Enforce the share password on the public audio endpoints

[MiMoHo]

Enforce the share password on the public audio endpoints

Problem

MusicService::getPublicAudioInfo() and createPublicAudioStream() resolve a public share by token via getShareByToken() and then serve its metadata / audio bytes without ever checking the share password (these are plain #[PublicPage] controller methods, so the framework's public-share password middleware never runs):

$share = $this->shareManager->getShareByToken($token);
// ... reads and streams the file, no password check

Any holder of a password-protected public share's token (but not its password) can therefore read the metadata and stream the audio, bypassing the password.

Fix

Gate both endpoints on the same session authentication core uses for password-protected public shares (\OCP\AppFramework\PublicShareController::DAV_AUTHENTICATED_FRONTEND). Non-password shares are unaffected; a password-protected share is only served when the current session has authenticated to that token with a matching password hash.

Testing (reproduced live on a Nextcloud 35 instance)

Password-protected public folder share of an audio file, requested by a different authenticated user who has neither the file nor the password:

step	before	after
stream password-protected share (no password)	200 + file bytes leaked	denied, no bytes
direct WebDAV to the same file	404 (denied)	404 (denied)
stream a non-password public share (regression)	200 + bytes	200 + bytes (unchanged)

🤖 Disclosure: prepared by Claude Code – Opus 4.8 (xhigh)