[Bug]: The inability to download files from a public link using the federation

[Elecktro1337]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

A bundle of two servers connected to each other through a federation. Both servers use NextCloud AIO and both are updated to the latest version.

Server No. 1 - Major
Server No. 2 - Minor

From the Major server, we share the file with the Minor server, after which we create a public link to the received file on the minor server.
When opening the link, only the file name and the basic interface of Next Cloud are visible. In the case of text files, a preview is visible. The documents hang on loading, and the pictures just don't display the preview.

In the opposite direction (from minor to major) - everything is working normally.

Steps to reproduce

1.Share a file from one server to another via federated access
2.Create a public link with viewing access to the file

Expected behavior

Share the file via federated access, create a public link, and be able to download the file via a public link and/or preview.

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

None

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

SERVER MINOR
{
    "system": {
        "one-click-instance": true,
        "one-click-instance.user-limit": 100,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "check_data_directory_permissions": false,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "overwritehost": "cloud.alians-kmv.ru",
        "overwriteprotocol": "https",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "cloud.alians-kmv.ru",
            "213.139.211.85"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "30.0.6.2",
        "overwrite.cli.url": "https:\/\/cloud.alians-kmv.ru\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "loglevel": 1,
        "log_type": "file",
        "logfile": "\/var\/www\/html\/data\/nextcloud.log",
        "log_rotate_size": 10485760,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "preview_max_x": 2048,
        "preview_max_y": 2048,
        "jpeg_quality": 60,
        "enabledPreviewProviders": {
            "1": "OC\\Preview\\Image",
            "2": "OC\\Preview\\MarkDown",
            "3": "OC\\Preview\\MP3",
            "4": "OC\\Preview\\TXT",
            "5": "OC\\Preview\\OpenDocument",
            "6": "OC\\Preview\\Movie",
            "7": "OC\\Preview\\Krita",
            "0": "OC\\Preview\\Imaginary",
            "23": "OC\\Preview\\ImaginaryPDF"
        },
        "enable_previews": true,
        "upgrade.disable-web": true,
        "mail_smtpmode": "smtp",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 30",
        "activity_expire_days": 30,
        "simpleSignUpLink.shown": false,
        "share_folder": "\/Shared",
        "one-click-instance.link": "https:\/\/nextcloud.com\/all-in-one\/",
        "upgrade.cli-upgrade-link": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/2726",
        "updatedirectory": "\/nc-updater",
        "maintenance_window_start": 100,
        "allow_local_remote_servers": true,
        "davstorage.request_timeout": 3600,
        "documentation_url.server_logs": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/5425",
        "htaccess.RewriteBase": "\/",
        "dbpersistent": false,
        "auth.bruteforce.protection.enabled": true,
        "ratelimit.protection.enabled": true,
        "files_external_allow_create_new_local": false,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
        "preview_imaginary_key": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "defaultapp": "",
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "everyone"
        ],
        "twofactor_enforced_excluded_groups": [],
        "default_phone_region": "RU",
        "skeletondirectory": "",
        "DOMAIN": "cloud.alians-kmv.ru"
    }
}

SERVER MAJOR
{
    "system": {
        "one-click-instance": true,
        "one-click-instance.user-limit": 100,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "check_data_directory_permissions": false,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "overwritehost": "cloud.erranix.agency",
        "overwriteprotocol": "https",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": {
            "0": "localhost",
            "3": "62.217.179.34",
            "1": "cloud.erranix.agency"
        },
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "30.0.5.1",
        "overwrite.cli.url": "https:\/\/cloud.erranix.agency\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "loglevel": 2,
        "log_type": "file",
        "logfile": "\/var\/www\/html\/data\/nextcloud.log",
        "log_rotate_size": 10485760,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "preview_max_x": 2048,
        "preview_max_y": 2048,
        "jpeg_quality": 60,
        "enabledPreviewProviders": {
            "1": "OC\\Preview\\Image",
            "2": "OC\\Preview\\MarkDown",
            "3": "OC\\Preview\\MP3",
            "4": "OC\\Preview\\TXT",
            "5": "OC\\Preview\\OpenDocument",
            "6": "OC\\Preview\\Movie",
            "7": "OC\\Preview\\Krita",
            "0": "OC\\Preview\\Imaginary",
            "23": "OC\\Preview\\ImaginaryPDF"
        },
        "enable_previews": true,
        "upgrade.disable-web": true,
        "mail_smtpmode": "smtp",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 30",
        "activity_expire_days": 30,
        "simpleSignUpLink.shown": false,
        "share_folder": "\/\u041e\u0431\u0449\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f",
        "one-click-instance.link": "https:\/\/nextcloud.com\/all-in-one\/",
        "upgrade.cli-upgrade-link": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/2726",
        "updatedirectory": "\/nc-updater",
        "maintenance_window_start": 100,
        "allow_local_remote_servers": true,
        "davstorage.request_timeout": 3600,
        "documentation_url.server_logs": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/5425",
        "htaccess.RewriteBase": "\/",
        "dbpersistent": false,
        "auth.bruteforce.protection.enabled": true,
        "ratelimit.protection.enabled": true,
        "files_external_allow_create_new_local": false,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
        "preview_imaginary_key": "***REMOVED SENSITIVE VALUE***",
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "Staff"
        ],
        "twofactor_enforced_excluded_groups": [
            "Clients"
        ],
        "defaultapp": "",
        "app_install_overwrite": [
            "stt_whisper",
            "webhooks"
        ],
        "mail_smtpauth": 1,
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": true,
                "verify_peer": false,
                "verify_peer_name": false
            }
        },
        "skeletondirectory": "\/mnt\/ncdata\/skeleton",
        "default_phone_region": "RU",
        "blacklisted_files": [],
        "DOMAIN": "cloud.erranix.agency"
    }
}

