[Bug]: Custom share token can't equal any username, UI doesn't forbid it

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When setting custom share tokens, it is not checked if the share token equals someone's username, the UI doesn't show an error, the resulting share just doesn't work. Also, it allows setting multiple shares' tokens to the same value.

Steps to reproduce

1. Share a file in Nextcloud.
2. Edit its token to equal your username and save it. Observe that there's no error.
3. Copy the resulting link and open it in a private browsing window. Observe that it reports the share as not existing.
4. Repeat the above steps with another file and observe that there's no error about the token collision either.

Expected behavior

It should either allow tokens that equal usernames, or return an error to the user when attempting to create them.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "mydomain.tld"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/localhost",
        "dbtype": "mysql",
        "version": "34.0.2.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "theme": "",
        "loglevel": "0",
        "mysql.utf8mb4": true,
        "updater.release.channel": "stable",
        "has_rebuilt_cache": true,
        "app_install_overwrite": [
            "dicomviewer",
            "transmissionproxy",
            "apporder",
            "carnet",
            "transfer",
            "checksum",
            "cfg_share_links",
            "metadata",
            "files_mindmap",
            "breezedark",
            "extract"
        ],
        "default_phone_region": "HU",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": 1,
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "ssl",
        "mail_smtpport": "465",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "maintenance_window_start": 1,
        "memories.db.triggers.fcu": true,
        "memories.exiftool": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/exiftool-aarch64-glibc",
        "memories.vod.path": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/go-vod-aarch64",
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
        "memories.gis_type": 1,
        "enabledPreviewProviders": [
            "OC\\Preview\\Image",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\TIFF",
            "OC\\Preview\\Movie"
        ],
        "memcache.local": "\\OC\\Memcache\\APCu",
        "files.chunked_upload.max_size": 20971520,
        "has_internet_connection": true
    }
}

List of activated Apps

Enabled:
  - activity: 7.0.0
  - admin_audit: 1.24.0
  - app_api: 34.0.0
  - apporder: 0.15.0
  - appstore: 1.0.0
  - bruteforcesettings: 7.0.0
  - calendar: 6.5.2
  - checksum: 2.1.2
  - circles: 34.0.0
  - cloud_federation_api: 1.18.0
  - comments: 1.24.0
  - contacts: 8.7.5
  - contactsinteraction: 1.15.0
  - cospend: 4.0.2
  - dashboard: 7.14.0
  - dav: 1.39.0
  - deck: 1.18.3
  - extract: 1.3.6
  - federatedfilesharing: 1.24.0
  - federation: 1.24.0
  - files: 2.6.0
  - files_automatedtagging: 5.0.0
  - files_downloadlimit: 5.2.0
  - files_external: 1.26.0
  - files_lock: 34.0.1
  - files_pdfviewer: 7.0.0-dev.0
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - firstrunwizard: 7.0.0-dev.0
  - forms: 5.3.5
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - maps: 1.7.1
  - metadata: 0.24.0
  - news: 28.6.0
  - nextcloud_announcements: 6.0.0
  - notes: 6.0.1
  - notifications: 7.0.0-dev.1
  - oauth2: 1.22.0
  - office: 1.0.0
  - onlyoffice: 10.1.2
  - password_policy: 6.0.0-dev.0
  - photos: 7.0.0
  - privacy: 6.0.0-dev.1
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - recognize: 12.0.0
  - recommendations: 7.0.0
  - related_resources: 5.0.0-dev.0
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - support: 6.0.0
  - survey_client: 6.0.0-dev.0
  - systemtags: 1.24.0
  - text: 8.0.0
  - theming: 2.9.0
  - transfer: 1.0.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_nextcloud_notification: 8.0.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - user_status: 1.14.0
  - viewer: 7.0.0-dev.0
  - weather_status: 1.14.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0
Disabled:
  - audioplayer: 3.9.0 (installed 3.9.0)
  - breezedark: 29.0.0 (installed 29.0.0)
  - carnet: 0.25.13 (installed 0.25.13)
  - cfg_share_links: 7.0.1 (installed 7.0.1)
  - dicomviewer: 2.3.3 (installed 2.3.3)
  - encryption: 2.22.0
  - external: 9.0.1 (installed 9.0.1)
  - memories: 8.0.1 (installed 8.0.1)
  - music: 3.1.0 (installed 3.1.0)
  - previewgenerator: 5.14.0 (installed 5.14.0)
  - richdocuments: 11.0.0 (installed 11.0.0)
  - richdocumentscode_arm64: 26.4.104 (installed 26.4.104)
  - spreed: 24.0.1 (installed 24.0.1)
  - suspicious_login: 12.0.0-dev.0 (installed 12.0.0-dev.0)
  - testing: 1.23.0
  - twofactor_webauthn: 2.7.0 (installed 2.7.0)
  - user_ldap: 1.25.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Additional info

No response

Start by reproducing the custom share-token collision from the issue steps, then trace the token editing UI and the corresponding share-creation flow. Check both username collisions and duplicate share tokens; the work is done when the behavior is consistently supported or rejected with a visible error.