[DerDreschner]

• Resolves: [Bug]: Password-protected share email exposes database password hash instead of plaintext in 35.0.2 #65479

Summary

Since ee1feb8 (which was backported to stable35 with #64892 ), the sent passwords when using share-by-mail are hashes and not the plaintext passwords anymore. This is kinda intentional, as the providers themselves should now only contain hashed passwords. To fix that, the manager itself needs to keep the plaintext password and use that when mailing the receiver of a share.

This PR also fixes code that Claude detected as dead in later iterations, but as I plan to do a backport, I'll remove that in a separate PR.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI

[DerDreschner]

/backport to stable35

[Copilot]

🟢 Approval recommended

Static review found no blocking issues, and regression tests cover the changed behavior; tests were not executed.

0 open findings

What changed in this PR

Fixes #65479 by sending readable share-by-mail passwords while preserving hashed passwords in storage.

Changes:

• Retains caller-provided plaintext passwords for email notifications.
• Handles generated passwords and prevents mailing password hashes.
• Adds regression tests for password storage and notification behavior.

File	Description
tests/​lib/​Share20/​ManagerTest.php	Tests plaintext notifications and hashed return values.
lib/​private/​Share20/​Manager.php	Passes plaintext passwords through a notification-only share clone.
apps/​sharebymail/​tests/​ShareByMailProviderTest.php	Tests supplied hashes, generated passwords, and hash suppression.
apps/​sharebymail/​lib/​ShareByMailProvider.php	Preserves generated plaintext for notification and skips mailing hashes.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

This pull request has been automatically locked because it has been closed for more than 7 days. As we do not monitor merged or closed pull requests, we are locking this pull request to prevent further comments from getting lost in the noise.
If you discovered any issues with this pull request, please open a new issue instead. In case you want to discuss this pull request or have further questions, please use our forum: https://help.nextcloud.com