@@ -28,14 +28,14 @@ |
||
28 | 28 | |
29 | 29 | class PrivateKeyMissingException extends GenericEncryptionException { |
30 | 30 | |
31 | - /** |
|
32 | - * @param string $userId |
|
33 | - */ |
|
34 | - public function __construct($userId) { |
|
35 | - if(empty($userId)) { |
|
36 | - $userId = "<no-user-id-given>"; |
|
37 | - } |
|
38 | - parent::__construct("Private Key missing for user: $userId"); |
|
39 | - } |
|
31 | + /** |
|
32 | + * @param string $userId |
|
33 | + */ |
|
34 | + public function __construct($userId) { |
|
35 | + if(empty($userId)) { |
|
36 | + $userId = "<no-user-id-given>"; |
|
37 | + } |
|
38 | + parent::__construct("Private Key missing for user: $userId"); |
|
39 | + } |
|
40 | 40 | |
41 | 41 | } |
@@ -38,293 +38,293 @@ |
||
38 | 38 | class Recovery { |
39 | 39 | |
40 | 40 | |
41 | - /** |
|
42 | - * @var null|IUser |
|
43 | - */ |
|
44 | - protected $user; |
|
45 | - /** |
|
46 | - * @var Crypt |
|
47 | - */ |
|
48 | - protected $crypt; |
|
49 | - /** |
|
50 | - * @var ISecureRandom |
|
51 | - */ |
|
52 | - private $random; |
|
53 | - /** |
|
54 | - * @var KeyManager |
|
55 | - */ |
|
56 | - private $keyManager; |
|
57 | - /** |
|
58 | - * @var IConfig |
|
59 | - */ |
|
60 | - private $config; |
|
61 | - /** |
|
62 | - * @var IStorage |
|
63 | - */ |
|
64 | - private $keyStorage; |
|
65 | - /** |
|
66 | - * @var View |
|
67 | - */ |
|
68 | - private $view; |
|
69 | - /** |
|
70 | - * @var IFile |
|
71 | - */ |
|
72 | - private $file; |
|
73 | - |
|
74 | - /** |
|
75 | - * @param IUserSession $user |
|
76 | - * @param Crypt $crypt |
|
77 | - * @param ISecureRandom $random |
|
78 | - * @param KeyManager $keyManager |
|
79 | - * @param IConfig $config |
|
80 | - * @param IStorage $keyStorage |
|
81 | - * @param IFile $file |
|
82 | - * @param View $view |
|
83 | - */ |
|
84 | - public function __construct(IUserSession $user, |
|
85 | - Crypt $crypt, |
|
86 | - ISecureRandom $random, |
|
87 | - KeyManager $keyManager, |
|
88 | - IConfig $config, |
|
89 | - IStorage $keyStorage, |
|
90 | - IFile $file, |
|
91 | - View $view) { |
|
92 | - $this->user = ($user && $user->isLoggedIn()) ? $user->getUser() : false; |
|
93 | - $this->crypt = $crypt; |
|
94 | - $this->random = $random; |
|
95 | - $this->keyManager = $keyManager; |
|
96 | - $this->config = $config; |
|
97 | - $this->keyStorage = $keyStorage; |
|
98 | - $this->view = $view; |
|
99 | - $this->file = $file; |
|
100 | - } |
|
101 | - |
|
102 | - /** |
|
103 | - * @param string $password |
|
104 | - * @return bool |
|
105 | - */ |
|
106 | - public function enableAdminRecovery($password) { |
|
107 | - $appConfig = $this->config; |
|
108 | - $keyManager = $this->keyManager; |
|
109 | - |
|
110 | - if (!$keyManager->recoveryKeyExists()) { |
|
111 | - $keyPair = $this->crypt->createKeyPair(); |
|
112 | - if(!is_array($keyPair)) { |
|
113 | - return false; |
|
114 | - } |
|
115 | - |
|
116 | - $this->keyManager->setRecoveryKey($password, $keyPair); |
|
117 | - } |
|
118 | - |
|
119 | - if ($keyManager->checkRecoveryPassword($password)) { |
|
120 | - $appConfig->setAppValue('encryption', 'recoveryAdminEnabled', 1); |
|
121 | - return true; |
|
122 | - } |
|
123 | - |
|
124 | - return false; |
|
125 | - } |
|
126 | - |
|
127 | - /** |
|
128 | - * change recovery key id |
|
129 | - * |
|
130 | - * @param string $newPassword |
|
131 | - * @param string $oldPassword |
|
132 | - * @return bool |
|
133 | - */ |
|
134 | - public function changeRecoveryKeyPassword($newPassword, $oldPassword) { |
|
135 | - $recoveryKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId()); |
|
136 | - $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $oldPassword); |
|
137 | - if($decryptedRecoveryKey === false) { |
|
138 | - return false; |
|
139 | - } |
|
140 | - $encryptedRecoveryKey = $this->crypt->encryptPrivateKey($decryptedRecoveryKey, $newPassword); |
|
141 | - $header = $this->crypt->generateHeader(); |
|
142 | - if ($encryptedRecoveryKey) { |
|
143 | - $this->keyManager->setSystemPrivateKey($this->keyManager->getRecoveryKeyId(), $header . $encryptedRecoveryKey); |
|
144 | - return true; |
|
145 | - } |
|
146 | - return false; |
|
147 | - } |
|
148 | - |
|
149 | - /** |
|
150 | - * @param string $recoveryPassword |
|
151 | - * @return bool |
|
152 | - */ |
|
153 | - public function disableAdminRecovery($recoveryPassword) { |
|
154 | - $keyManager = $this->keyManager; |
|
155 | - |
|
156 | - if ($keyManager->checkRecoveryPassword($recoveryPassword)) { |
|
157 | - // Set recoveryAdmin as disabled |
|
158 | - $this->config->setAppValue('encryption', 'recoveryAdminEnabled', 0); |
|
159 | - return true; |
|
160 | - } |
|
161 | - return false; |
|
162 | - } |
|
163 | - |
|
164 | - /** |
|
165 | - * check if recovery is enabled for user |
|
166 | - * |
|
167 | - * @param string $user if no user is given we check the current logged-in user |
|
168 | - * |
|
169 | - * @return bool |
|
170 | - */ |
|
171 | - public function isRecoveryEnabledForUser($user = '') { |
|
172 | - $uid = empty($user) ? $this->user->getUID() : $user; |
|
173 | - $recoveryMode = $this->config->getUserValue($uid, |
|
174 | - 'encryption', |
|
175 | - 'recoveryEnabled', |
|
176 | - 0); |
|
177 | - |
|
178 | - return ($recoveryMode === '1'); |
|
179 | - } |
|
180 | - |
|
181 | - /** |
|
182 | - * check if recovery is key is enabled by the administrator |
|
183 | - * |
|
184 | - * @return bool |
|
185 | - */ |
|
186 | - public function isRecoveryKeyEnabled() { |
|
187 | - $enabled = $this->config->getAppValue('encryption', 'recoveryAdminEnabled', 0); |
|
188 | - |
|
189 | - return ($enabled === '1'); |
|
190 | - } |
|
191 | - |
|
192 | - /** |
|
193 | - * @param string $value |
|
194 | - * @return bool |
|
195 | - */ |
|
196 | - public function setRecoveryForUser($value) { |
|
197 | - |
|
198 | - try { |
|
199 | - $this->config->setUserValue($this->user->getUID(), |
|
200 | - 'encryption', |
|
201 | - 'recoveryEnabled', |
|
202 | - $value); |
|
203 | - |
|
204 | - if ($value === '1') { |
|
205 | - $this->addRecoveryKeys('/' . $this->user->getUID() . '/files/'); |
|
206 | - } else { |
|
207 | - $this->removeRecoveryKeys('/' . $this->user->getUID() . '/files/'); |
|
208 | - } |
|
209 | - |
|
210 | - return true; |
|
211 | - } catch (PreConditionNotMetException $e) { |
|
212 | - return false; |
|
213 | - } |
|
214 | - } |
|
215 | - |
|
216 | - /** |
|
217 | - * add recovery key to all encrypted files |
|
218 | - * @param string $path |
|
219 | - */ |
|
220 | - private function addRecoveryKeys($path) { |
|
221 | - $dirContent = $this->view->getDirectoryContent($path); |
|
222 | - foreach ($dirContent as $item) { |
|
223 | - $filePath = $item->getPath(); |
|
224 | - if ($item['type'] === 'dir') { |
|
225 | - $this->addRecoveryKeys($filePath . '/'); |
|
226 | - } else { |
|
227 | - $fileKey = $this->keyManager->getFileKey($filePath, $this->user->getUID()); |
|
228 | - if (!empty($fileKey)) { |
|
229 | - $accessList = $this->file->getAccessList($filePath); |
|
230 | - $publicKeys = array(); |
|
231 | - foreach ($accessList['users'] as $uid) { |
|
232 | - $publicKeys[$uid] = $this->keyManager->getPublicKey($uid); |
|
233 | - } |
|
234 | - |
|
235 | - $publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $this->user->getUID()); |
|
236 | - |
|
237 | - $encryptedKeyfiles = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys); |
|
238 | - $this->keyManager->setAllFileKeys($filePath, $encryptedKeyfiles); |
|
239 | - } |
|
240 | - } |
|
241 | - } |
|
242 | - } |
|
243 | - |
|
244 | - /** |
|
245 | - * remove recovery key to all encrypted files |
|
246 | - * @param string $path |
|
247 | - */ |
|
248 | - private function removeRecoveryKeys($path) { |
|
249 | - $dirContent = $this->view->getDirectoryContent($path); |
|
250 | - foreach ($dirContent as $item) { |
|
251 | - $filePath = $item->getPath(); |
|
252 | - if ($item['type'] === 'dir') { |
|
253 | - $this->removeRecoveryKeys($filePath . '/'); |
|
254 | - } else { |
|
255 | - $this->keyManager->deleteShareKey($filePath, $this->keyManager->getRecoveryKeyId()); |
|
256 | - } |
|
257 | - } |
|
258 | - } |
|
259 | - |
|
260 | - /** |
|
261 | - * recover users files with the recovery key |
|
262 | - * |
|
263 | - * @param string $recoveryPassword |
|
264 | - * @param string $user |
|
265 | - */ |
|
266 | - public function recoverUsersFiles($recoveryPassword, $user) { |
|
267 | - $encryptedKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId()); |
|
268 | - |
|
269 | - $privateKey = $this->crypt->decryptPrivateKey($encryptedKey, $recoveryPassword); |
|
270 | - if($privateKey !== false) { |
|
271 | - $this->recoverAllFiles('/' . $user . '/files/', $privateKey, $user); |
|
272 | - } |
|
273 | - } |
|
274 | - |
|
275 | - /** |
|
276 | - * recover users files |
|
277 | - * |
|
278 | - * @param string $path |
|
279 | - * @param string $privateKey |
|
280 | - * @param string $uid |
|
281 | - */ |
|
282 | - private function recoverAllFiles($path, $privateKey, $uid) { |
|
283 | - $dirContent = $this->view->getDirectoryContent($path); |
|
284 | - |
|
285 | - foreach ($dirContent as $item) { |
|
286 | - // Get relative path from encryption/keyfiles |
|
287 | - $filePath = $item->getPath(); |
|
288 | - if ($this->view->is_dir($filePath)) { |
|
289 | - $this->recoverAllFiles($filePath . '/', $privateKey, $uid); |
|
290 | - } else { |
|
291 | - $this->recoverFile($filePath, $privateKey, $uid); |
|
292 | - } |
|
293 | - } |
|
294 | - |
|
295 | - } |
|
296 | - |
|
297 | - /** |
|
298 | - * recover file |
|
299 | - * |
|
300 | - * @param string $path |
|
301 | - * @param string $privateKey |
|
302 | - * @param string $uid |
|
303 | - */ |
|
304 | - private function recoverFile($path, $privateKey, $uid) { |
|
305 | - $encryptedFileKey = $this->keyManager->getEncryptedFileKey($path); |
|
306 | - $shareKey = $this->keyManager->getShareKey($path, $this->keyManager->getRecoveryKeyId()); |
|
307 | - |
|
308 | - if ($encryptedFileKey && $shareKey && $privateKey) { |
|
309 | - $fileKey = $this->crypt->multiKeyDecrypt($encryptedFileKey, |
|
310 | - $shareKey, |
|
311 | - $privateKey); |
|
312 | - } |
|
313 | - |
|
314 | - if (!empty($fileKey)) { |
|
315 | - $accessList = $this->file->getAccessList($path); |
|
316 | - $publicKeys = array(); |
|
317 | - foreach ($accessList['users'] as $user) { |
|
318 | - $publicKeys[$user] = $this->keyManager->getPublicKey($user); |
|
319 | - } |
|
320 | - |
|
321 | - $publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $uid); |
|
322 | - |
|
323 | - $encryptedKeyfiles = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys); |
|
324 | - $this->keyManager->setAllFileKeys($path, $encryptedKeyfiles); |
|
325 | - } |
|
326 | - |
|
327 | - } |
|
41 | + /** |
|
42 | + * @var null|IUser |
|
43 | + */ |
|
44 | + protected $user; |
|
45 | + /** |
|
46 | + * @var Crypt |
|
47 | + */ |
|
48 | + protected $crypt; |
|
49 | + /** |
|
50 | + * @var ISecureRandom |
|
51 | + */ |
|
52 | + private $random; |
|
53 | + /** |
|
54 | + * @var KeyManager |
|
55 | + */ |
|
56 | + private $keyManager; |
|
57 | + /** |
|
58 | + * @var IConfig |
|
59 | + */ |
|
60 | + private $config; |
|
61 | + /** |
|
62 | + * @var IStorage |
|
63 | + */ |
|
64 | + private $keyStorage; |
|
65 | + /** |
|
66 | + * @var View |
|
67 | + */ |
|
68 | + private $view; |
|
69 | + /** |
|
70 | + * @var IFile |
|
71 | + */ |
|
72 | + private $file; |
|
73 | + |
|
74 | + /** |
|
75 | + * @param IUserSession $user |
|
76 | + * @param Crypt $crypt |
|
77 | + * @param ISecureRandom $random |
|
78 | + * @param KeyManager $keyManager |
|
79 | + * @param IConfig $config |
|
80 | + * @param IStorage $keyStorage |
|
81 | + * @param IFile $file |
|
82 | + * @param View $view |
|
83 | + */ |
|
84 | + public function __construct(IUserSession $user, |
|
85 | + Crypt $crypt, |
|
86 | + ISecureRandom $random, |
|
87 | + KeyManager $keyManager, |
|
88 | + IConfig $config, |
|
89 | + IStorage $keyStorage, |
|
90 | + IFile $file, |
|
91 | + View $view) { |
|
92 | + $this->user = ($user && $user->isLoggedIn()) ? $user->getUser() : false; |
|
93 | + $this->crypt = $crypt; |
|
94 | + $this->random = $random; |
|
95 | + $this->keyManager = $keyManager; |
|
96 | + $this->config = $config; |
|
97 | + $this->keyStorage = $keyStorage; |
|
98 | + $this->view = $view; |
|
99 | + $this->file = $file; |
|
100 | + } |
|
101 | + |
|
102 | + /** |
|
103 | + * @param string $password |
|
104 | + * @return bool |
|
105 | + */ |
|
106 | + public function enableAdminRecovery($password) { |
|
107 | + $appConfig = $this->config; |
|
108 | + $keyManager = $this->keyManager; |
|
109 | + |
|
110 | + if (!$keyManager->recoveryKeyExists()) { |
|
111 | + $keyPair = $this->crypt->createKeyPair(); |
|
112 | + if(!is_array($keyPair)) { |
|
113 | + return false; |
|
114 | + } |
|
115 | + |
|
116 | + $this->keyManager->setRecoveryKey($password, $keyPair); |
|
117 | + } |
|
118 | + |
|
119 | + if ($keyManager->checkRecoveryPassword($password)) { |
|
120 | + $appConfig->setAppValue('encryption', 'recoveryAdminEnabled', 1); |
|
121 | + return true; |
|
122 | + } |
|
123 | + |
|
124 | + return false; |
|
125 | + } |
|
126 | + |
|
127 | + /** |
|
128 | + * change recovery key id |
|
129 | + * |
|
130 | + * @param string $newPassword |
|
131 | + * @param string $oldPassword |
|
132 | + * @return bool |
|
133 | + */ |
|
134 | + public function changeRecoveryKeyPassword($newPassword, $oldPassword) { |
|
135 | + $recoveryKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId()); |
|
136 | + $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $oldPassword); |
|
137 | + if($decryptedRecoveryKey === false) { |
|
138 | + return false; |
|
139 | + } |
|
140 | + $encryptedRecoveryKey = $this->crypt->encryptPrivateKey($decryptedRecoveryKey, $newPassword); |
|
141 | + $header = $this->crypt->generateHeader(); |
|
142 | + if ($encryptedRecoveryKey) { |
|
143 | + $this->keyManager->setSystemPrivateKey($this->keyManager->getRecoveryKeyId(), $header . $encryptedRecoveryKey); |
|
144 | + return true; |
|
145 | + } |
|
146 | + return false; |
|
147 | + } |
|
148 | + |
|
149 | + /** |
|
150 | + * @param string $recoveryPassword |
|
151 | + * @return bool |
|
152 | + */ |
|
153 | + public function disableAdminRecovery($recoveryPassword) { |
|
154 | + $keyManager = $this->keyManager; |
|
155 | + |
|
156 | + if ($keyManager->checkRecoveryPassword($recoveryPassword)) { |
|
157 | + // Set recoveryAdmin as disabled |
|
158 | + $this->config->setAppValue('encryption', 'recoveryAdminEnabled', 0); |
|
159 | + return true; |
|
160 | + } |
|
161 | + return false; |
|
162 | + } |
|
163 | + |
|
164 | + /** |
|
165 | + * check if recovery is enabled for user |
|
166 | + * |
|
167 | + * @param string $user if no user is given we check the current logged-in user |
|
168 | + * |
|
169 | + * @return bool |
|
170 | + */ |
|
171 | + public function isRecoveryEnabledForUser($user = '') { |
|
172 | + $uid = empty($user) ? $this->user->getUID() : $user; |
|
173 | + $recoveryMode = $this->config->getUserValue($uid, |
|
174 | + 'encryption', |
|
175 | + 'recoveryEnabled', |
|
176 | + 0); |
|
177 | + |
|
178 | + return ($recoveryMode === '1'); |
|
179 | + } |
|
180 | + |
|
181 | + /** |
|
182 | + * check if recovery is key is enabled by the administrator |
|
183 | + * |
|
184 | + * @return bool |
|
185 | + */ |
|
186 | + public function isRecoveryKeyEnabled() { |
|
187 | + $enabled = $this->config->getAppValue('encryption', 'recoveryAdminEnabled', 0); |
|
188 | + |
|
189 | + return ($enabled === '1'); |
|
190 | + } |
|
191 | + |
|
192 | + /** |
|
193 | + * @param string $value |
|
194 | + * @return bool |
|
195 | + */ |
|
196 | + public function setRecoveryForUser($value) { |
|
197 | + |
|
198 | + try { |
|
199 | + $this->config->setUserValue($this->user->getUID(), |
|
200 | + 'encryption', |
|
201 | + 'recoveryEnabled', |
|
202 | + $value); |
|
203 | + |
|
204 | + if ($value === '1') { |
|
205 | + $this->addRecoveryKeys('/' . $this->user->getUID() . '/files/'); |
|
206 | + } else { |
|
207 | + $this->removeRecoveryKeys('/' . $this->user->getUID() . '/files/'); |
|
208 | + } |
|
209 | + |
|
210 | + return true; |
|
211 | + } catch (PreConditionNotMetException $e) { |
|
212 | + return false; |
|
213 | + } |
|
214 | + } |
|
215 | + |
|
216 | + /** |
|
217 | + * add recovery key to all encrypted files |
|
218 | + * @param string $path |
|
219 | + */ |
|
220 | + private function addRecoveryKeys($path) { |
|
221 | + $dirContent = $this->view->getDirectoryContent($path); |
|
222 | + foreach ($dirContent as $item) { |
|
223 | + $filePath = $item->getPath(); |
|
224 | + if ($item['type'] === 'dir') { |
|
225 | + $this->addRecoveryKeys($filePath . '/'); |
|
226 | + } else { |
|
227 | + $fileKey = $this->keyManager->getFileKey($filePath, $this->user->getUID()); |
|
228 | + if (!empty($fileKey)) { |
|
229 | + $accessList = $this->file->getAccessList($filePath); |
|
230 | + $publicKeys = array(); |
|
231 | + foreach ($accessList['users'] as $uid) { |
|
232 | + $publicKeys[$uid] = $this->keyManager->getPublicKey($uid); |
|
233 | + } |
|
234 | + |
|
235 | + $publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $this->user->getUID()); |
|
236 | + |
|
237 | + $encryptedKeyfiles = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys); |
|
238 | + $this->keyManager->setAllFileKeys($filePath, $encryptedKeyfiles); |
|
239 | + } |
|
240 | + } |
|
241 | + } |
|
242 | + } |
|
243 | + |
|
244 | + /** |
|
245 | + * remove recovery key to all encrypted files |
|
246 | + * @param string $path |
|
247 | + */ |
|
248 | + private function removeRecoveryKeys($path) { |
|
249 | + $dirContent = $this->view->getDirectoryContent($path); |
|
250 | + foreach ($dirContent as $item) { |
|
251 | + $filePath = $item->getPath(); |
|
252 | + if ($item['type'] === 'dir') { |
|
253 | + $this->removeRecoveryKeys($filePath . '/'); |
|
254 | + } else { |
|
255 | + $this->keyManager->deleteShareKey($filePath, $this->keyManager->getRecoveryKeyId()); |
|
256 | + } |
|
257 | + } |
|
258 | + } |
|
259 | + |
|
260 | + /** |
|
261 | + * recover users files with the recovery key |
|
262 | + * |
|
263 | + * @param string $recoveryPassword |
|
264 | + * @param string $user |
|
265 | + */ |
|
266 | + public function recoverUsersFiles($recoveryPassword, $user) { |
|
267 | + $encryptedKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId()); |
|
268 | + |
|
269 | + $privateKey = $this->crypt->decryptPrivateKey($encryptedKey, $recoveryPassword); |
|
270 | + if($privateKey !== false) { |
|
271 | + $this->recoverAllFiles('/' . $user . '/files/', $privateKey, $user); |
|
272 | + } |
|
273 | + } |
|
274 | + |
|
275 | + /** |
|
276 | + * recover users files |
|
277 | + * |
|
278 | + * @param string $path |
|
279 | + * @param string $privateKey |
|
280 | + * @param string $uid |
|
281 | + */ |
|
282 | + private function recoverAllFiles($path, $privateKey, $uid) { |
|
283 | + $dirContent = $this->view->getDirectoryContent($path); |
|
284 | + |
|
285 | + foreach ($dirContent as $item) { |
|
286 | + // Get relative path from encryption/keyfiles |
|
287 | + $filePath = $item->getPath(); |
|
288 | + if ($this->view->is_dir($filePath)) { |
|
289 | + $this->recoverAllFiles($filePath . '/', $privateKey, $uid); |
|
290 | + } else { |
|
291 | + $this->recoverFile($filePath, $privateKey, $uid); |
|
292 | + } |
|
293 | + } |
|
294 | + |
|
295 | + } |
|
296 | + |
|
297 | + /** |
|
298 | + * recover file |
|
299 | + * |
|
300 | + * @param string $path |
|
301 | + * @param string $privateKey |
|
302 | + * @param string $uid |
|
303 | + */ |
|
304 | + private function recoverFile($path, $privateKey, $uid) { |
|
305 | + $encryptedFileKey = $this->keyManager->getEncryptedFileKey($path); |
|
306 | + $shareKey = $this->keyManager->getShareKey($path, $this->keyManager->getRecoveryKeyId()); |
|
307 | + |
|
308 | + if ($encryptedFileKey && $shareKey && $privateKey) { |
|
309 | + $fileKey = $this->crypt->multiKeyDecrypt($encryptedFileKey, |
|
310 | + $shareKey, |
|
311 | + $privateKey); |
|
312 | + } |
|
313 | + |
|
314 | + if (!empty($fileKey)) { |
|
315 | + $accessList = $this->file->getAccessList($path); |
|
316 | + $publicKeys = array(); |
|
317 | + foreach ($accessList['users'] as $user) { |
|
318 | + $publicKeys[$user] = $this->keyManager->getPublicKey($user); |
|
319 | + } |
|
320 | + |
|
321 | + $publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $uid); |
|
322 | + |
|
323 | + $encryptedKeyfiles = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys); |
|
324 | + $this->keyManager->setAllFileKeys($path, $encryptedKeyfiles); |
|
325 | + } |
|
326 | + |
|
327 | + } |
|
328 | 328 | |
329 | 329 | |
330 | 330 | } |
@@ -36,91 +36,91 @@ |
||
36 | 36 | |
37 | 37 | class MigrateKeys extends Command { |
38 | 38 | |
39 | - /** @var IUserManager */ |
|
40 | - private $userManager; |
|
41 | - /** @var View */ |
|
42 | - private $view; |
|
43 | - /** @var IDBConnection */ |
|
44 | - private $connection; |
|
45 | - /** @var IConfig */ |
|
46 | - private $config; |
|
47 | - /** @var ILogger */ |
|
48 | - private $logger; |
|
39 | + /** @var IUserManager */ |
|
40 | + private $userManager; |
|
41 | + /** @var View */ |
|
42 | + private $view; |
|
43 | + /** @var IDBConnection */ |
|
44 | + private $connection; |
|
45 | + /** @var IConfig */ |
|
46 | + private $config; |
|
47 | + /** @var ILogger */ |
|
48 | + private $logger; |
|
49 | 49 | |
50 | - /** |
|
51 | - * @param IUserManager $userManager |
|
52 | - * @param View $view |
|
53 | - * @param IDBConnection $connection |
|
54 | - * @param IConfig $config |
|
55 | - * @param ILogger $logger |
|
56 | - */ |
|
57 | - public function __construct(IUserManager $userManager, |
|
58 | - View $view, |
|
59 | - IDBConnection $connection, |
|
60 | - IConfig $config, |
|
61 | - ILogger $logger) { |
|
50 | + /** |
|
51 | + * @param IUserManager $userManager |
|
52 | + * @param View $view |
|
53 | + * @param IDBConnection $connection |
|
54 | + * @param IConfig $config |
|
55 | + * @param ILogger $logger |
|
56 | + */ |
|
57 | + public function __construct(IUserManager $userManager, |
|
58 | + View $view, |
|
59 | + IDBConnection $connection, |
|
60 | + IConfig $config, |
|
61 | + ILogger $logger) { |
|
62 | 62 | |
63 | - $this->userManager = $userManager; |
|
64 | - $this->view = $view; |
|
65 | - $this->connection = $connection; |
|
66 | - $this->config = $config; |
|
67 | - $this->logger = $logger; |
|
68 | - parent::__construct(); |
|
69 | - } |
|
63 | + $this->userManager = $userManager; |
|
64 | + $this->view = $view; |
|
65 | + $this->connection = $connection; |
|
66 | + $this->config = $config; |
|
67 | + $this->logger = $logger; |
|
68 | + parent::__construct(); |
|
69 | + } |
|
70 | 70 | |
71 | - protected function configure() { |
|
72 | - $this |
|
73 | - ->setName('encryption:migrate') |
|
74 | - ->setDescription('initial migration to encryption 2.0') |
|
75 | - ->addArgument( |
|
76 | - 'user_id', |
|
77 | - InputArgument::OPTIONAL | InputArgument::IS_ARRAY, |
|
78 | - 'will migrate keys of the given user(s)' |
|
79 | - ); |
|
80 | - } |
|
71 | + protected function configure() { |
|
72 | + $this |
|
73 | + ->setName('encryption:migrate') |
|
74 | + ->setDescription('initial migration to encryption 2.0') |
|
75 | + ->addArgument( |
|
76 | + 'user_id', |
|
77 | + InputArgument::OPTIONAL | InputArgument::IS_ARRAY, |
|
78 | + 'will migrate keys of the given user(s)' |
|
79 | + ); |
|
80 | + } |
|
81 | 81 | |
82 | - protected function execute(InputInterface $input, OutputInterface $output) { |
|
82 | + protected function execute(InputInterface $input, OutputInterface $output) { |
|
83 | 83 | |
84 | - // perform system reorganization |
|
85 | - $migration = new Migration($this->config, $this->view, $this->connection, $this->logger); |
|
84 | + // perform system reorganization |
|
85 | + $migration = new Migration($this->config, $this->view, $this->connection, $this->logger); |
|
86 | 86 | |
87 | - $users = $input->getArgument('user_id'); |
|
88 | - if (!empty($users)) { |
|
89 | - foreach ($users as $user) { |
|
90 | - if ($this->userManager->userExists($user)) { |
|
91 | - $output->writeln("Migrating keys <info>$user</info>"); |
|
92 | - $migration->reorganizeFolderStructureForUser($user); |
|
93 | - } else { |
|
94 | - $output->writeln("<error>Unknown user $user</error>"); |
|
95 | - } |
|
96 | - } |
|
97 | - } else { |
|
98 | - $output->writeln("Reorganize system folder structure"); |
|
99 | - $migration->reorganizeSystemFolderStructure(); |
|
100 | - $migration->updateDB(); |
|
101 | - foreach($this->userManager->getBackends() as $backend) { |
|
102 | - $name = get_class($backend); |
|
87 | + $users = $input->getArgument('user_id'); |
|
88 | + if (!empty($users)) { |
|
89 | + foreach ($users as $user) { |
|
90 | + if ($this->userManager->userExists($user)) { |
|
91 | + $output->writeln("Migrating keys <info>$user</info>"); |
|
92 | + $migration->reorganizeFolderStructureForUser($user); |
|
93 | + } else { |
|
94 | + $output->writeln("<error>Unknown user $user</error>"); |
|
95 | + } |
|
96 | + } |
|
97 | + } else { |
|
98 | + $output->writeln("Reorganize system folder structure"); |
|
99 | + $migration->reorganizeSystemFolderStructure(); |
|
100 | + $migration->updateDB(); |
|
101 | + foreach($this->userManager->getBackends() as $backend) { |
|
102 | + $name = get_class($backend); |
|
103 | 103 | |
104 | - if ($backend instanceof IUserBackend) { |
|
105 | - $name = $backend->getBackendName(); |
|
106 | - } |
|
104 | + if ($backend instanceof IUserBackend) { |
|
105 | + $name = $backend->getBackendName(); |
|
106 | + } |
|
107 | 107 | |
108 | - $output->writeln("Migrating keys for users on backend <info>$name</info>"); |
|
108 | + $output->writeln("Migrating keys for users on backend <info>$name</info>"); |
|
109 | 109 | |
110 | - $limit = 500; |
|
111 | - $offset = 0; |
|
112 | - do { |
|
113 | - $users = $backend->getUsers('', $limit, $offset); |
|
114 | - foreach ($users as $user) { |
|
115 | - $output->writeln(" <info>$user</info>"); |
|
116 | - $migration->reorganizeFolderStructureForUser($user); |
|
117 | - } |
|
118 | - $offset += $limit; |
|
119 | - } while(count($users) >= $limit); |
|
120 | - } |
|
121 | - } |
|
110 | + $limit = 500; |
|
111 | + $offset = 0; |
|
112 | + do { |
|
113 | + $users = $backend->getUsers('', $limit, $offset); |
|
114 | + foreach ($users as $user) { |
|
115 | + $output->writeln(" <info>$user</info>"); |
|
116 | + $migration->reorganizeFolderStructureForUser($user); |
|
117 | + } |
|
118 | + $offset += $limit; |
|
119 | + } while(count($users) >= $limit); |
|
120 | + } |
|
121 | + } |
|
122 | 122 | |
123 | - $migration->finalCleanUp(); |
|
123 | + $migration->finalCleanUp(); |
|
124 | 124 | |
125 | - } |
|
125 | + } |
|
126 | 126 | } |
@@ -34,54 +34,54 @@ |
||
34 | 34 | |
35 | 35 | class EnableMasterKey extends Command { |
36 | 36 | |
37 | - /** @var Util */ |
|
38 | - protected $util; |
|
39 | - |
|
40 | - /** @var IConfig */ |
|
41 | - protected $config; |
|
42 | - |
|
43 | - /** @var QuestionHelper */ |
|
44 | - protected $questionHelper; |
|
45 | - |
|
46 | - /** |
|
47 | - * @param Util $util |
|
48 | - * @param IConfig $config |
|
49 | - * @param QuestionHelper $questionHelper |
|
50 | - */ |
|
51 | - public function __construct(Util $util, |
|
52 | - IConfig $config, |
|
53 | - QuestionHelper $questionHelper) { |
|
54 | - |
|
55 | - $this->util = $util; |
|
56 | - $this->config = $config; |
|
57 | - $this->questionHelper = $questionHelper; |
|
58 | - parent::__construct(); |
|
59 | - } |
|
60 | - |
|
61 | - protected function configure() { |
|
62 | - $this |
|
63 | - ->setName('encryption:enable-master-key') |
|
64 | - ->setDescription('Enable the master key. Only available for fresh installations with no existing encrypted data! There is also no way to disable it again.'); |
|
65 | - } |
|
66 | - |
|
67 | - protected function execute(InputInterface $input, OutputInterface $output) { |
|
68 | - |
|
69 | - $isAlreadyEnabled = $this->util->isMasterKeyEnabled(); |
|
70 | - |
|
71 | - if($isAlreadyEnabled) { |
|
72 | - $output->writeln('Master key already enabled'); |
|
73 | - } else { |
|
74 | - $question = new ConfirmationQuestion( |
|
75 | - 'Warning: Only available for fresh installations with no existing encrypted data! ' |
|
76 | - . 'There is also no way to disable it again. Do you want to continue? (y/n) ', false); |
|
77 | - if ($this->questionHelper->ask($input, $output, $question)) { |
|
78 | - $this->config->setAppValue('encryption', 'useMasterKey', '1'); |
|
79 | - $output->writeln('Master key successfully enabled.'); |
|
80 | - } else { |
|
81 | - $output->writeln('aborted.'); |
|
82 | - } |
|
83 | - } |
|
84 | - |
|
85 | - } |
|
37 | + /** @var Util */ |
|
38 | + protected $util; |
|
39 | + |
|
40 | + /** @var IConfig */ |
|
41 | + protected $config; |
|
42 | + |
|
43 | + /** @var QuestionHelper */ |
|
44 | + protected $questionHelper; |
|
45 | + |
|
46 | + /** |
|
47 | + * @param Util $util |
|
48 | + * @param IConfig $config |
|
49 | + * @param QuestionHelper $questionHelper |
|
50 | + */ |
|
51 | + public function __construct(Util $util, |
|
52 | + IConfig $config, |
|
53 | + QuestionHelper $questionHelper) { |
|
54 | + |
|
55 | + $this->util = $util; |
|
56 | + $this->config = $config; |
|
57 | + $this->questionHelper = $questionHelper; |
|
58 | + parent::__construct(); |
|
59 | + } |
|
60 | + |
|
61 | + protected function configure() { |
|
62 | + $this |
|
63 | + ->setName('encryption:enable-master-key') |
|
64 | + ->setDescription('Enable the master key. Only available for fresh installations with no existing encrypted data! There is also no way to disable it again.'); |
|
65 | + } |
|
66 | + |
|
67 | + protected function execute(InputInterface $input, OutputInterface $output) { |
|
68 | + |
|
69 | + $isAlreadyEnabled = $this->util->isMasterKeyEnabled(); |
|
70 | + |
|
71 | + if($isAlreadyEnabled) { |
|
72 | + $output->writeln('Master key already enabled'); |
|
73 | + } else { |
|
74 | + $question = new ConfirmationQuestion( |
|
75 | + 'Warning: Only available for fresh installations with no existing encrypted data! ' |
|
76 | + . 'There is also no way to disable it again. Do you want to continue? (y/n) ', false); |
|
77 | + if ($this->questionHelper->ask($input, $output, $question)) { |
|
78 | + $this->config->setAppValue('encryption', 'useMasterKey', '1'); |
|
79 | + $output->writeln('Master key successfully enabled.'); |
|
80 | + } else { |
|
81 | + $output->writeln('aborted.'); |
|
82 | + } |
|
83 | + } |
|
84 | + |
|
85 | + } |
|
86 | 86 | |
87 | 87 | } |
@@ -24,10 +24,10 @@ |
||
24 | 24 | |
25 | 25 | |
26 | 26 | interface IHook { |
27 | - /** |
|
28 | - * Connects Hooks |
|
29 | - * |
|
30 | - * @return null |
|
31 | - */ |
|
32 | - public function addHooks(); |
|
27 | + /** |
|
28 | + * Connects Hooks |
|
29 | + * |
|
30 | + * @return null |
|
31 | + */ |
|
32 | + public function addHooks(); |
|
33 | 33 | } |
@@ -38,90 +38,90 @@ |
||
38 | 38 | |
39 | 39 | class Admin implements ISettings { |
