From aa7e48e5e89aa13ab24d3042708dd5974bb644a5 Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Fri, 8 May 2026 16:33:18 +0200 Subject: [PATCH 1/2] fix: don't put hashed password in share api response Signed-off-by: Robin Appelman --- .../lib/Controller/ShareAPIController.php | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/apps/files_sharing/lib/Controller/ShareAPIController.php b/apps/files_sharing/lib/Controller/ShareAPIController.php index c8831009dca..c6636a52603 100644 --- a/apps/files_sharing/lib/Controller/ShareAPIController.php +++ b/apps/files_sharing/lib/Controller/ShareAPIController.php @@ -273,10 +273,10 @@ class ShareAPIController extends OCSController { // "share_with" and "share_with_displayname" for passwords of link // shares was deprecated in Nextcloud 15, use "password" instead. - $result['share_with'] = $share->getPassword(); + $result['share_with'] = $this->formatPasswordField($share->getPassword()); $result['share_with_displayname'] = '(' . $this->l->t('Shared link') . ')'; - $result['password'] = $share->getPassword(); + $result['password'] = $this->formatPasswordField($share->getPassword()); $result['send_password_by_talk'] = $share->getSendPasswordByTalk(); @@ -292,7 +292,7 @@ class ShareAPIController extends OCSController { $result['token'] = $token; } elseif ($share->getShareType() === IShare::TYPE_EMAIL) { $result['share_with'] = $share->getSharedWith(); - $result['password'] = $share->getPassword(); + $result['password'] = $this->formatPasswordField($share->getPassword()); $result['password_expiration_time'] = $share->getPasswordExpirationTime() !== null ? $share->getPasswordExpirationTime()->format(\DateTime::ATOM) : null; $result['send_password_by_talk'] = $share->getSendPasswordByTalk(); $result['share_with_displayname'] = $this->getDisplayNameFromAddressBook($share->getSharedWith(), 'EMAIL'); @@ -351,6 +351,10 @@ class ShareAPIController extends OCSController { return $result; } + private function formatPasswordField(?string $password): ?string { + return ($password === null) ? null : 'redacted'; + } + /** * Check if one of the users address books knows the exact property, if * not we return the full name. From b2494f224f0f9fc99c717d55a4e9e16bc4aa02cd Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Fri, 8 May 2026 16:42:45 +0200 Subject: [PATCH 2/2] test: adjust tests redacted password field Signed-off-by: Robin Appelman --- .../tests/Controller/ShareAPIControllerTest.php | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/apps/files_sharing/tests/Controller/ShareAPIControllerTest.php b/apps/files_sharing/tests/Controller/ShareAPIControllerTest.php index a85b9645de3..b6ca22329f6 100644 --- a/apps/files_sharing/tests/Controller/ShareAPIControllerTest.php +++ b/apps/files_sharing/tests/Controller/ShareAPIControllerTest.php @@ -807,8 +807,8 @@ class ShareAPIControllerTest extends TestCase { $expected = [ 'id' => '101', 'share_type' => IShare::TYPE_LINK, - 'password' => 'password', - 'share_with' => 'password', + 'password' => 'redacted', + 'share_with' => 'redacted', 'share_with_displayname' => '(Shared link)', 'send_password_by_talk' => false, 'uid_owner' => 'initiatorId', @@ -4405,8 +4405,8 @@ class ShareAPIControllerTest extends TestCase { 'file_source' => 3, 'file_parent' => 1, 'file_target' => 'myTarget', - 'password' => 'mypassword', - 'share_with' => 'mypassword', + 'password' => 'redacted', + 'share_with' => 'redacted', 'share_with_displayname' => '(Shared link)', 'send_password_by_talk' => false, 'mail_send' => 0, @@ -4450,8 +4450,8 @@ class ShareAPIControllerTest extends TestCase { 'file_source' => 3, 'file_parent' => 1, 'file_target' => 'myTarget', - 'password' => 'mypassword', - 'share_with' => 'mypassword', + 'password' => 'redacted', + 'share_with' => 'redacted', 'share_with_displayname' => '(Shared link)', 'send_password_by_talk' => true, 'mail_send' => 0, @@ -4768,7 +4768,7 @@ class ShareAPIControllerTest extends TestCase { 'mail_send' => 0, 'mimetype' => 'myFolderMimeType', 'has_preview' => false, - 'password' => 'password', + 'password' => 'redacted', 'send_password_by_talk' => false, 'hide_download' => 0, 'can_edit' => false, @@ -4813,7 +4813,7 @@ class ShareAPIControllerTest extends TestCase { 'mail_send' => 0, 'mimetype' => 'myFolderMimeType', 'has_preview' => false, - 'password' => 'password', + 'password' => 'redacted', 'send_password_by_talk' => true, 'hide_download' => 0, 'can_edit' => false,