner]

@yanyixing I don't know why but it also disappeared for me. I did not change anything but when I opened the web UI next time, it worked without a problem again.

[ghost]

This is happening to me, exactly as described by the OP. I can't login, clicking the login button does nothing. I am using the nginx configuration supplied in your documentation (the config to serve Nextcloud from a subdirectory). I disabled nginx pagespeed module in my Nextcloud nginx config and restarted Nginx, but that hasn't resolved the issue.

It looks like inline scripts are being blocked by Chrome. The weird this is, I don't have Content-Security-Policy header set anywhere in nginx, I have no idea why Chrome is complaining about it. I take it this is an nginx configuration issue, but I'm stumped. The 6 other web apps I am running, ownCloud included, run fine, with no errors in the dev console (3 of which are PHP-based).

Uncaught TypeError: OC.ContactsMenu is not a constructor
at setupContactsMenu (https://nmda.co/nextcloud/js/core/merged-template-prepend.js?v=9bcc7ed9c2dc18f14074cb38bb4c3dc7-0:2630:3)
at HTMLDocument.initCore (https://nmda.co/nextcloud/js/core/merged-template-prepend.js?v=9bcc7ed9c2dc18f14074cb38bb4c3dc7-0:2638:2)
at j (https://nmda.co/nextcloud/core/vendor/core.js,qv=9bcc7ed9c2dc18f14074cb38bb4c3dc7-0.pagespeed.jm.aq0OiJRbay.js:1:26925)
at Object.fireWith [as resolveWith] (https://nmda.co/nextcloud/core/vendor/core.js,qv=9bcc7ed9c2dc18f14074cb38bb4c3dc7-0.pagespeed.jm.aq0OiJRbay.js:1:27738)
at Function.ready (https://nmda.co/nextcloud/core/vendor/core.js,qv=9bcc7ed9c2dc18f14074cb38bb4c3dc7-0.pagespeed.jm.aq0OiJRbay.js:1:29532)
at HTMLDocument.I (https://nmda.co/nextcloud/core/vendor/core.js,qv=9bcc7ed9c2dc18f14074cb38bb4c3dc7-0.pagespeed.jm.aq0OiJRbay.js:1:29723)
at <anonymous>:2:479
at HTMLDocument.f.string.e.function.b.(anonymous function) (eval at exec_fn (:2:27), <anonymous>:52:92)
at <anonymous>:2:479
at c (<anonymous>:2:324)

And I'm seeing a bunch of these:

Refused to load the script 'https://nmda.co/nextcloud/core/search,_js,_search.js,qv==9bcc7ed9c2dc18f14074cb38bb4c3dc7-0+js,_backgroundjobs.js,qv==9bcc7ed9c2dc18f14074cb38bb4c3dc7-0.pagespeed.jc.0P3ly5SJfo.js' because it violates the following Content Security Policy directive: "script-src 'nonce-QkFlTzJJYk9xQnNXKzZnaWRtU2hJZDZhbWFBQldTSURYUkZoZ0NUQWE3cz06Tm5MNTYvYUswbHB5bFA5elFndnVRcnY4dy9kb2NucE1OMVV5MGtXTkJ0OD0=' 'unsafe-eval'".

Ubuntu 14.04
nginx: 1.13.3
mysql: 14.14
PHP: 7.1

Update: running curl -vvvv https://example.com/nextcloud/ shows that Content-Security-Policy headers are indeed being set, so now I'll have to find out where.

< Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';