Password-protected share viewer: metadata leak, silent wrong password, forced auto-download

Cordy commented

2026-08-18 19:08:00 +00:00

Owner

Dogfood finding (2026-08-18, v0.6.42, files.c0rdyceps.ch)

Opening a password-protected share link (/s/<token>#<key>):

Metadata leaks before the password: the viewer already shows the file name and size ("0 Shuggah 2 King.wav — 92.9 MB · encrypted share") with the password still unentered. The password gate should hide everything about the content.
Wrong password → silence: entering a wrong password produces no error, no feedback, nothing.
Correct password → forced download: the file loads and immediately downloads. The recipient never chose to download.

Wanted behavior

Pre-password: a neutral card — "One or more files have been shared with you. Enter the password to see them." No names, no sizes, no count.
Wrong password: explicit inline error.
Post-password: show the contents; downloads are deliberate — a Download button per file, plus Download all when the share contains multiple files; never auto-download.
Applies to both single-file viewer and folder-share listing surfaces.

Acceptance

No content metadata (name/size/type/count) is served before password verification on password-protected shares.
Wrong password shows an inline error; throttling behavior unchanged.
Correct password reveals the content list; each file has its own Download button; multi-file shares also offer Download all; nothing downloads without a click.
Works for layered shares (key-in-link + password, new in v0.6.42) — password gate first, then in-browser decryption on explicit download.

## Dogfood finding (2026-08-18, v0.6.42, files.c0rdyceps.ch) Opening a password-protected share link (`/s/<token>#<key>`): 1. **Metadata leaks before the password**: the viewer already shows the file name and size ("0 Shuggah 2 King.wav — 92.9 MB · encrypted share") with the password still unentered. The password gate should hide *everything* about the content. 2. **Wrong password → silence**: entering a wrong password produces no error, no feedback, nothing. 3. **Correct password → forced download**: the file loads and immediately downloads. The recipient never chose to download. ## Wanted behavior - Pre-password: a neutral card — "One or more files have been shared with you. Enter the password to see them." No names, no sizes, no count. - Wrong password: explicit inline error. - Post-password: show the contents; **downloads are deliberate** — a Download button per file, plus **Download all** when the share contains multiple files; never auto-download. - Applies to both single-file viewer and folder-share listing surfaces. ## Acceptance 1. No content metadata (name/size/type/count) is served before password verification on password-protected shares. 2. Wrong password shows an inline error; throttling behavior unchanged. 3. Correct password reveals the content list; each file has its own Download button; multi-file shares also offer Download all; nothing downloads without a click. 4. Works for layered shares (key-in-link + password, new in v0.6.42) — password gate first, then in-browser decryption on explicit download.

Cordy added this to the v0.7 — Closed beta (dogfood + hardening) milestone

2026-08-18 19:08:00 +00:00

Cordy referenced this issue from a commit

2026-08-18 19:08:26 +00:00

scout-v271: viewer.go whole + public.go auth/serve flow for #271

Cordy referenced this issue from a commit

2026-08-18 19:14:06 +00:00

#271: locked share viewer, wrong-password error, deliberate downloads (patch)

Cordy referenced this issue from a commit

2026-08-18 19:14:23 +00:00

ship workflow: #271 locked share viewer (gofmt; PR CI is the Go build gate)

forgejo-actions referenced this issue from a commit

2026-08-18 19:14:35 +00:00

#271: locked pre-password share viewer (no metadata), visible wrong-password error, deliberate Download buttons

Cordy referenced this issue

2026-08-18 19:15:23 +00:00

#271: locked share viewer — no metadata before the password, visible errors, deliberate downloads #272

Cordy referenced this issue from a commit

2026-08-18 19:17:41 +00:00

Merge pull request '#271: locked share viewer — no metadata before the password, visible errors, deliberate downloads' (#272) from feat/viewer271 into main

Cordy commented

2026-08-18 19:32:19 +00:00

Author

Owner

all has been implemented, except "Download all" feature. yet to come back to this and implement, as there is a decryption challange to be solved here.

Cordy referenced this issue

2026-08-18 19:45:47 +00:00

Password-only shares must not exist: protection is key-in-link, optionally + password #274

Cordy referenced this issue

2026-08-18 19:47:50 +00:00

#274: password-only shares removed — key-in-link always, password as optional layer (v0.6.45) #275

forgejo-actions referenced this issue from a commit

2026-08-18 20:19:44 +00:00

v0.6.46: Protection first + safe dialog dismiss; Shares wording + Transfers-style rows; folder-share per-file + Download all (#271)

Cordy referenced this issue

2026-08-18 20:20:30 +00:00

v0.6.46: Protection first + safe dialog dismiss; Shares wording + Transfers-style rows; folder-share Download all (#271) #276