Cannot hide download button

Hello,

If you want to share a file and hide the download button, it does not work on Vivaldi browser, which is based on Chrome.

If you include the file in a folder and share the folder, then the download button is hidden.

Nextcloud version (eg, 20.0.5): 20.0.5
Operating system and version (eg, Ubuntu 20.04): Debian 9
Apache or nginx version (eg, Apache 2.4.25): Apache 2.4.25
PHP version (eg, 7.4): 7.3.29

Is this the first time you’ve seen this error? (Y/N): N

Sincerely

Does it really works with other browsers? Then i think the feature is programmed in Javascript and it could be a security risk for all installations.

To exclude your nextcloud installation please create a 60 minutes test account at https://try.nextcloud.com and test a share with your browser and a different browser. Please post screenshots. Thanks.

Here are some screen shot with Vivaldi browser (Chrome)

Folder share: there is no download button
folder-share

File share

File-Share2

Windows that popup when you click the download button
File-share3

With Firefox 69 there are no button, file or folder share.

I also checked on an android phone and it behave the same way.
Vivaldi android shows download
Firefox android does not

Please post screenshot with Firefox. Also please test with https://try.nextcloud.com to exclude your nextcloud configuration. If there is still an problem on Vivaldi browser we can open an issue.

Perhaps you can make new screenshots with the nextcloud test server.

Screen shot form try.nexcloud on Vivaldi
Share-demo

Screen shot form try.nexcloud on Firefox 69

Have a nice day

Hi, see this PR for a fix hide download button for public preview of audio files by fstorz · Pull Request #27674 · nextcloud/server · GitHub

1 Like

@PatriceV
Have you also tested it with other files (not only mp3) ?

I tested with a .txt file, It is the same behavior, download is possible

I think this should not be possible. If the in sharing configured hidden download is shown in Vivaldi browser than i think the hidden function must be a client side function (e.g. Javascript) and that is a security issue.

I can open an issue for you at GitHub - nextcloud/server: ☁️ Nextcloud server, a safe home for all your data if you want it.

I applied the patch from here

This work for for MP3 file but do not for txt file (for example)

I will open an issue on GitHub

The bug report on GitHub is here

1 Like

For those who do not know:
Hiding the button is not hiding the download link in the code, so it is harder to download for beta user, but it is still (unfortunately) possible.

@PatriceV
Yes. “Hide Download” not not really a security feature.

You can change:
https://cloud.server.tld/index.php/s/s7DGpDzK2WxHM5W
to
https://cloud.server.tld/index.php/s/s7DGpDzK2WxHM5W/download
and you can download the file.

Only add “/download” on the public share.

I know and one my my wish is to be able to have a true read only.

I think it could be possible to deactivate /download if nextcloud code change.
But the problem is that e.g. for playing an mp3 it must always be transferred from server to client.

Instead of deny download you can use e.g. watermarks on office documents. Thant they can be shown but there is a problem to copy them to a third party.

For me it is the problem that I cannot share safely my music before it is registered.
The solution is a streaming function.

Even with “the hide Download button” function working, it is very easy to get the URL for the file download, via the browser’s’ developer tools. It’s not a real protection. There would have to be some copy protection mechanisms and DRM stuff built in, like the big streaming providers Spotify and Netflix have. But even with that in place, there would always be a way to extract the content somehow. If necessary, via analog audio output :wink:

In your case, it’s probably more of a legal problem anyways. And I doubt that a “hide download button” function would legally pass as download protection. But I am not a lawyer…

It has that. For me it shows an audioplayer and starts to play the file when I click on a shared audio file. But without copy protection / DRM of course. :wink: