[Bug]: "Album #1" is not allowed as an album name. "#" not allowed in album name

[R2019-github]

⚠️ This issue respects the following points: ⚠️

• [X] This is a bug, not a question or a configuration/webserver/proxy issue.
• [X] This issue is not already reported on Github (I've searched it).
• [X] Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• [X] Nextcloud Server is running on 64bit capable CPU, PHP and OS.
• [X] I agree to follow Nextcloud's Code of Conduct.

Bug description

Under Photos, it is possible to create albums containing a # in the name (like Album #1) and to associate photos with them. This album is well presented under the "Albums" access. The number of photos it contains is correctly indicated. However, when clicking on this album, an error message indicates "This collection does not exist".

The only solution I found to fix the crash was to change the album name in the database ( update oc_photos_albums set name="Album 1" where album_id=3; ).

Steps to reproduce

1. Create a Album with name "Album nextcloud/server#1"
2. Associate photos to this album
3. Go to "Albums" entries and try to see his content

Expected behavior

View photos and not the french message "Cette collection n'existe pas"

Installation method

Community Web installer on a VPS or web space

Nextcloud Server version

25

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.1

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• [X] Default user-backend (database)
• [ ] LDAP/ Active Directory
• [ ] SSO - SAML
• [ ] Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***",
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "25.0.5.1",
        "overwrite.cli.url": "http:\/\/127.0.0.1\/home",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "theme": "",
        "loglevel": 3,
        "default_phone_region": "FR",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "filelocking.enabled": true,
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "preview_max_x": "2048",
        "preview_max_y": "2048",
        "jpeg_quality": "60",
        "updater.secret": "***REMOVED SENSITIVE VALUE***"
    }
}

List of activated Apps

Enabled:
  - bruteforcesettings: 2.5.0
  - circles: 25.0.0
  - cloud_federation_api: 1.8.0
  - comments: 1.15.0
  - contacts: 5.2.0
  - contactsinteraction: 1.6.0
  - dav: 1.24.0
  - federatedfilesharing: 1.15.0
  - federation: 1.15.0
  - files: 1.20.1
  - files_pdfviewer: 2.6.0
  - files_rightclick: 1.4.0
  - files_sharing: 1.17.0
  - files_trashbin: 1.15.0
  - files_versions: 1.18.0
  - groupfolders: 13.1.1
  - logreader: 2.10.0
  - lookup_server_connector: 1.13.0
  - maps: 1.0.2
  - nextcloud_announcements: 1.14.0
  - notifications: 2.13.1
  - oauth2: 1.13.0
  - password_policy: 1.15.0
  - photos: 2.0.1
  - previewgenerator: 5.2.1
  - privacy: 1.9.0
  - provisioning_api: 1.15.0
  - related_resources: 1.0.4
  - richdocuments: 7.1.2
  - richdocumentscode: 22.5.802
  - serverinfo: 1.15.0
  - settings: 1.7.0
  - sharebymail: 1.15.0
  - spreed: 15.0.5
  - support: 1.8.0
  - survey_client: 1.13.0
  - systemtags: 1.15.0
  - text: 3.6.0
  - theming: 2.0.1
  - twofactor_backupcodes: 1.14.0
  - updatenotification: 1.15.0
  - user_status: 1.5.0
  - viewer: 1.9.0
  - workflowengine: 2.7.0
Disabled:
  - activity: 2.17.0
  - admin_audit
  - calendar: 4.3.1
  - dashboard: 7.5.0
  - encryption
  - files_external
  - firstrunwizard: 2.14.0
  - mail: 2.2.5
  - recommendations: 1.4.0
  - suspicious_login
  - twofactor_totp
  - user_ldap
  - weather_status: 1.5.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

No response

Additional info

No response

[R2019-github]

Inside navigator console, error is

XHRPROPFINDhttps://xxx/home/remote.php/dav/photos/xxx/albums/Album /
[HTTP/1.1 404 Not Found 205ms]

The Album name is not complete : missing #1 at the end of the name.

[Jaymoon85]

Also doesn't like the parentheses symbols either in the album name. Now I'm stuck with an album that won't go away.

[TheGroundZero]

It's easy to see why # in an album name would cause issues. The name of the album is used in the URL of the album and # is used to refer to anchor tags on a page. So basically the URL of Album #1 would be turned into Album (space might be stripped) and a reference to the non-existing anchor #1

Should be fixable by using character encoding.

Another character encoding issue occures when using e.g. & in the location data of an album. This also results in an error.

[PetziAt]

Same error with other characters like "?"

album name: "shared?"

url of an link is just "/apps/photos/albums/shared" instead of "/apps/photos/albums/shared%3F"

[joshtrichards]

Related: #1531