[Bug]: Share links to folders with a dash ("-") in custom link part broken in NC 29

[s-ailus2]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Folders shared via URLs that have a dash ("-") in folder custom URL part do not work. This used to work in NC 28.

The log says (assuming the folder custom URL part is "foo-bar"), stripping repeated errors and irrelevant parts:

Requested uri (/public.php/dav/files/foo-bar/) is out of base uri (/public.php/dav/files/foo/)"

Steps to reproduce

1. Create a folder and share it via a URL.
2. Change to folder's part URL to something that has a dash. The URL will be something like https://host/s/foo-bar .
3. Try to access the above URL with a browser.
4. The browser will tell the directory isn't available and to contact the admin. (I don't have an English error message for this.)

Expected behavior

Folders with dash in custom URL part should work as they used to in NC 28 and earlier.

Installation method

Community Docker image

Nextcloud Server version

29

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 22 to 23)

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "debug": false,
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "opcache.revalidate_freq": "86400",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "******************",
            "******************"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "29.0.0.19",
        "overwrite.cli.url": "https:\/\/*************",
        "overwriteprotocol": "https",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_smtpdebug": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "loglevel": 0,
        "maintenance": false,
        "theme": "",
        "app_install_overwrite": [
            "files_external_dropbox",
            "ojsxc",
            "riotchat",
            "transfer",
            "extract",
            "cfg_share_links",
            "music"
        ]
    }
}

List of activated Apps

Enabled:
  - activity: 2.21.1
  - admin_audit: 1.19.0
  - bookmarks: 14.0.2
  - bruteforcesettings: 2.9.0
  - calendar: 4.7.3
  - cfg_share_links: 5.1.0
  - circles: 29.0.0-dev
  - cloud_federation_api: 1.12.0
  - comments: 1.19.0
  - contacts: 6.0.0
  - contactsinteraction: 1.10.0
  - dashboard: 7.9.0
  - dav: 1.30.1
  - deck: 1.13.0
  - event_update_notification: 2.4.0
  - extract: 1.3.6
  - federatedfilesharing: 1.19.0
  - federation: 1.19.0
  - files: 2.1.0
  - files_downloadlimit: 2.0.0
  - files_external: 1.21.0
  - files_pdfviewer: 2.10.0
  - files_reminders: 1.2.0
  - files_sharing: 1.21.0
  - files_trashbin: 1.19.0
  - files_versions: 1.22.0
  - fileslibreofficeedit: 1.1.0
  - firstrunwizard: 2.18.0
  - logreader: 2.14.0
  - lookup_server_connector: 1.17.0
  - mail: 3.6.0
  - music: 1.11.0
  - nextcloud_announcements: 1.18.0
  - notes: 4.10.0
  - notifications: 2.17.0
  - oauth2: 1.17.0
  - password_policy: 1.19.0
  - phonetrack: 0.8.1
  - photos: 2.5.0
  - polls: 7.0.3
  - privacy: 1.13.0
  - provisioning_api: 1.19.0
  - recommendations: 2.1.0
  - related_resources: 1.4.0
  - richdocuments: 8.4.2
  - riotchat: 0.17.0
  - serverinfo: 1.19.0
  - settings: 1.12.0
  - sharebymail: 1.19.0
  - spreed: 19.0.0
  - support: 1.12.0
  - survey_client: 1.17.0
  - suspicious_login: 7.0.0
  - systemtags: 1.19.0
  - text: 3.10.0
  - theming: 2.4.0
  - twofactor_backupcodes: 1.18.0
  - twofactor_totp: 11.0.0-dev
  - updatenotification: 1.19.1
  - user_status: 1.9.0
  - viewer: 2.3.0
  - weather_status: 1.9.0
  - workflowengine: 2.11.0
Disabled:
  - encryption: 2.17.0
  - files_external_dropbox: 1.4.3 (installed 1.4.3)
  - files_linkeditor: 1.1.20 (installed 1.1.20)
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - ncdownloader: 1.0.20 (installed 1.0.20)
  - socialsharing_email: 3.1.0 (installed 3.1.0)

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

[joshtrichards]

Are you referring to links adding using this app: https://github.com/jimmyl0l3c/cfg_share_links

Because that isn't us. :-)

[s-ailus2]

Hi Josh,

Thanks for your quick reply.

Yes, in fact I have Configurable share links enabled.

Still, to make things work again, it'll take a change in Nextcloud and not in Configurable share links. I'm not sure why this has been changed.

For instance, creating a share results in something like this:
MariaDB [nextcloud]> select * from oc_share where id = 369;
+-----+------------+------------+----------+-----------+---------------+--------+-----------+-------------+-------------+-------------+-------------+-------------+------------+----------+---------------------+-----------------+-----------+------------+------------------+------+---------------+-------+--------------------------+------------+
| id | share_type | share_with | password | uid_owner | uid_initiator | parent | item_type | item_source | item_target | file_source | file_target | permissions | stime | accepted | expiration | token | mail_send | share_name | password_by_talk | note | hide_download | label | password_expiration_time | attributes |
+-----+------------+------------+----------+-----------+---------------+--------+-----------+-------------+-------------+-------------+-------------+-------------+------------+----------+---------------------+-----------------+-----------+------------+------------------+------+---------------+-------+--------------------------+------------+
| 369 | 3 | NULL | NULL | sailus | sailus | NULL | folder | 227894 | NULL | 227894 | /foo-bar | 17 | 1715924217 | 0 | 2024-05-30 21:00:00 | QtnXGPHjEEaXLxQ | 0 | NULL | 0 | NULL | 0 | | NULL | NULL |
+-----+------------+------------+----------+-----------+---------------+--------+-----------+-------------+-------------+-------------+-------------+-------------+------------+----------+---------------------+-----------------+-----------+------------+------------------+------+---------------+-------+--------------------------+------------+
1 row in set (0.001 sec)

"QtnXGPHjEEaXLxQ" is the share specific URL postfix and that's what the Configurable share links changes. Doing this manually:

MariaDB [nextcloud]> update oc_share set token='foo-bar' where id=369;
Query OK, 1 row affected (0.005 sec)
Rows matched: 1 Changed: 1 Warnings: 0

One would expect the file to be accessible using "foo-bar" token but the result is the same error and log message:

"Requested uri (/public.php/dav/files/foo-bar/) is out of base uri (/public.php/dav/files/foo/)"