ITADN

[Bug]: Video playback fails (503) on publicly shared albums - null user ID in DAV URL

#3442OpenSh4kE 创建于 2026-02-28
S
Sh4kEcommented
## Bug description When a Photos album is shared via public link and a visitor tries to play a video, the request fails with HTTP 503. Images in the same album work fine. ## Steps to reproduce 1. Create an album in the Photos app containing videos (mp4) 2. Share the album via public link 3. Open the public share URL in a browser (without being logged in) 4. Try to play a video ## Expected behavior Video plays normally, same as when logged in. ## Actual behavior Video fails to load with HTTP 503. The browser makes requests to two URLs: ``` GET /public.php/dav/photospublic/{token}/video.mp4 → 503 GET /public.php/dav/files/null/{token}/video.mp4 → 503 ``` Note the `null` user ID in the second URL — the Photos app cannot resolve the album owner when serving the request via a public share token, resulting in a broken DAV path. The Nextcloud application log shows: ```json { "level": 3, "app": "no app in context", "method": "GET", "url": "/public.php/dav/photospublic/{token}/video.mp4", "message": "Exception thrown: Sabre\\DAV\\Exception\\NotFound", "exception": { "Exception": "Sabre\\DAV\\Exception\\NotFound", "Message": "", "File": "/var/www/html/apps/dav/lib/Connector/Sabre/PublicAuth.php", "Line": 133 } } ``` `PublicAuth::checkToken()` throws `NotFound` because album share tokens are not stored in the same share backend as regular file shares. As a side effect, this triggers the brute-force protection, causing subsequent requests to be throttled (HTTP 429) even after the rate limit is reset. ## Workaround None found for album shares. Sharing the folder directly via the Files app (standard link share) works correctly for video streaming. ## Environment - Nextcloud version: 33.0.0 - Photos app version: 6.0.0-dev.0 (shipped with `nextcloud:33.0.0-apache` Docker image) - Reverse proxy: Traefik v3 - Browser: Chrome 145 (Linux)
0 条评论