Public and email-share uploads are recorded as file_created instead of public_links_upload, preventing email notifications

[Ayumey]

Issue body

Bug description

Anonymous uploads through both:

• an upload-only public link, and
• a folder shared by email with an external recipient without a Nextcloud account

are incorrectly classified by the Activity app.

The uploads complete successfully and are displayed in the Activity feed. However, no activity email is sent, even though the corresponding email notification is enabled and activity emails are configured to be sent as soon as possible.

Steps to reproduce

1. Log in as a local Nextcloud user.
2. Enable the email notification:
3. Files have been uploaded to a folder shared by mail or by public link.
4. Configure activity emails to be sent As soon as possible.
5. Create a folder.
6. Create an upload-only/file-drop public link for the folder.
7. Open the link in a private browser window without being logged into Nextcloud.
8. Upload a file.
9. Wait for the background job to run.
10. Check the Activity feed, email inbox and oc_activity.
11. Repeat the test with a folder shared by email with an external recipient who has no Nextcloud account.

Expected behaviour

For both public-link and email-share uploads, the following activity should be created:

type: public_links_upload
subject: created_public

The folder owner should receive an activity email because the following notification is enabled:

Files have been uploaded to a folder shared by mail or by public link

Actual behaviour

No activity email is sent.

The file is uploaded successfully and appears in the Activity feed, but it is recorded as an ordinary file creation event:

type: file_created
subject: created_by
user: empty

The following query was used to inspect the activity records:

SELECT activity_id, affecteduser, user, type, subject, file,
       FROM_UNIXTIME(timestamp) AS created
FROM oc_activity
WHERE file LIKE '%dani_avatar.png%'
ORDER BY activity_id DESC
LIMIT 5;

Result for an upload through a public file-drop link:

activity_id: 167294
affecteduser: nextcloudadmin
user:
type: file_created
subject: created_by
file: /dani-testing-link/dani_avatar.png
created: 2026-08-07 18:43:52

Result for an upload through an email share:

activity_id: 167282
affecteduser: nextcloudadmin
user:
type: file_created
subject: created_by
file: /Danis-Testing-Folder/heal.jpg
created: 2026-08-07 09:20:25

SMTP itself works. For example, the separate share-password email is delivered successfully.

No related errors are present in nextcloud.log.

The external uploader is not logged in and does not have a Nextcloud account.

Possible regression

The problem was first noticed in production after upgrading to Nextcloud 33.0.6 on 23 July 2026.

It has been reproduced on a separate test instance with:

Nextcloud Server 33.0.6
Nextcloud Server 33.0.7
Activity app 6.0.0

The behaviour may be related to nextcloud/activity#2431.

That change requires an anonymous request to additionally be recognized by CurrentUser::isPublicShareToken(), which appears to rely on PHP_AUTH_USER.

For the affected requests, the Activity app sees an empty user but apparently does not recognize the public share token. It consequently creates a regular file_created / created_by activity instead of public_links_upload / created_public.

The public upload itself succeeds, which means that access to the share and the upload are otherwise accepted.

A similar report for Nextcloud 33.0.3 can be found in the Nextcloud community forum.

Server configuration

Web server: Nginx 1.31.1 (nginx-unprivileged:alpine)

PHP runtime: PHP-FPM Alpine container

Database: MySQL

PHP version: 8.4.24

Nextcloud version: 33.0.7.1 (versionstring: 33.0.7)

Activity app version: 6.0.0

Installation: Containerized Kubernetes deployment

Background jobs: Cron, executed every five minutes

Maintenance mode: Disabled

Database upgrade required: No

App list

Enabled:

• activity: 6.0.0
• admin_audit: 1.23.0
• announcementcenter: 7.5.0
• app_api: 33.0.0
• bruteforcesettings: 6.0.0
• checksum: 2.1.2
• cloud_federation_api: 1.17.0
• comments: 1.23.0
• contactsinteraction: 1.14.1
• dav: 1.36.0
• drawio: 4.3.5
• encryption: 2.21.0
• external: 8.0.1
• federatedfilesharing: 1.23.0
• files: 2.5.0
• files_antivirus: 6.3.2
• files_automatedtagging: 4.0.0
• files_downloadlimit: 5.1.0
• files_pdfviewer: 6.0.0
• files_reminders: 1.6.0
• files_retention: 4.0.1
• files_sharing: 1.25.2
• files_trashbin: 1.23.0
• files_versions: 1.26.0
• flow_notifications: 4.0.0
• impersonate: 4.0.0
• logreader: 6.0.0
• lookup_server_connector: 1.21.0
• metadata: 0.24.0
• nextcloud_announcements: 5.0.0
• notifications: 6.0.0
• oauth2: 1.21.0
• password_policy: 5.0.0
• photos: 6.0.0
• privacy: 5.0.0
• profile: 1.2.0
• provisioning_api: 1.23.0
• recommendations: 6.0.0
• related_resources: 4.0.0
• serverinfo: 5.0.0
• settings: 1.16.0
• sharebymail: 1.23.0
• sharereview: 2.3.0
• support: 5.0.0
• survey_client: 5.0.0
• systemtags: 1.23.0
• text: 7.0.1
• theming: 2.8.0
• theming_customcss: 1.21.0
• twofactor_backupcodes: 1.22.0
• twofactor_nextcloud_notification: 7.0.0
• twofactor_totp: 15.0.0
• updatenotification: 1.23.0
• user_migration: 10.4.0
• user_saml: 8.2.0
• user_status: 1.13.0
• user_usage_report: 4.0.0
• viewer: 6.0.0
• weather_status: 1.13.0
• webhook_listeners: 1.5.0
• workflowengine: 2.15.0

