"Hide download" in public shares is no longer "hide download" but "prevent download" in Nextcloud 31

Since the migration of public shares to Vue enabling Hide download also removes the download permissions. But a hidden download is not the same as a disabled download; a hidden download does not disable the download, but simply removes the option from the UI (as some of the viewer apps (like the PDF viewer) need to actually download the file to be able to show it).

Note that just updating to Nextcloud 31 will not change the behaviour of existing shares. However, any share then marked as Hide download will behave as Prevent download.

If that new behaviour is intended then at least it should be documented to avoid surprises (some file types no longer viewable in public shares if download is hidden) for users coming from previous versions :-)

@marcoambrosini

@marcoambrosini @nfebe is this intended somehow but stopped "half way"? We should check this

In my opinion hide download should not prevent download, and one should still be able to open files with the browser

Preventing download breaks all functionality of how people want to share something. Let's say I want to share an mp3 or a video, and I use Hide Download, then I expect that the Download button is removed from the UI.

I don't expect that this breaks playing the mp3 or the video. The share is broken and useless.

I upgraded to NextCloud 31 and now I'm unable to share video hiding the download button.
Will be cool have NextCloud forbid download and not only hide the button but as is now is no more working.
I share a video then I want disable the download and cannot do because the video never play.
An example for the next 30 days: https://mbcloud.peopleinside.it/nxtc/index.php/s/sRMM3ParPSwHJcd

I reported this as soon I upgraded to the stable 31.
I hope a fix will come and I hope to see an improvement where video can play without be allowed to be download but... since this cannot be implemented was better as was working before; now is no more possible hide download because video cannot be played if the option is selected. From the browser console it gives 403 forbid to play the video.

For now I will use a custom CSS to hide the numerous new download button introduced in Nextcloud 31

/* NextCloud 31 fix download file */
.public-page-menu__wrapper {
	display: none !important;
}
.button-vue.button-vue--size-normal.button-vue--icon-and-text.button-vue--vue-secondary.action-item.action-item--single.files-list__row-actions-batch-download {
	display: none !important;
}
.action.files-list__row-action-download {
	display: none !important;
}
#trigger-menu-uwthl {
	display: none !important;
}
.header-actions.action-item.action-item--default-popover.action-item--tertiary {
	display: none !important;
}

I am using NextCloud 31.0.2.
The “Download” issue for public links seems to be totally broken.
The option “hide download” has no effect at all, and download is still displayed for the recipient, even if hide is selected. If someone then clicks on the now visible “Download” button, or on “Direct link”, he gets an error message that he has no access and can only get out if he goes back in the browser. Of course, this is not a good solution for people with whom you share something, as these are often people who don't have NextCloud themselves and don't even know it.

German:
Ich verwende NextCloud 31.0.2.
Das Thema «Download» für öffentliche Links scheint total nicht mehr richtig zu funktionieren.
Die Option «downloade verbergen» hat überhaupt keine Wirkung, und Download wird für den Empfänger immer noch angezeigt, auch wenn verbergen ausgewählt wurde. Klickt einer dann auf nun doch sichtbaren «Download» Button, oder auf «Direktlink», kommt er eine Fehlermeldung, dass man keinen Zugriff habe und kommt nur noch raus, wenn man im Browser zurück geht. So ist das natürlich für Leute, mit welchen man etwas teilt, keine gute Lösung, dann oft sind das Leute, welche selber kein NextCloud haben, es nicht einmal kennen.

I can confirm the issue remains on 31.0.3.

The browser makes a request to the server for the file i.e. /public.php/dav/files/44d8cBBCGTk3K8H/:1 which returns a 403 error. There are no traces in the server error logs.

in the browser console there is a wrong nonce error (see the console contents below), but it may be unrelated as the same error appears when a video is shared without ticking "Hide download".

I tried removing the Hide download flag from the share to see if it worked, and I could not: I just click on the Hide download checkbox, it is not toggled, and a notice appears that the 'hide-download' status was saved (so once it's enabled, it remains enabled).

Copy of the console showing the nonce error

index.mjs:51 [WARN] viewer: Some mimes were ignored because they are not enabled in the server previews config Object
log @ index.mjs:51
index.mjs:48 [INFO] viewer: 5 viewer handlers registered Object
session-heartbeat.js:83 session heartbeat polling started
index.mjs:54 [ERROR] Files_PDFViewer: But this does not appear to be a public page Object
log @ index.mjs:54
ServiceWorker.js:22 Refused to create a worker from 'https://cloud.example.com/index.php/apps/files/preview-service-worker.js' because it violates the following Content Security Policy directive: "script-src 'nonce-TyDllvNF7ac25XWQ8dD3xV5EGquEG5svmWvhzfe2NNo='". Note that 'worker-src' was not explicitly set, so 'script-src' is used as a fallback.

