Skip to content

fix(files_sharing): encode path in public share download redirect - #65983

Open
MarioPym wants to merge 1 commit into
nextcloud:masterfrom
MarioPym:fix/share-download-redirect-encoding
Open

MarioPym wants to merge 1 commit into
nextcloud:masterfrom
MarioPym:fix/share-download-redirect-encoding

Conversation

@MarioPym

Copy link
Copy Markdown

Summary

The legacy public share download endpoint (/s/{token}/download?path=... and ?files=<name>) redirects to the public WebDAV URL by appending the requested node's relative path unencoded. Consequently, folder or file names containing reserved URL characters break the redirect:

  • # truncates the path into a URL fragment (e.g., downloading a#b results in /public.php/dav/files/<token>/a#b?accept=zip, causing the client to request /a and fail with a 404).
  • Other reserved characters like ? or % cause similar malformed URLs.

This fix encodes the path segment by segment using OCP\Util::encodePath() prior to generating the redirect, leaving names without special characters unaffected.

How to test

  1. Create a folder shared with a subfolder a#b containing a file, and share shared by public link.
  2. Open /index.php/s/<token>/download?path=/a%23b.
  3. Before: Location: .../public.php/dav/files/<token>/a#b?accept=zip → 404.
    After: Location: .../public.php/dav/files/<token>/a%23b?accept=zip → 200, zip with a#b/x.txt.

Checklist

AI (if applicable)

  • The content of this PR was partly or fully generated using AI

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Mario Alfonso Pym Mejía <pymm@hitss.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant