Pressing Enter in "Search people and groups" silently creates a PUBLIC link (Shares panel is one form; "Create link" is its only submit) #680

New issue

Closed

opened 2026-09-23 03:27:43 +00:00 by Cordy · 0 comments

Cordy commented

2026-09-23 03:27:43 +00:00

Owner

Found by the #656 QA pass (v0.6.247, files). Severity: high. It is an unintended data exposure, and the default expiry makes it a live link.

Matrix row: §4 Sharing — "Person share via panel" and "Public link" (both are affected). Also relevant to §5 "Federated share … from the panel".

Steps

files, as nikola-test: _qa/qa-note.md → pane → Shares.
Click "Search people and groups", type an address (here sharer1@files-bao.c0rdyceps.ch), and press Enter. This is the natural way to confirm a recipient.
The row immediately gets a Public chip. GET /api/v1/shares shows a new kind: "link" for /home/nikola-test/_qa/qa-note.md, created at 03:27:08Z, expiring 03:27:08Z the next day (the pre-filled default), with no password.

Root cause (from the live DOM): the whole Shares drill is a single <form>. Its buttons are Add: type=button, Copy: type=button ×2, and Create link: type=submit, so Enter in any field of the panel (people search, and presumably the password field) submits the form and creates a public link. Nothing asks for confirmation and no toast appears. The only signal is the chip in the list behind the panel.

Expected: Enter in the people field picks or adds the typed recipient, or does nothing. Creating a public link happens only through an explicit click on Create link.
Seen: a public, passwordless, 24-hour link is created without the user knowing.

Suggested fix: separate forms per section, or type="button" on Create link with Enter handled per field. It is also worth an audit of other panels built as one form (the policy page, dialogs).

Cleanup note: the created link lives in _qa and will be revoked in the #656 cleanup batch.

Screenshot: 680-enter-creates-public-link.jpg (qa-note now shows "Public")

Found by the #656 QA pass (v0.6.247, files). Severity: high. It is an unintended data exposure, and the default expiry makes it a live link. **Matrix row:** §4 Sharing — "Person share via panel" and "Public link" (both are affected). Also relevant to §5 "Federated share … from the panel". **Steps** 1. files, as nikola-test: `_qa/qa-note.md` → pane → Shares. 2. Click "Search people and groups", type an address (here `sharer1@files-bao.c0rdyceps.ch`), and press **Enter**. This is the natural way to confirm a recipient. 3. The row immediately gets a **Public** chip. `GET /api/v1/shares` shows a new `kind: "link"` for `/home/nikola-test/_qa/qa-note.md`, created at 03:27:08Z, expiring 03:27:08Z the next day (the pre-filled default), with no password. **Root cause (from the live DOM):** the whole Shares drill is a single `<form>`. Its buttons are `Add: type=button`, `Copy: type=button` ×2, and **`Create link: type=submit`**, so Enter in *any* field of the panel (people search, and presumably the password field) submits the form and creates a public link. Nothing asks for confirmation and no toast appears. The only signal is the chip in the list behind the panel. **Expected:** Enter in the people field picks or adds the typed recipient, or does nothing. Creating a public link happens only through an explicit click on Create link. **Seen:** a public, passwordless, 24-hour link is created without the user knowing. Suggested fix: separate forms per section, or `type="button"` on Create link with Enter handled per field. It is also worth an audit of other panels built as one form (the policy page, dialogs). Cleanup note: the created link lives in `_qa` and will be revoked in the #656 cleanup batch. **Screenshot:** `680-enter-creates-public-link.jpg` (qa-note now shows "Public")