Read the MIME icon cache buster from initial state before Theming global assignment

[Trockeneis617]

Repository: https://github.com/nextcloud/server

core/src/OC/mimeType.js reads window.OCA.Theming.cacheBuster in getIconUrl. This throws when valid theming/data initial state is present but the additional OCA.Theming assignment has not happened or the OCA namespace has been replaced. Recommendations calls this method when initializing RecommendedFile.

The affected source is byte-identical in Nextcloud v33.0.6, v33.0.8 and stable33 revision cf340916779182c899e2e9d5bfebcaff5dfc6058.

Reproduction: provide valid initial state theming/data with {cacheBuster: 73}, normal OC MIME/theme configuration and window.OCA = {}; call getIconUrl('text/plain'). The global property lookup throws even though the needed state exists. The same occurs after replacing OCA or removing it. These reproduce the unsafe dependency; the exact scheduling of the original browser incident was not recorded.

Proposed change:

+import { loadState } from '@nextcloud/initial-state'
 ...
-path += '?v=' + window.OCA.Theming.cacheBuster
+path += '?v=' + loadState('theming', 'data').cacheBuster

This uses the state object already read by apps/theming/src/theming.ts, including its shared cache identity. There is no default cache-buster and missing or malformed initial state remains an error.

Validation: 13 extracted-source cases, with three failures before and all 13 passing after. Coverage includes MIME aliases, older theme paths, unknown MIME types, cache-buster zero, cached URLs, cache clearing, later updates through the shared state object and malformed/missing state. The matching diagnostic bundle passed the same cases. A local Chromium comparison with this and two independent app corrections passed all navigation checks; a full rebuilt release remains untested.

This is a JavaScript initialization issue, distinct from the server-side AppConfig cache-buster integer/string mismatch reports for Nextcloud 34.

[joshtrichards]

provide valid initial state theming/data with {cacheBuster: 73}, normal OC MIME/theme configuration and window.OCA = {}; call getIconUrl('text/plain'). The global property lookup throws even though the needed state exists. The same occurs after replacing OCA or removing it. These reproduce the unsafe dependency;

Hi @Trockeneis617,

This shows that getIconUrl() depends on window.OCA.Theming, but not that this is a real-world failure.

The reproduction explicitly replaces window.OCA with {} before calling the function. Given that the dashboard declares theming as a script dependency, it’s unclear how this would affect RecommendedFile in practice.

This throws when valid theming/data initial state is present but the additional OCA.Theming assignment has not happened or the OCA namespace has been replaced.

Do you have a production stack trace or generated script order showing that RecommendedFile can run before the theming initializer?

There’s probably some useful cleanup/refactoring to do here, but please either provide real-world reproduction steps or submit a PR with the proposed fix. The current report feels more theoretical than actionable.