From 545caf477ad6d3bd052f2388de71428c2e9ab12d Mon Sep 17 00:00:00 2001
From: Milan <37556964+MiMoHo@users.noreply.github.com>
Date: Fri, 3 Jul 2026 12:28:12 +0200
Subject: [PATCH] fix(attachments): return 404 when attachment path resolves to
 a folder

getAttachment() relied on assert() to ensure the resolved node is a File. assert() is a no-op with the production setting zend.assertions=-1, so a path pointing at a directory produced a TypeError from the ": File" return type. TypeError is a \Error and is not caught by the controllers' catch(\Exception), ending the request in HTTP 500 instead of 404.

Guard the type explicitly and throw NoteDoesNotExistException, mirroring the existing pattern in getFileById().

Signed-off-by: Milan <37556964+MiMoHo@users.noreply.github.com>
---
 lib/Service/NotesService.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/Service/NotesService.php b/lib/Service/NotesService.php
index 644b61f0c..d191f8c53 100644
--- a/lib/Service/NotesService.php
+++ b/lib/Service/NotesService.php
@@ -310,7 +310,9 @@ public function getAttachment(string $userId, int $noteid, string $path) : File
 			}
 		}
 		$targetNode = $notesFolder->get(implode('/', $p));
-		assert($targetNode instanceof \OCP\Files\File);
+		if (!($targetNode instanceof File)) {
+			throw new NoteDoesNotExistException();
+		}
 		return $targetNode;
 	}