[Bug]: Password handling for public links

[Elchadi]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Password protection for public share links in read-only mode is broken. Passwords are not generated, not applied, or disappear when displayed.

Steps to reproduce

Password generation does not work
1.Create a public share link.
2.Set permissions to Read-only.
3.Click on Generate password.

Manually entered password is not applied

1. Create a public share link.
2. Manually enter a password.
3. Copy and open the public link in a private/incognito browser window.

Password disappears when clicking the eye icon

1. Enter a password manually in the share dialog.
2. Click the eye icon to display the password.

Expected behavior

Password generation does not work
A password should be automatically generated and assigned to the share link.

Manually entered password is not applied
The link should prompt for the password before allowing access.

Password disappears when clicking the eye icon
The password should become visible.

Nextcloud Server version

32

Operating system

RHEL/CentOS

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

Issue occurs consistently.

Workaround: Works via Windows Explorer / NextCloud Client

[szaimen]

cc @nfebe

[etlam]

For me, it is not just a normal bug, it is a security problem. The users think the password was applied (he gets a confirmation), but the link works without passwords!

[etlam]

This ticket seems to be a duplicate of #57011.
There is already a working workaround.