List of activated Apps

SERVER MINOR
Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - announcementcenter: 7.1.0
  - bruteforcesettings: 3.0.0
  - calendar: 5.2.0
  - camerarawpreviews: 0.8.6
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contacts: 7.0.4
  - contactsinteraction: 1.11.0
  - dashboard: 7.10.0
  - dav: 1.31.1
  - deck: 1.14.4
  - external: 5.5.2
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_downloadactivity: 1.17.0
  - files_downloadlimit: 3.0.0
  - files_external: 1.22.0
  - files_pdfviewer: 3.0.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - forms: 5.0.4
  - group_everyone: 0.1.17
  - impersonate: 1.17.1
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - mail: 4.3.1
  - metadata: 0.22.0
  - nextcloud-aio: 0.7.0
  - nextcloud_announcements: 2.0.0
  - notes: 4.11.0
  - notifications: 3.0.0
  - notify_push: 1.0.0
  - oauth2: 1.18.1
  - password_policy: 2.0.0
  - passwords: 2025.2.20
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - quota_warning: 1.21.0
  - richdocuments: 8.5.5
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - support: 2.0.0
  - suspicious_login: 8.0.0
  - systemtags: 1.20.0
  - text: 4.1.0
  - theming: 2.6.0
  - twofactor_backupcodes: 1.19.0
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - user_migration: 7.0.1
  - user_status: 1.10.0
  - users_picker: 1.2.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - welcome: 1.2.1
  - whiteboard: 1.0.5
  - workflowengine: 2.12.0
Disabled:
  - app_api: 4.0.6 (installed 4.0.3)
  - circles: 30.0.0 (installed 30.0.0)
  - encryption: 2.18.0
  - files_reminders: 1.3.0 (installed 1.3.0)
  - firstrunwizard: 3.0.0 (installed 3.0.0)
  - photos: 3.0.2 (installed 3.0.2)
  - recommendations: 3.0.0 (installed 3.0.0)
  - related_resources: 1.5.0 (installed 1.5.0)
  - survey_client: 2.0.0 (installed 2.0.0)
  - user_ldap: 1.21.0

SERVER MAJOR 
Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - announcementcenter: 7.1.0
  - bruteforcesettings: 3.0.0
  - calendar: 5.2.0
  - camerarawpreviews: 0.8.6
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contacts: 7.0.4
  - contactsinteraction: 1.11.0
  - dashboard: 7.10.0
  - dav: 1.31.1
  - deck: 1.14.4
  - external: 5.5.2
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_downloadactivity: 1.17.0
  - files_downloadlimit: 3.0.0
  - files_external: 1.22.0
  - files_fulltextsearch: 31.0.0
  - files_pdfviewer: 3.0.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - forms: 5.0.4
  - fulltextsearch: 30.0.1
  - fulltextsearch_elasticsearch: 30.0.1
  - group_everyone: 0.1.17
  - groupfolders: 18.1.2
  - impersonate: 1.17.1
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - mail: 4.3.1
  - metadata: 0.22.0
  - nextcloud-aio: 0.7.0
  - nextcloud_announcements: 2.0.0
  - notes: 4.11.0
  - notifications: 3.0.0
  - notify_push: 1.0.0
  - oauth2: 1.18.1
  - password_policy: 2.0.0
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - quota_warning: 1.21.0
  - richdocuments: 8.5.5
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - spreed: 20.1.5
  - support: 2.0.0
  - suspicious_login: 8.0.0
  - systemtags: 1.20.0
  - talk_matterbridge: 1.31.1026000
  - text: 4.1.0
  - theming: 2.5.0
  - twofactor_backupcodes: 1.19.0
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - user_migration: 7.0.1
  - user_status: 1.10.0
  - users_picker: 1.2.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - welcome: 1.2.1
  - workflowengine: 2.12.0
Disabled:
  - app_api: 4.0.5 (installed 4.0.3)
  - circles: 30.0.0 (installed 30.0.0)
  - encryption: 2.18.0
  - files_reminders: 1.3.0 (installed 1.3.0)
  - firstrunwizard: 3.0.0 (installed 3.0.0)
  - photos: 3.0.2 (installed 3.0.2)
  - recommendations: 3.0.0 (installed 3.0.0)
  - related_resources: 1.5.0 (installed 1.5.0)
  - survey_client: 2.0.0 (installed 2.0.0)
  - user_ldap: 1.21.0

Nextcloud Signing status

SERVER MAJOR: No errors have been found.
SERVER MINOR: No errors have been found.

Nextcloud Logs

https://pastebin.com/dtLzDiL0

Very long content, so I use pastebin.

Additional info

No response

[gdnmhr]

Related issues regarding recent (undocumented, breaking) changes to the download permissions and the inability to allow download for federated reshares:

• Nextcloud Hub 10 (v 31.0.0) "Allow download and sync" feature (Files) : bugs or features ? #51129
• "Hide download" in public shares is no longer "hide download" but "prevent download" in Nextcloud 31 #48954
• [Bug]: Public links with "Hide Download" option do not preview #51358
• [Bug]: Federation: "Allow download and sync" cannot be checked, breaking local reshares #51245
• [Bug]: Previews and Download not available for Link Shares of Remote Shares #51569
• [Bug]: Hide download in share creation is not retained after it is checked while share is created #50788

The combination of federation & those changes make it impossible to share files. I really hope those issues are addresses soon, sharing is one of the core features of nextcloud but currently completely broken.