(anonymous) @ ServiceWorker.js:22
index.mjs:54 [ERROR] files: SW registration failed:  Object
log @ index.mjs:54
index.mjs:48 [INFO] viewer: Opening viewer for file  Object
44d8cBBCGTk3K8H:1 
            
            
           Failed to load resource: the server responded with a status of 403 (Forbidden)
/public.php/dav/files/44d8cBBCGTk3K8H/:1 
            
            
           Failed to load resource: the server responded with a status of 403 (Forbidden)
Videos.vue:181 Loading of file / failed, falling back to fetching it by hand
onFail @ Videos.vue:181
/public.php/dav/files/44d8cBBCGTk3K8H/:1 
            
            
           Failed to load resource: the server responded with a status of 403 (Forbidden)
/public.php/dav/files/44d8cBBCGTk3K8H/:1 
            
            
           Failed to load resource: the server responded with a status of 403 (Forbidden)
vue-async-computed.esm.js:194 Error evaluating async computed property: Error: Invalid response: 403 Forbidden
    at Rl (https://cloud.example.com/apps/viewer/js/logger-CSHmak5d.chunk.mjs:14:2474)
    at Pe (https://cloud.example.com/apps/viewer/js/logger-CSHmak5d.chunk.mjs:14:2714)
    at https://cloud.example.com/apps/viewer/js/logger-CSHmak5d.chunk.mjs:14:13324
    at async No (https://cloud.example.com/apps/viewer/js/viewer-init.mjs?v=adb124fd-11:4787:1173)
(anonymous) @ vue-async-computed.esm.js:194

I can also confirm that version 31.0.3 is still involved.

If the “Hide download” is enabled, it is not only not possible to download, it is also no longer possible to display any files in the browser.
That is not the idea behind this function.
Hide download should only be used to ensure that no document can be downloaded and at the same time hide the download Button.

Hide download should only be used to ensure that no document can be downloaded

Which it is doing: Showing in the browser will download the document, thats why it can only be viewed with Collabora because that is not downloading the document to the browser but uses some visualization that only will download some graphical representation of it.

But we are already working on bringing back the old behavior.

But we are already working on bringing back the old behavior.
I hope in the future the download can also be blocked.

For now let's wait a fix as I need completely hide with a CSS the many downloads button after the latest update

But we are already working on bringing back the old behavior.

Thanks for working on this, this is core functionality for us. We often want to share videos to preview while 'discouraging' downloading. It's fine if 'prevent download' is not bulletproof (as long as 'delete' is!).

I'm off to update to the latest version.

@boneycursor

@boneycursor
That's exactly how I see it. If you can't even look at the documents in the browser because you're not allowed to download them, the share is useless anyway.
For the normal user, it is sufficient to simply hide the download link and button if you don't want the documents to be so easy to download.
If you don't want to be able to download the documents at all, don't share your documents or set a password so that only those who have access to them can do so.

Hello. Can confirm that in version 31.0.4 (updated version) it still occurs.

In a fresh version 30 it doesn't occur.

@henmohr

Hello. Can confirm that in version 31.0.4 (updated version) it still occurs.

In a fresh version 30 it doesn't occur.

Hello @henmohr That should be because #52226 has not been merged.

Cc: @susnux

Hi,
Would it be possible to extend the "Hide Download" functionnality to internal shares ?

Navigation Menu

Repository navigation

"Hide download" in public shares is no longer "hide download" but "prevent download" in Nextcloud 31 #48954

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

"Hide download" in public shares is no longer "hide download" but "prevent download" in Nextcloud 31 #48954

Description

Activity

sorbaugh commented on Feb 18, 2025

marcoambrosini commented on Feb 28, 2025

chotaire commented on Feb 28, 2025

PeopleInside commented on Apr 4, 2025

MarkusGasser2 commented on Apr 7, 2025

riczorn commented on Apr 14, 2025

MarkusGasser2 commented on Apr 14, 2025

susnux commented on Apr 14, 2025

PeopleInside commented on Apr 14, 2025

boneycursor commented on Apr 22, 2025

MarkusGasser2 commented on Apr 23, 2025

henmohr commented on Apr 25, 2025

nfebe commented on Apr 26, 2025

infocillasas commented on Jun 30, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions