SECURITY: Fix potential password bypass vulnerability by:
Frontend changes:
- Add password_hash field to Share interface
- Only show direct download button for single files without password protection
- Update hasDownloadLink() to check both file type and password status
Backend changes:
- Remove token-based authentication bypass for password-protected shares
- Enforce password authentication for all protected shares, even with valid tokens
- Add security comments explaining the rationale
This ensures that password-protected shares cannot be accessed via direct
download links, closing the security vulnerability while preserving the
convenience of direct downloads for public shares.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
aa0338a1c4