Released: July 1, 2026 · Repository: owncloud/web · GitHub release page
ownCloud Web 12.5.0 is a modest but useful release for oCIS deployments, headlined by a fix that closed a long-standing gap in the Collabora Online integration: documents can now actually be saved as a copy or exported to another format from inside the editor. Alongside that, admins get an ownCloud-branded login background out of the box, users get a new lightweight HTML editor app, and there are three targeted bugfixes covering PDF viewing on iOS, focus styling, and app resolution by MIME type.
Note: this is the last standalone owncloud/web release. On 14 July 2026, ownCloud Web and oCIS became one codebase, all under Apache-2.0, with the web frontend now living inside owncloud/ocis under web/
Enhancements
Collabora Online Save-As support (headline change)
- #13906 — Collabora Online Save-As now works. Previously, choosing „Save As“ inside a document opened via Collabora did nothing. Collabora exposes Save-As as a host-delegated operation (it posts a UI_SaveAs message and waits for a reply via Action_SaveAs), but the app-provider integration never opened that postMessage channel. The integration now announces itself with Host_PostmessageReady once the iframe loads, requests the grouped Save-As control, and replies correctly when the user names the copy. Since the collaboration service already implements WOPI PutRelativeFile, the copy is written into the same oCIS space respecting the user’s permissions. The chosen file extension controls the export format (for example .docx → PDF or ODT, .xlsx → ODS, .pptx → PDF).
Branded login background
- #13875 — Default login page now uses ownCloud’s own branding background rather than a generic placeholder. Applied through a new CSS custom property (–oc-login-background-image) so future branding updates only need to touch one value. The actual image still comes from backgroundImg in theme.json and remains fully customisable.
New bundled app: HTML editor
- #13895 — web-app-html-editor Opens .html, .htm, and .xhtml files in a CodeMirror-based source editor with a live preview. Modes: Editor / Split / Preview. File load and save handled over WebDAV by the standard app wrapper. The document renders inside a strictly sandboxed iframe with an opaque origin and no network egress. Follows the same lightweight registration pattern as the existing text editor.
Documentation tooling
- #13894 — Playwright-based documentation screenshot tool added. Drives the Web UI through scripted „tours“ and captures captioned screenshots plus a manifest for each step. Aimed at keeping end-user documentation screenshots in sync with the actual product rather than going stale after UI changes. Not user-facing, but a real quality-of-life win for the documentation team and anyone who’s ever had to spot the difference between docs and reality.
Bugfixes
- #13888 — /external redirect now resolves the correct app by MIME type. Previously the redirect picked an arbitrary app provider when no explicit app query parameter was present, which could route a file to an app that didn’t support its MIME type and surface a generic „app not found“ error. The redirect now resolves the app from the file’s actual MIME type, prefers the configured default, and shows an explicit error instead of guessing wrong.
- #13797 — PDF handling on iOS and iPadOS improved. The built-in PDF viewer had known issues on iOS and iPadOS, so Web now shows a button to open PDFs in the browser instead of the native viewer as a workaround.
- #13887 — OcButton danger-filled focus colour fixed. The variant was not applying the correct text colour when focused via keyboard. Fixed.
Security (one fix)
- #13924 — .psec file URL validation added. The URL stored inside a .psec file (used for password-protected folder views) was previously loaded directly as the source of the folder view iframe without validation. The URL is now checked to ensure it uses a safe scheme and points at the configured ownCloud server before being loaded. Vulnerability class: unsafe URL loading with potential for redirect abuse or arbitrary iframe source injection.
Upgrade notes
No configuration migration is required for this release. If your deployment customizes the login page background, note that theming now flows through the –oc-login-background-image CSS variable in addition to theme.json, so review custom themes to make sure the new default does not need to be overridden. If you rely on the /external redirect for integrations, double-check that file associations resolve to the intended app now that MIME-type resolution has changed.
Get it
Full changelog, PR links, and assets are on the GitHub release page for v12.5.0.
Note: this is the last standalone owncloud/web release. On 14 July 2026, ownCloud Web and oCIS became one codebase, all under Apache-2.0, with the web frontend now living inside owncloud/ocis under web/
