unshare link does not work

[stijnhaezebrouck]

When editing the sharing setting of a directory, a sharing link is automatically created, an a check is set on "share link". With Google Chrome, it is unpossible to unshare is (by clicking the check mark again to deactivate it). After less then a second, it is automatically activated again. The issue is only with Google Chrome (not with Safari i.e.) The client os seems to be unrelated.

See https://help.nextcloud.com/t/unshare-doesnt-work-falls-back-to-share/21259

Steps to reproduce

1. use Google chrome, logon to your nexcloud as an administrator
2. on any directory that is not shared, click the share icon -> share link automatically created
3. try to remove the share link by unchecking the share checkmark.

Expected behaviour

The check mark should be unchecked, and the sharing link should be removed

Actual behaviour

The check mark unchecked, and the sharing link was removed. But immediately after, (.5 sec), the check mark was checked again, and a sharing link was created again

Server configuration

Operating system:
Debian linux 8

Web server:
apache 2 2.4.10-10+deb8u9
Database:
mysql 5.5.58

PHP version:
php7
Nextcloud version: (see Nextcloud admin page)
12.0.3.3
Updated from an older Nextcloud/ownCloud or fresh install:
updated
Where did you install Nextcloud from:
do not remember

Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

Nextcloud configuration:

Config report

$CONFIG = array (
  'instanceid' => 'ocotjy5q5ns1',
  'passwordsalt' => ''
  'secret' => '',
  'trusted_domains' => 
  array (
    0 => 'server',
    1 => 'xxxx.be',
  ),
  'datadirectory' => '/share/nextcloud',
  'overwrite.cli.url' => 'x',xx
  'dbtype' => 'mysql',
  'version' => '12.0.3.3',
  'dbname' => 'nextcloud',
  'dbhost' => 'localhost',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'dbuser' => 'nextcloud',
  'dbpassword' => '',
  'logtimezone' => 'UTC',
  'installed' => true,
  'theme' => '',
  'loglevel' => 1,
  'maintenance' => false,
  'mail_smtpmode' => 'sendmail',
  'mail_from_address' => 'nextcloud',
  'mail_domain' => 'xxx.be',
);

Are you using external storage, if yes which one: local/smb/sftp/...
local
Are you using encryption: yes/no
no
Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
webdav

Client configuration

Browser:
Google chrome 61 and 62
Operating system:
Mac Sierra 10.12.1

Logs

Web server error log

Web server error log

Insert your webserver log here

Nextcloud log (data/nextcloud.log)

Nextcloud log

{"reqId":"Oi9uqNbFfV3HZ7HpbVmy","level":1,"time":"2017-10-28T06:44:31+00:00","remoteAddr":"192.168.0.1","user":"stijnh","app":"admin_audit","method":"DELETE","url":"\/ocs\/v2.php\/apps\/files_sharing\/api\/v1\/shares\/79?format=json","message":"The folder \"\/Calibrebibliotheek\" with ID \"342605\" has been unshared (Share ID: 79)","userAgent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3202.75 Safari\/537.36","version":"12.0.3.3"}
{"reqId":"vLkF671cf3TvBg1pXZ90","level":1,"time":"2017-10-28T06:44:32+00:00","remoteAddr":"192.168.0.1","user":"stijnh","app":"admin_audit","method":"POST","url":"\/ocs\/v2.php\/apps\/files_sharing\/api\/v1\/shares?format=json","message":"The folder \"\/Calibrebibliotheek\" with ID \"342605\" has been shared via link with permissions \"1\" (Share ID: 80)","userAgent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/62.0.3202.75 Safari\/537.36","version":"12.0.3.3"}

Browser log

Browser log

No errors in the console

[rullzer]

I just checked this locally against a clean 12.0.3 in chrome and it works for me me.

on any directory that is not shared, click the share icon -> share link automatically created

That already sounds weird... do you have some extra apps enabled?

[stijnhaezebrouck]

Don't remember which app's I activated extra, but this is the list of all the activated apps:

Activity
Auditing/Logging
Collaborative tags
Comments
Deleted files
External storage support
File sharing
First run wizard
Gallery
Log Reader
Monitoring
Notifications
Password policy
PDF viewer
Share by mail
Text Editor
Theming
Update notification
Usage survey
Versions
Video player
Brute-force settings
Contacts
Reader (ebook reader)
Two Factor TOTP Provider

[stijnhaezebrouck]

Tried on another computer, window 10, chrome 61, incognito window. Could not reproduce.
Tried again on my mac, incognito window. Could not reproduce.
Tried again on my mac, non-incognito window (my normal account). (!) Could reproduce.
Tried again on my mac, non-incognito window, someone else account. Could not reproduce.

