[Bug]: Password handling for public links

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Password protection for public share links in read-only mode is broken. Passwords are not generated, not applied, or disappear when displayed.

Steps to reproduce

Password generation does not work
1.Create a public share link.
2.Set permissions to Read-only.
3.Click on Generate password.

Manually entered password is not applied

1. Create a public share link.
2. Manually enter a password.
3. Copy and open the public link in a private/incognito browser window.

Password disappears when clicking the eye icon

1. Enter a password manually in the share dialog.
2. Click the eye icon to display the password.

Expected behavior

Password generation does not work
A password should be automatically generated and assigned to the share link.

Manually entered password is not applied
The link should prompt for the password before allowing access.

Password disappears when clicking the eye icon
The password should become visible.

Nextcloud Server version

32

Operating system

RHEL/CentOS

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

Issue occurs consistently.

Workaround: Works via Windows Explorer / NextCloud Client

No files or tests are named in the report. Start by reproducing the three failures from the public share dialog and the resulting link, then trace the public-link password handling entry points. Done means generated and manually entered passwords are assigned, retained, displayed by the eye control, and required before read-only link access.