From 7c469ea06bb440d0b1b7bffbdeb0b44e0095b242 Mon Sep 17 00:00:00 2001 From: MiMoHo <37556964+MiMoHo@users.noreply.github.com> Date: Sun, 5 Jul 2026 02:06:10 +0200 Subject: [PATCH] fix(files_sharing): limit the share token input to the maximum token length The custom share link token input accepted arbitrarily long values, while the server (and the oc_share.token database column) only allows 32 characters. Users learned about the limit only after submitting the form and reading the error toast. Set the maxlength attribute on the token input matching ShareAPIController::TOKEN_MAX_LENGTH and mention the length and character constraints in the helper text, so the limit is communicated before saving instead of after a failed request. Related: #61416, follow-up to #61630 Co-Authored-By: Claude Fable 5 Assisted-by: ClaudeCode:claude-fable-5 Assisted-by: Hermes:claude-opus-5 Signed-off-by: MiMoHo <37556964+MiMoHo@users.noreply.github.com> --- apps/files_sharing/src/views/SharingDetailsTab.vue | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/apps/files_sharing/src/views/SharingDetailsTab.vue b/apps/files_sharing/src/views/SharingDetailsTab.vue index c1cc67ca72289..0294d0b860dce 100644 --- a/apps/files_sharing/src/views/SharingDetailsTab.vue +++ b/apps/files_sharing/src/views/SharingDetailsTab.vue @@ -122,7 +122,8 @@ v-model="share.token" autocomplete="off" :label="t('files_sharing', 'Share link token')" - :helper-text="t('files_sharing', 'Set the public share link token to something easy to remember or generate a new token. It is not recommended to use a guessable token for shares which contain sensitive information.')" + :helper-text="t('files_sharing', 'Set the public share link token to something easy to remember or generate a new token. Tokens can be up to {maxLength} characters long and may only contain letters, numbers, and hyphens. It is not recommended to use a guessable token for shares which contain sensitive information.', { maxLength: TOKEN_MAX_LENGTH })" + :maxlength="TOKEN_MAX_LENGTH" show-trailing-button :trailing-button-label="loadingToken ? t('files_sharing', 'Generating…') : t('files_sharing', 'Generate new token')" @trailing-button-click="generateNewToken"> @@ -340,6 +341,12 @@ import logger from '../services/logger.ts' import { generateToken } from '../services/TokenService.ts' import GeneratePassword from '../utils/GeneratePassword.ts' +/** + * Maximum length of a custom share token, matching the oc_share.token + * database column (see ShareAPIController::TOKEN_MAX_LENGTH). + */ +const TOKEN_MAX_LENGTH = 32 + /** @typedef {import('../models/Share.js').default} Share */ export default { name: 'SharingDetailsTab', @@ -389,6 +396,7 @@ export default { data() { return { + TOKEN_MAX_LENGTH, writeNoteToRecipientIsChecked: false, sharingPermission: getBundledPermissions().ALL.toString(), revertSharingPermission: getBundledPermissions().ALL.toString(),