Disabled:

• circles: 33.0.0 (installed 26.0.0)
• dashboard: 7.13.0 (installed 7.5.0)
• federation: 1.23.0 (installed 1.21.0)
• files_downloadactivity: 1.18.1 (installed 1.18.1)
• files_external: 1.25.1 (installed 1.18.0)
• files_mindmap: 0.0.34 (installed 0.0.33)
• files_rightclick: 0.15.1 (installed 1.6.0)
• firstrunwizard: 6.0.0 (installed 5.0.0)
• guests: 4.9.0 (installed 4.9.0)
• suspicious_login: 11.0.0 (installed 4.4.0)
• user_ldap: 1.24.0 (installed 1.21.0)

Nextcloud system configuration

{
"system": {
"memcache.local": "\OC\Memcache\APCu",
"apps_paths": [
{
"path": "/var/www/html/apps",
"url": "/apps",
"writable": false
},
{
"path": "/var/www/html/custom_apps",
"url": "/custom_apps",
"writable": true
}
],
"memcache.distributed": "\OC\Memcache\Redis",
"memcache.locking": "\OC\Memcache\Redis",
"redis": {
"host": "REMOVED SENSITIVE VALUE",
"password": "REMOVED SENSITIVE VALUE",
"port": 6379
},
"mail_smtpport": "587",
"mail_smtpauth": true,
"mail_smtpauthtype": "LOGIN",
"mail_smtpname": "REMOVED SENSITIVE VALUE",
"mail_smtppassword": "REMOVED SENSITIVE VALUE",
"passwordsalt": "REMOVED SENSITIVE VALUE",
"instanceid": "REMOVED SENSITIVE VALUE",
"secret": "REMOVED SENSITIVE VALUE",
"trusted_domains": [
"REMOVED SENSITIVE VALUE"
],
"trusted_proxies": "REMOVED SENSITIVE VALUE",
"datadirectory": "REMOVED SENSITIVE VALUE",
"dbtype": "mysql",
"version": "33.0.7.1",
"enable_previews": true,
"overwrite.cli.url": "REMOVED SENSITIVE VALUE",
"dbname": "REMOVED SENSITIVE VALUE",
"dbhost": "REMOVED SENSITIVE VALUE",
"dbport": "",
"dbtableprefix": "oc_",
"mysql.utf8mb4": true,
"dbuser": "REMOVED SENSITIVE VALUE",
"dbpassword": "REMOVED SENSITIVE VALUE",
"installed": true,
"ldapUserCleanupInterval": "20",
"maintenance": false,
"skeletondirectory": "",
"mail_sendmailmode": "smtp",
"has_internet_connection": "false",
"default_phone_region": "ch",
"default_locale": "de_CH",
"default_language": "de",
"simpleSignUpLink.shown": false,
"loglevel": 1,
"log_rotate_size": "5242880000",
"mail_smtphost": "REMOVED SENSITIVE VALUE",
"mail_from_address": "REMOVED SENSITIVE VALUE",
"mail_domain": "REMOVED SENSITIVE VALUE",
"theme": "",
"htaccess.RewriteBase": "/",
"forwarded_for_headers": [
"HTTP_X_FORWARDED_FOR"
],
"mail_smtpsecure": "tls",
"trashbin_retention_obligation": "auto, 30",
"overwriteprotocol": "https",
"lost_password_link": "disabled",
"twofactor_enforced": "false",
"twofactor_enforced_groups": [
"guest_app"
],
"twofactor_enforced_excluded_groups": [],
"proxyexclude": [
"REMOVED SENSITIVE VALUE"
],
"proxy": "REMOVED SENSITIVE VALUE",
"files.chunked_upload.max_size": 52428800,
"app_install_overwrite": [],
"upgrade.disable-web": true,
"activity_expire_days": 180,
"enabledPreviewProviders": [
"OC\Preview\Movie",
"OC\Preview\PNG",
"OC\Preview\JPEG",
"OC\Preview\GIF",
"OC\Preview\BMP",
"OC\Preview\XBitmap",
"OC\Preview\MP3",
"OC\Preview\MP4",
"OC\Preview\TXT",
"OC\Preview\MarkDown",
"OC\Preview\PDF"
],
"mail_smtpmode": "smtp",
"openmetrics_allowed_clients": [
"REMOVED SENSITIVE VALUE"
]
}
}

Browser

Browser name: Firefox

Browser version: 153

Operating system: Windows 11

No related JavaScript or browser error was observed. The upload completes successfully; the problem occurs when the server creates and classifies the Activity event.