false notification e-mails "... was created in a public folder"

[tom-ch1]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

1. update to Nextcloud Hub 9 (30.0.5) or Nextcloud Hub 10 (31.0.4)
2. unknown trigger (for me it was files in the Bookmarks folder).

Expected behaviour

Nothing

Actual behaviour

received an E-Mail:
There was some activity at
was created in a public folder

Server configuration

Web server: Apache

Database: PostgreSQL

PHP version: 8.2

Nextcloud version: Nextcloud Hub 10 (31.0.4)

List of activated apps

Enabled:
  - activity: 4.0.0
  - admin_audit: 1.21.0
  - app_api: 5.0.2
  - audioplayer: 3.4.1
  - bookmarks: 15.1.0
  - bruteforcesettings: 4.0.0
  - calendar: 5.2.3
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contacts: 7.0.6
  - contactsinteraction: 1.12.0
  - dashboard: 7.11.0
  - data_request: 3.0.0
  - dav: 1.33.0
  - deck: 1.15.1
  - documentserver_community: 0.2.0
  - drawio: 3.1.0
  - external: 6.0.2
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_bpm: 1.7.1
  - files_downloadlimit: 4.0.0
  - files_external: 1.23.0
  - files_mindmap: 0.0.33
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_retention: 2.0.1
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - firstrunwizard: 4.0.0
  - forms: 5.1.0
  - gpxpod: 7.0.4
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - notes: 4.12.0
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - onlyoffice: 9.8.0
  - password_policy: 3.0.0
  - passwords: 2025.4.10
  - phonetrack: 0.8.2
  - photos: 4.0.0-dev.1
  - polls: 7.4.2
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - qownnotesapi: 25.2.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - richdocuments: 8.6.4
  - richdocumentscode: 24.4.1303
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - side_menu: 5.1.0
  - snappymail: 2.38.2
  - spreed: 21.0.4
  - support: 3.0.0
  - survey_client: 3.0.0
  - systemtags: 1.21.1
  - tasks: 0.16.1
  - text: 5.0.0
  - theming: 2.6.1
  - theming_customcss: 1.18.0
  - twofactor_backupcodes: 1.20.0
  - unroundedcorners: 1.1.4
  - unsplash: 3.0.3
  - updatenotification: 1.21.0
  - uppush: 2.3.0
  - user_pwauth: 2.8.3
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0
Disabled:
  - analytics: 5.4.0 (installed 5.4.0)
  - cms_pico: 1.0.21 (installed 1.0.21)
  - encryption: 2.19.0
  - gpxedit: 0.0.14 (installed 0.0.14)
  - gpxmotion: 0.1.0 (installed 0.1.0)
  - maps: 1.5.0 (installed 1.5.0)
  - music: 2.1.4 (installed 2.1.4)
  - news: 25.3.1 (installed 25.3.1)
  - nextcloud_announcements: 3.0.0 (installed 1.5.0)
  - ownpad: 0.12.0 (installed 0.12.0)
  - passman: 2.4.12 (installed 2.4.12)
  - suspicious_login: 9.0.1
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0
  - user_ldap: 1.22.0

Nextcloud configuration

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "version": "31.0.4.1",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "forcessl": true,
        "theme": "",
        "default_phone_region": "CH",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "share_folder": "\/Shared",
        "preview_libreoffice_path": "\/usr\/bin\/libreoffice",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "sendmail",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "loglevel": 1,
        "updatechecker": true,
        "maintenance": false,
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 365",
        "updater.release.channel": "stable",
        "overwrite.cli.url": "https:\/\/***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "has_rebuilt_cache": true,
        "app_install_overwrite": {
            "0": "passman",
            "1": "deck",
            "3": "files_bpm",
            "4": "files_external_dropbox",
            "5": "apporder",
            "7": "jsloader",
            "8": "snappymail",
            "9": "unsplash"
        },
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "dbindex": 0,
            "timeout": 1.5
        },
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "maintenance_window_start": 1
    }
}

Browser

Browser name: Chromium

Browser version: Version 135.0.7049.95 (Official Build)

Operating system: Debian GNU/Linux 12 (bookworm) (64-bit)

Browser log

not relevant, it is not a browser issue.

[tom-ch1]

See also

• https://help.nextcloud.com/t/activity-noticifations-there-was-some-activity-at-file-was-created-in-a-public-folder/215206
• https://help.nextcloud.com/t/email-file-zip-was-created-in-a-public-folder/206611

[tom-ch1]

It might be related to my floccus Chromium addon for nextcloud bookmarks in combination with the passwords addon for chromium. floccus syncs bookmarks and open tabs to nextcloud. Maybe if I use the passwords addon just while floccus syncs, floccus might try to add a "bookmark" (in fact an open tab) inside the Bookmarks folder (that's the location which the notification E-Mail indicates).
However, this folder is not public --> bug in Activity addon?

[miaulalala]

Certain apps may perform file operations without a proper user session, causing getUserIdentifier() to return '', which incorrectly triggers the "created in a public folder" notification. The folder isn't actually public — it's just that the current user context is empty.
To fix it:

1. Distinguish "actually public upload via share link" from "no user session available for other reasons"
2. Check if the file is actually in a publicly shared folder, rather than inferring it from the absence of a user identifier