40 | 40 | |
41 | - /** @var IL10N */ |
|
42 | - private $l; |
|
43 | - |
|
44 | - /** @var ILogger */ |
|
45 | - private $logger; |
|
46 | - |
|
47 | - /** @var IUserSession */ |
|
48 | - private $userSession; |
|
49 | - |
|
50 | - /** @var IConfig */ |
|
51 | - private $config; |
|
52 | - |
|
53 | - /** @var IUserManager */ |
|
54 | - private $userManager; |
|
55 | - |
|
56 | - /** @var ISession */ |
|
57 | - private $session; |
|
58 | - |
|
59 | - public function __construct( |
|
60 | - IL10N $l, |
|
61 | - ILogger $logger, |
|
62 | - IUserSession $userSession, |
|
63 | - IConfig $config, |
|
64 | - IUserManager $userManager, |
|
65 | - ISession $session |
|
66 | - ) { |
|
67 | - $this->l = $l; |
|
68 | - $this->logger = $logger; |
|
69 | - $this->userSession = $userSession; |
|
70 | - $this->config = $config; |
|
71 | - $this->userManager = $userManager; |
|
72 | - $this->session = $session; |
|
73 | - } |
|
74 | - |
|
75 | - /** |
|
76 | - * @return TemplateResponse |
|
77 | - */ |
|
78 | - public function getForm() { |
|
79 | - $crypt = new Crypt( |
|
80 | - $this->logger, |
|
81 | - $this->userSession, |
|
82 | - $this->config, |
|
83 | - $this->l); |
|
84 | - |
|
85 | - $util = new Util( |
|
86 | - new View(), |
|
87 | - $crypt, |
|
88 | - $this->logger, |
|
89 | - $this->userSession, |
|
90 | - $this->config, |
|
91 | - $this->userManager); |
|
92 | - |
|
93 | - // Check if an adminRecovery account is enabled for recovering files after lost pwd |
|
94 | - $recoveryAdminEnabled = $this->config->getAppValue('encryption', 'recoveryAdminEnabled', '0'); |
|
95 | - $session = new Session($this->session); |
|
96 | - |
|
97 | - $encryptHomeStorage = $util->shouldEncryptHomeStorage(); |
|
98 | - |
|
99 | - $parameters = [ |
|
100 | - 'recoveryEnabled' => $recoveryAdminEnabled, |
|
101 | - 'initStatus' => $session->getStatus(), |
|
102 | - 'encryptHomeStorage' => $encryptHomeStorage, |
|
103 | - 'masterKeyEnabled' => $util->isMasterKeyEnabled(), |
|
104 | - ]; |
|
105 | - |
|
106 | - return new TemplateResponse('encryption', 'settings-admin', $parameters, ''); |
|
107 | - } |
|
108 | - |
|
109 | - /** |
|
110 | - * @return string the section ID, e.g. 'sharing' |
|
111 | - */ |
|
112 | - public function getSection() { |
|
113 | - return 'encryption'; |
|
114 | - } |
|
115 | - |
|
116 | - /** |
|
117 | - * @return int whether the form should be rather on the top or bottom of |
|
118 | - * the admin section. The forms are arranged in ascending order of the |
|
119 | - * priority values. It is required to return a value between 0 and 100. |
|
120 | - * |
|
121 | - * E.g.: 70 |
|
122 | - */ |
|
123 | - public function getPriority() { |
|
124 | - return 5; |
|
125 | - } |
|
41 | + /** @var IL10N */ |
|
42 | + private $l; |
|
43 | + |
|
44 | + /** @var ILogger */ |
|
45 | + private $logger; |
|
46 | + |
|
47 | + /** @var IUserSession */ |
|
48 | + private $userSession; |
|
49 | + |
|
50 | + /** @var IConfig */ |
|
51 | + private $config; |
|
52 | + |
|
53 | + /** @var IUserManager */ |
|
54 | + private $userManager; |
|
55 | + |
|
56 | + /** @var ISession */ |
|
57 | + private $session; |
|
58 | + |
|
59 | + public function __construct( |
|
60 | + IL10N $l, |
|
61 | + ILogger $logger, |
|
62 | + IUserSession $userSession, |
|
63 | + IConfig $config, |
|
64 | + IUserManager $userManager, |
|
65 | + ISession $session |
|
66 | + ) { |
|
67 | + $this->l = $l; |
|
68 | + $this->logger = $logger; |
|
69 | + $this->userSession = $userSession; |
|
70 | + $this->config = $config; |
|
71 | + $this->userManager = $userManager; |
|
72 | + $this->session = $session; |
|
73 | + } |
|
74 | + |
|
75 | + /** |
|
76 | + * @return TemplateResponse |
|
77 | + */ |
|
78 | + public function getForm() { |
|
79 | + $crypt = new Crypt( |
|
80 | + $this->logger, |
|
81 | + $this->userSession, |
|
82 | + $this->config, |
|
83 | + $this->l); |
|
84 | + |
|
85 | + $util = new Util( |
|
86 | + new View(), |
|
87 | + $crypt, |
|
88 | + $this->logger, |
|
89 | + $this->userSession, |
|
90 | + $this->config, |
|
91 | + $this->userManager); |
|
92 | + |
|
93 | + // Check if an adminRecovery account is enabled for recovering files after lost pwd |
|
94 | + $recoveryAdminEnabled = $this->config->getAppValue('encryption', 'recoveryAdminEnabled', '0'); |
|
95 | + $session = new Session($this->session); |
|
96 | + |
|
97 | + $encryptHomeStorage = $util->shouldEncryptHomeStorage(); |
|
98 | + |
|
99 | + $parameters = [ |
|
100 | + 'recoveryEnabled' => $recoveryAdminEnabled, |
|
101 | + 'initStatus' => $session->getStatus(), |
|
102 | + 'encryptHomeStorage' => $encryptHomeStorage, |
|
103 | + 'masterKeyEnabled' => $util->isMasterKeyEnabled(), |
|
104 | + ]; |
|
105 | + |
|
106 | + return new TemplateResponse('encryption', 'settings-admin', $parameters, ''); |
|
107 | + } |
|
108 | + |
|
109 | + /** |
|
110 | + * @return string the section ID, e.g. 'sharing' |
|
111 | + */ |
|
112 | + public function getSection() { |
|
113 | + return 'encryption'; |
|
114 | + } |
|
115 | + |
|
116 | + /** |
|
117 | + * @return int whether the form should be rather on the top or bottom of |
|
118 | + * the admin section. The forms are arranged in ascending order of the |
