Sharing Links with password can be accessed without password

[Crashman1983]

Describe the bug

I am logged in with my personal account, which is admin.
I want to share a directory with several subdirectories. Therefore I created a share link for the top level directory. I limited the link to 30d and set a password.

When I open the newly created share link in a private browser window or on a different client (smartphone) it will open the link and show the gallery without asking for password. The user shown is "guest" which was not configured before.

I cannot protect a share link with a password. I would expect PiGallery2 to ask for a password before showing the directory content.

Environment (please complete the following information):

• OS: linux, docker
• Browser: safari, edge

Used app version:

• release v2.0 (docker)

[luxmentis]

Same problem here. Password-protected shares behave as if they have no password and let you straight in.

I know there are a lot of outstanding issues, but this feels like a fairly major one.

Also running v2.0 on Docker.

[israel-lugo]

Is there any news on this? I also have observed the same issue and can't trust sharing because of it. This is a serious security/privacy problem.

I created a share with a password. Opening the share link on a private browser window takes me straight to the photos, with a "Guest" user. No prompt for password.

If I hit Back a couple of times eventually I do get thrown into a password prompt, but by then it's too late.

Also running v2.0.0 on Docker.

[israel-lugo]

Tagging @bpatrik for awareness