Inserting image doesn't work : lok_allow not taking alias_group into account.

[vincib]

Describe the Bug

When I edit a document opened from a Nextcloud and I want to insert an image from my nextcloud into the document, I can browse my files, but when I click "insert file", nothing happen, and collabora logs this:

dec. 03 11:07:47 hostname coolwsd[1931654]: kit-1931654-1931654 2025-12-03 11:07:47.068565 +0100 [ kitbroker_2137 ] ERR  ToMaster-4a0e2: CALLBACK_ERROR: { "code": 24581, "kind": "network", "cmd": "insert"}| kit/ChildSession.cpp:3742
dec. 03 11:07:47 hostname coolwsd[1931654]: kit-1931654-1931654 2025-12-03 11:07:47.068686 +0100 [ kitbroker_2137 ] ERR  ToMaster-4a0e2: error: cmd=insert kind=network code=24581| common/Session.hpp:181

We found a way to reproduce, stated below:

Steps to Reproduce

1. Install collabora
2. Setup the configuration to have a remote_config url
3. This remote_config URL spit out a JSON file containing a storage > wopi > alias_groups > groups > host > "https://mynextcloud.com"
4. open an ODT document from mynexcloud.com using this collabora
5. The document opens properly
6. click Insert > Illustration > Image > Image... and select an image from your nextcloud
7. click "insert this file" => nothing happen

To make it work we MUST add mynextcloud.com in the lok_allow key in the coolwsd.xml configuration statically

Expected Behavior

I expect lok_allow to be a dynamic configurable list too.

We tried to setup the remote_config with a lok_allow key too as follow:

{ "kind":"configuration", "net": { "lok_allow": { "hosts" : ["mynextcloud.com"]  }   }  }

but it didn't work.

Actual Behavior

lok_allow is a static configuration list, it's seems to be read at boottime and can't be modified later.

• Collabora version: collabora online lite version 25.04.7-3
• OS and version: server running Debian 12
• Browser and version: Chrome 142

[vincib]

Also, if I'm NOT using remote_config but adds "mynextcloud.com" into the static configuration in coolwsd.xml in storage > wopi > alias_groups > groups > host and not in lok_allow, it works too.

this proves that lok_allow is not dynamic

[jazevedo-coll]

CC @meven

[elzody]

I am able to confirm this. I have to manually add my host to lok_allow in order for images from Nextcloud to be inserted. The error in the Collabora logs is the same for me.

COOLWSD details

COOLWSD version: 25.04.7.3(git hash: a0576a3364 (E))
LOKit version: Collabora Office 25.04.7.3(git hash: 4ad7ba3245)
Served by: unknown
Server ID: 3872faad

Logs

Dec 17 15:31:42 tux coolwsd[16162]: kit-16162-16162 2025-12-17 15:31:42.442128 -0500 [ kitbroker_002 ] ERR  ToMaster-003: CALLBACK_ERROR: { "code": 24581, "kind": "network", "cmd": "insert"}| kit/ChildSession.cpp:3742
Dec 17 15:31:42 tux coolwsd[16162]: kit-16162-16162 2025-12-17 15:31:42.442136 -0500 [ kitbroker_002 ] ERR  ToMaster-003: error: cmd=insert kind=network code=24581| common/Session.hpp:181
Dec 17 15:31:42 tux coolwsd[16061]: wsd-16061-16183 2025-12-17 15:31:42.442201 -0500 [ docbroker_002 ] ERR  ToClient-003: insert error failure: network| wsd/ClientSession.cpp:2399

[meven]

Issue analysis:

Inserting image, works by letting the backend lokit do the file downloading and inserting.
In order to limit security exposure, the hosts allowed to be downloaded from are set through an environment variable: LOK_HOST_ALLOWLIST

And this variable is currently ever updated only on coolwsd start.

The fix is then to allow this environment to be refreshed as remote_config is updated.

N.B: with this solution, this still won't affect already opened documents.