[stijnhaezebrouck]

When in my browser (my browser profile), I try to logon with a different nextcloud user, I also have the issue. But with another browser profile, it is not reproducible.
My my own profile, issue still present after removing 4 cookies related to my nextcloud domain.

Something else I could try?

[charlesbragg]

I am also having this problem with Google Chrome version 62.0.3202.75 with NC 12.0.3. Clicking on any file results in immediate share link created. When trying to unshare it results in share again.

Also notice infinite loop of this web request using F12 Tools in Chrome under Network Tab.

Problem does not appear using Internet Explorer.

[charlesbragg]

Also found that if I sign out of my profile the problem goes away and share works as expected. Also, clearing browsing history, cookies, cached data and resetting back to defaults does not resolve problem.

When signing out and signing back in, the problem is present again. I even remove ALL extensions.

[nickvergessen]

Well sounds like your browser somewhat triggers the toggle twice causing an immediate reshare of the file.
But I can also not reproduce this

[agoat]

I have the same problem in the Google Chrome browser, for all users. It works in Firefox.
The problem occurred after the update to 12.0.3.

[ToggoStar]

I have the same issue as well - everything works as expected in Firefox, but in Chrome the toggle resets itself almost immediately. In additon, the same problem affects the password checkbox to protect the link with a password: The checkbox is automatically checked and cannot be unchecked in Chrome.

[janisppc]

I have the same problem in two separate Nextcloud installations - NC 12.0.3 and 12.0.4, Chromium 62.0.3202.94 on Ubuntu. You no longer can create "unshared" folders or files after you have clicked the sharing checkbox for one. Newly created ones are automatically shared and re-shared if you try to uncheck the box.

[okoone-dev]

We are experiencing the same issue on both NextCloud 12.0.3 / 12.0.4. Exactly what others described above (everything works as expected on Firefox but not on Chrome 63.0.3239.108, password field not displayed, share checkbox is immediately re-checked after unchecked, etc...).

Clearing browser history, cookies and cached data does not resolve problem.

This is creates a major security flaw since our users end-up publicly sharing all folders.

[mel26]

Confirm. The same issue with the same behaviour. NextCloud 12.0.4.

One more addition.
Check box "Share with link" appears already pressed when just open Share options in Chrome.
I.e. you want to see share options and have shared link with no way to unshare.

Agree. It creates major security risk.

[dirknilius]

I can confirm this bug. It appears to be only present on the Mac with Chrome. I cannot reproduce it under Windows (Chrome 63) or Linux (Chromium 62). This is also not reproducible with enabled incognito mode. I cleared ALL browser data including passwords. Now this issue is gone.

[dirknilius]

@nickvergessen I found the cause of this issue. I have the force passwords for links option enabled. When I create a share link, enter a password and hit enter Chrome offers to save this password after the form submit. If I accidentally accept to store it Nextcloud always creates a share link with this password automatically. After uncheck the share link button the option is magically re-enabled as described above with the stored password. So clearing form data from Chrome history fixed this for now. But I think the store password dialog should be suppressed. Other browsers doesn't show this behavior because they don't offer to store the password.

[dirknilius]

I tested this a little more and found out that the 1Password browser extension causes Chrome to offer the store password option. If I deactivate the plugin everything is fine. This explains why it worked in incognito mode. The extension in deactivated in incognito mode by default. So I believe this is not a Nextcloud bug.

[agoat]

I can confirm this bug. It appears to be only present on the Mac with Chrome.

I have to deny that. The problem also appears on Chrome (62 and now 63) on Windows.

But I can agree that in the incognito mode the issue do not exist. Anyway, I would say it's a nextcloud bug (possibly in combination with a chrome bug).

[rullzer]

In NC13 we added an autocomplete hint to the password input field.
Can any of you (that reliably have the bug) test with that?

[MorrisJobke]

In NC13 we added an autocomplete hint to the password input field.
Can any of you (that reliably have the bug) test with that?

See #7461

[MorrisJobke]

Let's go for the other way around: I will close this now and if it still exist we could reopen the issue.

[t-oster]

I can confirm this on Linux, Chromium 65.0.3325.181. It is definitively Chrome trying to enter a stored password. We should use autocomplete="new-password" like suggested here https://stackoverflow.com/questions/15738259/disabling-chrome-autofill

[MrEbbinghaus]

@MorrisJobke

The Problem still exists with:
Chrome 73.0.3683.39
Nextcloud 15.0.4

[MorrisJobke]

@MorrisJobke

The Problem still exists with:
Chrome 73.0.3683.39
Nextcloud 15.0.4

Please open a new ticket - this one is nearly 1 year closed.