Nextcloud version 17.x and 18.x:
Operating system and version: I think it is not relevant.
Apache or nginx version: I think it is not relevant.
PHP version: I think it is not relevant.
The issue you are facing:
Version 17 and 18 seem to allow link sharing that does not follow the sharing options. So it is possible to create link shares without a password, but “enforce password protection” (Passwortschutz erzwingen) is activated on our system.
Is this the first time you’ve seen this error? : Y
Steps to replicate it - V17:
- Simply type an e-mailadress in the “Name or email address…” field and press return-key.
- Link share is created and targetuser gets an e-mail and can access the link without password.
- It is possible to add a password later by pressing … and activate “Password protect”. But the system does not ask for the password while the link is created, so the default is no password protection which is contrary to the enforce password option.
Screenshot V17:
Steps to replicate it - V18:
- Simply type an e-mailadress in the “Name or email address…” field and press return-key.
- Link share is created and targetuser gets an e-mail and can access the link without password.
- A strange “(Shared link)” is created. But the mailadress is not displayed like in V17, so recipient can’t be reproduced later.
- It is also not possible to add a password afterwards like in V17. It is only possible to delete the link share.
Any idea how to prevent this?
For safety reasons ALL our links shares must have a password and it is not good, when user can bypass the enforce password option 