[Bug]: Adding a password to a share is not effective unless saved twice

[Alwaysin]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

We need to save twice the settings of a share when adding a password, else the password will not be taken into account.

Steps to reproduce

1. Create a public share for a file
2. Add a password to it
3. Try to access the link

Expected behavior

Being presented with the password input before displaying the file

Instead, I have to reopen the share settings and save again (without even the need to change anything) so that it finally works. It didn't work on 32.0.2 either.

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "redacted"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "redacted",
        "dbtype": "mysql",
        "version": "32.0.3.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "theme": "",
        "loglevel": 2,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtpauthtype": "PLAIN",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "updater.release.channel": "stable",
        "mysql.utf8mb4": true,
        "maintenance_window_start": 1,
        "default_phone_region": "FR"
    }
}

List of activated Apps

Enabled:
  - activity: 5.0.0-dev.0
  - app_api: 32.0.0
  - bruteforcesettings: 5.0.0-dev.0
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - dav: 1.34.2
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.1
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - nextcloud_announcements: 4.0.0-dev.0
  - notifications: 5.0.0-dev.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0-dev.0
  - related_resources: 3.0.0-dev.0
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - support: 4.0.0-dev.0
  - systemtags: 1.22.0
  - text: 6.0.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - viewer: 5.0.0-dev.0
  - weather_status: 1.12.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - admin_audit: 1.22.0
  - contactsinteraction: 1.13.1 (installed 1.8.0)
  - dashboard: 7.12.0 (installed 7.0.0)
  - encryption: 2.20.0
  - files_external: 1.24.0
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - firstrunwizard: 5.0.0-dev.0 (installed 5.0.0-dev.0)
  - survey_client: 4.0.0-dev.0 (installed 4.0.0-dev.0)
  - suspicious_login: 10.0.0-dev.0
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - twofactor_totp: 14.0.0
  - user_ldap: 1.23.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

No logs are being produced while doing the actions

Additional info

No response

[ItsYash1421]

assign it to me

[MajorP93]

I can confirm that this issue occurs in latest Nextcloud (v32.0.3).
I checked, there is no error in log being written.
Upon "applying" the password Nextcloud says "successful".
I consider this a security issue since some Nextcloud users do not notice that their password was not applied - not everyone double-checks their sharing links.
Everyone that has access to the link can view the file without having to type in the password.
Being able to password-protect a share is a very essential feature.
Please prioritize this accordingly.

[passibe15]

I cannot confirm this, for me passwords apply directly.
But I can confirm the opposite: Removing the password from a share link no longer works. Once a password is set, you cannot unset it, it always prompts you for it, no matter how often you remove the password checkbox and click update share link.

Maybe all of this somehow relates to #55660 and #56278? @skjnldsv

[0rb1ta]

I have this problem too

[thompsonbear]

I also have this issue on NextCloud v32.0.3 on a fresh install. To add additional information, this issue does not occur for me when sharing a directory, but only when sharing a file, where the share has to be saved twice.

Furthermore, while potentially unrelated, it appears that when sharing a directory a default password is auto-populated when clicking the "Set password" checkbox, while a default is not populated when sharing a file.

[solracsf]

Hi @nfebe it seems that #56740 fixes one part of the issue (link removal) but not the need to double-save the password, do you confirm?

PS: this issue applies to v32 and v31.