download do not get deleted upon deletion of referenced file - possible information leakage

[muellefr]

We noticed a strange beahavior, that we consider a bug:

After deleting a file that was shared via download-link, he added a file with the same name. The newly created file was still accessible through the prior created download-link. We think, this is a bug and the download-link should get deleted with the file. Otherwise the user could leak information, without noticing.

Howto reproduce:

• add file "test.md"
• create download-link for "test.md"
• delete "test.md"
• create new file "test.md"
• test formerly created download-link

Possible solutions:

• check for download-links upon deletion of file or folder and delete them with the file/folder
• use unique file-id as reference in download-links (like the internal link does)
• ...

Thank you for looking into this!

regards