fix(sharing): enforce the read permission in the public preview endpoint (full-ci)

[DeepDiver1975]

Description

The public share preview endpoint (apps/files_sharing/ajax/publicpreview.php) resolved the share by token and rendered the requested file without ever consulting the share's permission bitmask. It now returns 404 when the share does not carry PERMISSION_READ.

This makes the endpoint consistent with the two sibling paths that serve content from a public link, both of which already enforced the read bit:

• ShareController::downloadShare() — apps/files_sharing/lib/Controllers/ShareController.php:434
• the public WebDAV route, via the PermissionsMask storage wrapper — apps/dav/appinfo/v1/publicwebdav.php:88

The check is deliberately placed before any file name is resolved, so the response does not vary with the requested name.

Related Issue

n/a — reported privately.

Motivation and Context

publicpreview.php was the only content-serving public-link path without a permission check, so its behaviour diverged from downloadShare() and public WebDAV for shares that do not grant read access.

How Has This Been Tested?

• test environment: PHP 8.3.32, local checkout
• php -l apps/files_sharing/ajax/publicpreview.php — no syntax errors
• php-cs-fixer with the ownCloud coding standard — 0 of 1 files fixable
• apps/files_sharing/tests/Controllers/ShareControllerTest.php — 12 tests, 45 assertions, OK
• Permission matrix reviewed: create-only (4) → 404; read (1), read+create (5), change (15) and all (31) are unaffected, so the four pre-existing scenarios that expect 200 from this endpoint still hold
• Two acceptance scenarios added in tests/acceptance/features/apiSharePublicLink1/accessToPublicLinkShare.feature, covering an uploadwriteonly public link share. These run in CI (this PR is titled full-ci so the apiSharePublicLink1 suite executes); they were not run locally as no server is available in that environment.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Database schema changes (next release will require increase of minor version instead of patch)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:
• Changelog item, see TEMPLATE

🤖 Generated with Claude Code