[Bug]: Video playback fails (503) on publicly shared albums - null user ID in DAV URL

[Sh4kE]

Bug description

When a Photos album is shared via public link and a visitor tries to play a video, the request fails with HTTP 503. Images in the same album work fine.

Steps to reproduce

1. Create an album in the Photos app containing videos (mp4)
2. Share the album via public link
3. Open the public share URL in a browser (without being logged in)
4. Try to play a video

Expected behavior

Video plays normally, same as when logged in.

Actual behavior

Video fails to load with HTTP 503. The browser makes requests to two URLs:

GET /public.php/dav/photospublic/{token}/video.mp4  → 503
GET /public.php/dav/files/null/{token}/video.mp4    → 503

Note the null user ID in the second URL — the Photos app cannot resolve the album owner when serving the request via a public share token, resulting in a broken DAV path.

The Nextcloud application log shows:

{
  "level": 3,
  "app": "no app in context",
  "method": "GET",
  "url": "/public.php/dav/photospublic/{token}/video.mp4",
  "message": "Exception thrown: Sabre\\DAV\\Exception\\NotFound",
  "exception": {
    "Exception": "Sabre\\DAV\\Exception\\NotFound",
    "Message": "",
    "File": "/var/www/html/apps/dav/lib/Connector/Sabre/PublicAuth.php",
    "Line": 133
  }
}

PublicAuth::checkToken() throws NotFound because album share tokens are not stored in the same share backend as regular file shares.

As a side effect, this triggers the brute-force protection, causing subsequent requests to be throttled (HTTP 429) even after the rate limit is reset.

Workaround

None found for album shares. Sharing the folder directly via the Files app (standard link share) works correctly for video streaming.

Environment

• Nextcloud version: 33.0.0
• Photos app version: 6.0.0-dev.0 (shipped with nextcloud:33.0.0-apache Docker image)
• Reverse proxy: Traefik v3
• Browser: Chrome 145 (Linux)

[Guillaume35]

I have the exact same issue with this config :

Environement

• Nextcloud : 33.0.0
• Photos : 6.0.0-dev.0
• System : nextcloud:fpm image on Docker
• Reverse proxy : Nginx on a docker container

Log

{
  "reqId": "SDUFswbu017ZFi7FzPf5",
  "level": 3,
  "time": "2026-03-09T22:38:13+00:00",
  "remoteAddr": "192.168.1.254",
  "user": "--",
  "app": "no app in context",
  "method": "GET",
  "url": "/public.php/dav/files/null/(token)/(file_name).mov",
  "scriptName": "/public.php",
  "message": "Exception thrown: Sabre\\DAV\\Exception\\NotFound",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0",
  "version": "33.0.0.16",
  "exception": {
    "Exception": "Sabre\\DAV\\Exception\\NotFound",
    "Message": "",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/html/apps/dav/lib/Connector/Sabre/PublicAuth.php",
        "line": 82,
        "function": "checkToken",
        "class": "OCA\\DAV\\Connector\\Sabre\\PublicAuth",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php",
        "line": 179,
        "function": "check",
        "class": "OCA\\DAV\\Connector\\Sabre\\PublicAuth",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php",
        "line": 135,
        "function": "check",
        "class": "Sabre\\DAV\\Auth\\Plugin",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
        "line": 89,
        "function": "beforeMethod",
        "class": "Sabre\\DAV\\Auth\\Plugin",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 456,
        "function": "emit",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          "beforeMethod:GET",
          [
            {
              "__class__": "Sabre\\HTTP\\Request"
            },
            {
              "__class__": "Sabre\\HTTP\\Response"
            }
          ]
        ]
      },
      {
        "file": "/var/www/html/apps/dav/lib/Connector/Sabre/Server.php",
        "line": 212,
        "function": "invokeMethod",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/var/www/html/apps/dav/appinfo/v2/publicremote.php",
        "line": 165,
        "function": "start",
        "class": "OCA\\DAV\\Connector\\Sabre\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/html/public.php",
        "line": 90,
        "args": [
          "/var/www/html/apps/dav/appinfo/v2/publicremote.php"
        ],
        "function": "require_once"
      }
    ],
    "File": "/var/www/html/apps/dav/lib/Connector/Sabre/PublicAuth.php",
    "Line": 133,
    "message": "",
    "exception": "{\"class\":\"Sabre\\DAV\\Exception\\NotFound\",\"message\":\"\",\"code\":0,\"file\":\"/var/www/html/apps/dav/lib/Connector/Sabre/PublicAuth.php:133\",\"trace\":\"#0 /var/www/html/apps/dav/lib/Connector/Sabre/PublicAuth.php(82): OCA\\DAV\\Connector\\Sabre\\PublicAuth->checkToken()\\n#1 /var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php(179): OCA\\DAV\\Connector\\Sabre\\PublicAuth->check(Object(Sabre\\HTTP\\Request), Object(Sabre\\HTTP\\Response))\\n#2 /var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php(135): Sabre\\DAV\\Auth\\Plugin->check(Object(Sabre\\HTTP\\Request), Object(Sabre\\HTTP\\Response))\\n#3 /var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\Auth\\Plugin->beforeMethod(Object(Sabre\\HTTP\\Request), Object(Sabre\\HTTP\\Response))\\n#4 /var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php(456): Sabre\\DAV\\Server->emit('beforeMethod:GE...', Array)\\n#5 /var/www/html/apps/dav/lib/Connector/Sabre/Server.php(212): Sabre\\DAV\\Server->invokeMethod(Object(Sabre\\HTTP\\Request), Object(Sabre\\HTTP\\Response))\\n#6 /var/www/html/apps/dav/appinfo/v2/publicremote.php(165): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#7 /var/www/html/public.php(90): require_once('/var/www/html/a...')\\n#8 {main}\"}",
    "CustomMessage": "Exception thrown: Sabre\\DAV\\Exception\\NotFound"
  },
  "id": "69af4d1c51970"
}