[Bug]: Display "Forgot Password?" during publicshareauth even there is no chance to successfully change your password

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Current relevant config

• public shares allowed to all users and groups
• public users are private contacts only
• administration settings at "Share by Mail" -> Send password by mail = disabled, Reply to initiator = enabled

Current behavior

• when a NC user shares a file to an external via mail ( with expiration date and password )
  • a mail with the sharelink and expiration date is send to the mail address of the external -> perfect
  • a mail with the password is send to the mail address of the initiator -> perfect
  • a public share link is created and the file is protected by a password -> perfect
  • beside the password filed, the public share link includes "request password button" option -> here the problem starts
  • if the external click the "Forgot Password?" link at the public share link, the external could request a new password via mail even this mail will never be send to the external based at administrative setting "Send password by mail = disabled"
  • indepentent from this, the password will be changed and the initiator is not able to override it. Workaroud is deleting the publicshare and create a new share.
  • in addition to that, a link to the default login page is provided to the external to achieve maximum confusion

Steps to reproduce

1. follow the default process stepsto share a file ith an external and open the public share link
2. click "Forgot Password?" and at the next page
3. request a new password
4. go back and try the old and correct password

Expected behavior

• beside the password filed, the public share link "DOES NOT INCLUDE a "request password button" option

  • from administraive perspective this means, if administration settings at "Share by Mail" -> Send password by mail = disabled
  • then bypas/drop "" at www/core/templates/publicshareauth.php
  getShareType() === $_['share']::TYPE_EMAIL && !$_['share']->getSendPasswordByTalk()): ?>

    <a id="request-password-button-not-talk"><?php p($l->t('Forgot password?')); ?></a>
  

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

None

Web server

Apache (supported)

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

Start with www/core/templates/publicshareauth.php and review the existing Forgot password condition alongside the Share by Mail setting for sending passwords. Reproduce the listed public-share flow, then verify that the request-password option is absent when sending passwords by mail is disabled and that the protected share still works with its original password.