nextcloud / gallery

DEPRECATED Gallery app was replaced by Photos
https://github.com/nextcloud/photos
GNU Affero General Public License v3.0
109 stars 58 forks source link

Possible Information Disclosure: Password Protecting Public Share Links Does not Work (at least for me) #512

Open gohrner opened 5 years ago

gohrner commented 5 years ago

Bug report

Steps to reproduce

  1. open a folder in gallery
  2. click the "Share" triangle on the right of the breadcrumb bar
  3. click "Share link"
  4. click "Password protect" (possibly named slightly differently, I translated from the German UI strings)
  5. enter a password and press the tab key

Expected behaviour

Actual behaviour

Server configuration

Operating system: Debian 9 Stretch

Web server: Apache 2.4.25-3+deb9u7

Database: MariaDB 10.1.37-0+deb9u1

PHP version: 7.0.33-0+deb9u3

Nextcloud configuration

Nextcloud version: 15.0.7

Updated from an older installation or fresh install: updated from originally 15.0.1

List of activated apps:

App list ``` Enabled: - accessibility: 1.1.0 - activity: 2.8.2 - calendar: 1.6.4 - cloud_federation_api: 0.1.0 - comments: 1.5.0 - contacts: 3.1.0 - dav: 1.8.1 - federatedfilesharing: 1.5.0 - federation: 1.5.0 - files: 1.10.0 - files_pdfviewer: 1.4.0 - files_sharing: 1.7.0 - files_texteditor: 2.7.0 - files_trashbin: 1.5.0 - files_versions: 1.8.0 - files_videoplayer: 1.4.0 - firstrunwizard: 2.4.0 - gallery: 18.2.0 - impersonate: 1.2.0 - logreader: 2.0.0 - lookup_server_connector: 1.3.0 - mail: 0.11.1 - nextcloud_announcements: 1.4.0 - notifications: 2.3.0 - oauth2: 1.3.0 - password_policy: 1.5.0 - polls: 0.10.2 - provisioning_api: 1.5.0 - richdocuments: 3.2.4 - serverinfo: 1.5.0 - sharebymail: 1.5.0 - support: 1.0.0 - survey_client: 1.3.0 - systemtags: 1.5.0 - theming: 1.6.0 - twofactor_backupcodes: 1.4.1 - updatenotification: 1.5.0 - workflowengine: 1.5.0 Disabled: - admin_audit - encryption - files_external - user_ldap ```

Nextcloud configuration:

Are you using external storage, if yes which one: none

Are you using encryption: no

Are you using custom gallery.cnf config files: not that I'd be aware of (didn't create them manually)