From 2534bd9fb5d2770a3a2ebfc57f72bb2d4716791a Mon Sep 17 00:00:00 2001 From: MiMoHo <37556964+MiMoHo@users.noreply.github.com> Date: Sun, 5 Jul 2026 02:06:10 +0200 Subject: [PATCH] fix(files_sharing): limit the share token input to the maximum token length The custom share link token input accepted arbitrarily long values, while the server (and the oc_share.token database column) only allows 32 characters. Users learned about the limit only after submitting the form and reading the error toast. Set the maxlength attribute on the token input matching ShareAPIController::TOKEN_MAX_LENGTH and mention the length and character constraints in the helper text, so the limit is communicated before saving instead of after a failed request. Related: #61416, follow-up to #61630 Co-Authored-By: Claude Fable 5 Assisted-by: ClaudeCode:claude-fable-5 Assisted-by: Hermes:claude-opus-5 Signed-off-by: MiMoHo <37556964+MiMoHo@users.noreply.github.com> --- apps/files_sharing/src/views/SharingDetailsTab.vue | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/apps/files_sharing/src/views/SharingDetailsTab.vue b/apps/files_sharing/src/views/SharingDetailsTab.vue index 29616d1829be1..06fdf16ef7304 100644 --- a/apps/files_sharing/src/views/SharingDetailsTab.vue +++ b/apps/files_sharing/src/views/SharingDetailsTab.vue @@ -122,7 +122,8 @@ v-model="share.token" autocomplete="off" :label="t('files_sharing', 'Share link token')" - :helper-text="t('files_sharing', 'Set the public share link token to something easy to remember or generate a new token. It is not recommended to use a guessable token for shares which contain sensitive information.')" + :helper-text="t('files_sharing', 'Set the public share link token to something easy to remember or generate a new token. Tokens can be up to {maxLength} characters long and may only contain letters, numbers, and hyphens. It is not recommended to use a guessable token for shares which contain sensitive information.', { maxLength: TOKEN_MAX_LENGTH })" + :maxlength="TOKEN_MAX_LENGTH" show-trailing-button :trailing-button-label="loadingToken ? t('files_sharing', 'Generating…') : t('files_sharing', 'Generate new token')" @trailing-button-click="generateNewToken"> @@ -340,6 +341,12 @@ import logger from '../services/logger.ts' import { generateToken } from '../services/TokenService.ts' import GeneratePassword from '../utils/GeneratePassword.ts' +/** + * Maximum length of a custom share token, matching the oc_share.token + * database column (see ShareAPIController::TOKEN_MAX_LENGTH). + */ +const TOKEN_MAX_LENGTH = 32 + /** @typedef {import('../models/Share.js').default} Share */ export default { name: 'SharingDetailsTab', @@ -389,6 +396,7 @@ export default { data() { return { + TOKEN_MAX_LENGTH, writeNoteToRecipientIsChecked: false, sharingPermission: getBundledPermissions().ALL.toString(), revertSharingPermission: getBundledPermissions().ALL.toString(),