fix(sharing): fix public share viewing and password-protected shares - #362
Merged
Merged
Conversation
The public load/save flow read #isPublic, #sharingToken and #mimetype hidden inputs to detect a public share page. Those inputs were removed when the files_sharing public page moved to initial state, so a public share always fell through to the authenticated endpoints and failed. Detect the public share the same way the rest of the app already does, via isPublicShare()/getSharingToken() from @nextcloud/sharing/public. The iframe's error paths also called FilesMindMap.hide(), a method that no longer exists since the app moved to the Viewer API. Call the Viewer's own OCA.Viewer.close() instead. On the backend, a password-protected share was always rejected: the session stores an array of authenticated share IDs (public_link_authenticated, still filled by files_sharing's ShareController for this exact purpose), but the check compared it directly against a single share ID and could never match. Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>
AndyScherzinger
approved these changes
Sep 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Public share pages moved the
isPublic/sharingToken/mimetypeflags from hidden DOM inputs to initial state a while ago. This app still read the old inputs, so every public share (single file, folder, password-protected) fell through to the authenticated endpoints and failed to load or save. Switched toisPublicShare()/getSharingToken()from@nextcloud/sharing/public, already used elsewhere in the same file.The iframe's error paths also called a
FilesMindMap.hide()method that no longer exists since the app moved to the Viewer API; replaced withOCA.Viewer.close().On the backend, a password-protected share was always rejected: the session key
public_link_authenticatedholds an array of authenticated share IDs (still populated by files_sharing'sShareControllerfor exactly this purpose), but the check compared it against a single ID and could never match.Adds a PHPUnit setup for the app (
tests/, run from inside a server checkout), extending the one added in #355.Tested locally on PHP 8.2 against stable33 and stable34, MariaDB 11.8 and PostgreSQL 16: the new PHPUnit tests fail on the old code and pass with the fix. Confirmed in a real browser against both versions that a single-file share, a folder share, and a password-protected share all now open and edit correctly; reproduced the original failures against the pre-fix build for comparison.
npm run lint,npm run testandnpm run buildall pass.