v0.7.2 — packaging fix (0.7.1 could not be installed)

Install 0.7.2 — the 0.7.1 archives were withdrawn.

Packaging fix

Installing 0.7.1 from the App Store failed with Extracted app sharepath has more than 1 folder. The archives were built on macOS, where tar stores extended attributes as AppleDouble ._name entries and defaults to the pax format, which adds PaxHeader/… entries. tar hides both when listing an archive, but Nextcloud's PHP extractor writes them out as real files and then rejects the app. The build now sets COPYFILE_DISABLE, strips extended attributes and writes plain ustar archives.

Signing key replaced

The 0.7.1 archives also contained the app's private signing key: the build mirrored the whole working tree and filtered by exclusions, and certificate/ was not on that list — .gitignore keeps a file out of git, not out of the release. The archives have been deleted from the 0.7.1 release page, the key has been replaced and the old certificate revoked. The key was never committed to this repository, and 0.7.0 predates it.

The build now works from an explicit allowlist of what belongs in a Nextcloud app, so nothing can leak in by default again.

No functional changes

The application code is identical to 0.7.1, including the privilege escalation fix in the settings endpoints.

Install

tar xzf sharepath-0.7.2.tar.gz -C /path/to/nextcloud/custom_apps/
occ app:enable sharepath

Disclaimer

This fork's compatibility work was developed and tested with substantial assistance from an AI coding agent (Claude Code); review before use in critical environments. The software is provided as is without warranty of any kind — the authors and maintainers accept no liability for damages or unintended exposure of files (AGPL sections 15/16).

v0.7.1 — security fix (settings privilege escalation)

Security fix — please update from 0.7.0.

The settings endpoints decided whether a request writes the instance wide defaults purely from a type=admin request parameter, which any logged-in account could send. A non-admin could therefore overwrite the admin defaults — most importantly default_sharing_folder, which controls what is served without a share and could be pointed at another account's folder to expose its contents.

Admin rights are now resolved through IGroupManager; a non-admin request for the defaults is rejected with 403 instead of silently falling back to the personal setting. This flaw is present in every upstream release (including the App Store version 0.4.4).

Verified on Nextcloud 33.0.6: attacker request returns 403 with the stored value unchanged; admin writes and personal writes both still work.

Two app ids

This release ships two tarballs built from the same code base:

Tarball	App id	URL
sharingpath-0.7.1.tar.gz	sharingpath	/apps/sharingpath/<user>/<path>
sharepath-0.7.1.tar.gz	sharepath	/apps/sharepath/<user>/<path>

They are functionally identical, carry separate PHP namespaces and can be installed side by side. See the README for which one to pick.

Install

tar xzf sharepath-0.7.1.tar.gz -C /path/to/nextcloud/custom_apps/
occ app:enable sharepath

Disclaimer

This fork's compatibility work was developed and tested with substantial assistance from an AI coding agent (Claude Code); review before use in critical environments. The software is provided as is without warranty of any kind — the authors and maintainers accept no liability for damages or unintended exposure of files (AGPL sections 15/16).

v0.7.0 — Nextcloud 25–34 compatibility

First release of this maintenance fork. Tested against Nextcloud 33.0.6 (Hub 26 Winter).

Fixed

• Internal Server Error on every download since Nextcloud 33: the server removed the private OC_Response class the app still used. Files are now streamed through the public OCP API (IRootFolder / File::fopen), so future core refactorings are far less likely to break the app again. HTTP Range and multipart range requests keep working.
• Copy sharing path file action restored in the Vue based files app (Nextcloud 28+, including the @nextcloud/files v4 registry used since Nextcloud 33). Plain JS, no build step.
• Replaced removed OC.getProtocol() / OC.getHost() / OC_User / legacy event APIs, added modern security attributes, fixed PHP 8.2+ deprecations. Errors now land in nextcloud.log instead of an anonymous 500 page.

Install

tar xzf sharingpath-0.7.0.tar.gz -C /path/to/nextcloud/custom_apps/
occ app:enable sharingpath

Version 0.6.0 is intentionally skipped (used by another fork; Nextcloud refuses app downgrades).

Verified: GET/HEAD byte-identical downloads, range/suffix/multipart ranges (206), 404/403 handling, settings pages (admin + personal), file action in the files UI — zero errors in nextcloud.log.

Disclaimer

This fork's compatibility work was developed and tested with substantial assistance from an AI coding agent (Claude Code); review before use in critical environments. The software is provided as is without warranty of any kind — the authors and maintainers accept no liability for damages or unintended exposure of files (AGPL sections 15/16). See the README for the full disclaimer. (Asset refreshed on release day to include the disclaimer in README and app description.)