Password protection of files is by-passable with the direkt link, even after link removal and file deletion

[ghost]

When pwd protecting a share link it can be bypassed with the direct link the download button links to. Looks something like this:

https://cloud.domain.tld/seafhttp/files//filename

Now even worse, after deleting the share link, i can still download the file without problems using the link

Even even worse, after deleting the file from my library and clearing the trash and setting library to keep 0 history the file is still downloadable via that link.

[killing]

https://cloud.domain.tld/seafhttp/files//filename this link can only be accessed once and after that it becomes invalid. So it's generally not a security issue.