From cfcab9141c8f3335480db72aa108003cc764b35a Mon Sep 17 00:00:00 2001 From: MiMoHo <37556964+MiMoHo@users.noreply.github.com> Date: Sun, 5 Jul 2026 02:06:10 +0200 Subject: [PATCH] fix(files_sharing): limit the share token input to the maximum token length The custom share link token input accepted arbitrarily long values, while the server (and the oc_share.token database column) only allows 32 characters. Users learned about the limit only after submitting the form and reading the error toast. Set the maxlength attribute on the token input matching ShareAPIController::TOKEN_MAX_LENGTH and mention the length and character constraints in the helper text, so the limit is communicated before saving instead of after a failed request. Related: #61416, follow-up to #61630 Co-Authored-By: Claude Fable 5 Assisted-by: ClaudeCode:claude-fable-5 Assisted-by: Hermes:claude-opus-5 Signed-off-by: MiMoHo <37556964+MiMoHo@users.noreply.github.com> --- apps/files_sharing/src/views/SharingDetailsTab.vue | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/apps/files_sharing/src/views/SharingDetailsTab.vue b/apps/files_sharing/src/views/SharingDetailsTab.vue index 803a27ee347c3..1bd5fb62e4c22 100644 --- a/apps/files_sharing/src/views/SharingDetailsTab.vue +++ b/apps/files_sharing/src/views/SharingDetailsTab.vue @@ -122,7 +122,8 @@ v-model="share.token" autocomplete="off" :label="t('files_sharing', 'Share link token')" - :helper-text="t('files_sharing', 'Set the public share link token to something easy to remember or generate a new token. It is not recommended to use a guessable token for shares which contain sensitive information.')" + :helper-text="t('files_sharing', 'Set the public share link token to something easy to remember or generate a new token. Tokens can be up to {maxLength} characters long and may only contain letters, numbers, and hyphens. It is not recommended to use a guessable token for shares which contain sensitive information.', { maxLength: TOKEN_MAX_LENGTH })" + :maxlength="TOKEN_MAX_LENGTH" show-trailing-button :trailing-button-label="loadingToken ? t('files_sharing', 'Generating…') : t('files_sharing', 'Generate new token')" @trailing-button-click="generateNewToken"> @@ -340,6 +341,12 @@ import logger from '../services/logger.ts' import { generateToken } from '../services/TokenService.ts' import GeneratePassword from '../utils/GeneratePassword.ts' +/** + * Maximum length of a custom share token, matching the oc_share.token + * database column (see ShareAPIController::TOKEN_MAX_LENGTH). + */ +const TOKEN_MAX_LENGTH = 32 + /** @typedef {import('../models/Share.js').default} Share */ export default { name: 'SharingDetailsTab', @@ -389,6 +396,7 @@ export default { data() { return { + TOKEN_MAX_LENGTH, writeNoteToRecipientIsChecked: false, sharingPermission: getBundledPermissions().ALL.toString(), revertSharingPermission: getBundledPermissions().ALL.toString(),