|
119 | + * priority values. It is required to return a value between 0 and 100. |
|
120 | + * |
|
121 | + * E.g.: 70 |
|
122 | + */ |
|
123 | + public function getPriority() { |
|
124 | + return 5; |
|
125 | + } |
|
126 | 126 | |
127 | 127 | } |
@@ -29,159 +29,159 @@ |
||
29 | 29 | |
30 | 30 | class Session { |
31 | 31 | |
32 | - /** @var ISession */ |
|
33 | - protected $session; |
|
34 | - |
|
35 | - const NOT_INITIALIZED = '0'; |
|
36 | - const INIT_EXECUTED = '1'; |
|
37 | - const INIT_SUCCESSFUL = '2'; |
|
38 | - const RUN_MIGRATION = '3'; |
|
39 | - |
|
40 | - /** |
|
41 | - * @param ISession $session |
|
42 | - */ |
|
43 | - public function __construct(ISession $session) { |
|
44 | - $this->session = $session; |
|
45 | - } |
|
46 | - |
|
47 | - /** |
|
48 | - * Sets status of encryption app |
|
49 | - * |
|
50 | - * @param string $status INIT_SUCCESSFUL, INIT_EXECUTED, NOT_INITIALIZED |
|
51 | - */ |
|
52 | - public function setStatus($status) { |
|
53 | - $this->session->set('encryptionInitialized', $status); |
|
54 | - } |
|
55 | - |
|
56 | - /** |
|
57 | - * Gets status if we already tried to initialize the encryption app |
|
58 | - * |
|
59 | - * @return string init status INIT_SUCCESSFUL, INIT_EXECUTED, NOT_INITIALIZED |
|
60 | - */ |
|
61 | - public function getStatus() { |
|
62 | - $status = $this->session->get('encryptionInitialized'); |
|
63 | - if (is_null($status)) { |
|
64 | - $status = self::NOT_INITIALIZED; |
|
65 | - } |
|
66 | - |
|
67 | - return $status; |
|
68 | - } |
|
69 | - |
|
70 | - /** |
|
71 | - * check if encryption was initialized successfully |
|
72 | - * |
|
73 | - * @return bool |
|
74 | - */ |
|
75 | - public function isReady() { |
|
76 | - $status = $this->getStatus(); |
|
77 | - return $status === self::INIT_SUCCESSFUL; |
|
78 | - } |
|
79 | - |
|
80 | - /** |
|
81 | - * Gets user or public share private key from session |
|
82 | - * |
|
83 | - * @return string $privateKey The user's plaintext private key |
|
84 | - * @throws Exceptions\PrivateKeyMissingException |
|
85 | - */ |
|
86 | - public function getPrivateKey() { |
|
87 | - $key = $this->session->get('privateKey'); |
|
88 | - if (is_null($key)) { |
|
89 | - throw new Exceptions\PrivateKeyMissingException('please try to log-out and log-in again', 0); |
|
90 | - } |
|
91 | - return $key; |
|
92 | - } |
|
93 | - |
|
94 | - /** |
|
95 | - * check if private key is set |
|
96 | - * |
|
97 | - * @return boolean |
|
98 | - */ |
|
99 | - public function isPrivateKeySet() { |
|
100 | - $key = $this->session->get('privateKey'); |
|
101 | - if (is_null($key)) { |
|
102 | - return false; |
|
103 | - } |
|
104 | - |
|
105 | - return true; |
|
106 | - } |
|
107 | - |
|
108 | - /** |
|
109 | - * Sets user private key to session |
|
110 | - * |
|
111 | - * @param string $key users private key |
|
112 | - * |
|
113 | - * @note this should only be set on login |
|
114 | - */ |
|
115 | - public function setPrivateKey($key) { |
|
116 | - $this->session->set('privateKey', $key); |
|
117 | - } |
|
118 | - |
|
119 | - /** |
|
120 | - * store data needed for the decrypt all operation in the session |
|
121 | - * |
|
122 | - * @param string $user |
|
123 | - * @param string $key |
|
124 | - */ |
|
125 | - public function prepareDecryptAll($user, $key) { |
|
126 | - $this->session->set('decryptAll', true); |
|
127 | - $this->session->set('decryptAllKey', $key); |
|
128 | - $this->session->set('decryptAllUid', $user); |
|
129 | - } |
|
130 | - |
|
131 | - /** |
|
132 | - * check if we are in decrypt all mode |
|
133 | - * |
|
134 | - * @return bool |
|
135 | - */ |
|
136 | - public function decryptAllModeActivated() { |
|
137 | - $decryptAll = $this->session->get('decryptAll'); |
|
138 | - return ($decryptAll === true); |
|
139 | - } |
|
140 | - |
|
141 | - /** |
|
142 | - * get uid used for decrypt all operation |
|
143 | - * |
|
144 | - * @return string |
|
145 | - * @throws \Exception |
|
146 | - */ |
|
147 | - public function getDecryptAllUid() { |
|
148 | - $uid = $this->session->get('decryptAllUid'); |
|
149 | - if (is_null($uid) && $this->decryptAllModeActivated()) { |
|
150 | - throw new \Exception('No uid found while in decrypt all mode'); |
|
151 | - } elseif (is_null($uid)) { |
|
152 | - throw new \Exception('Please activate decrypt all mode first'); |
|
153 | - } |
|
154 | - |
|
155 | - return $uid; |
|
156 | - } |
|
157 | - |
|
158 | - /** |
|
159 | - * get private key for decrypt all operation |
|
160 | - * |
|
161 | - * @return string |
|
162 | - * @throws PrivateKeyMissingException |
|
163 | - */ |
|
164 | - public function getDecryptAllKey() { |
|
165 | - $privateKey = $this->session->get('decryptAllKey'); |
|
166 | - if (is_null($privateKey) && $this->decryptAllModeActivated()) { |
|
167 | - throw new PrivateKeyMissingException('No private key found while in decrypt all mode'); |
|
168 | - } elseif (is_null($privateKey)) { |
|
169 | - throw new PrivateKeyMissingException('Please activate decrypt all mode first'); |
|
170 | - } |
|
171 | - |
|
172 | - return $privateKey; |
|
173 | - } |
|
174 | - |
|
175 | - /** |
|
176 | - * remove keys from session |
|
177 | - */ |
|
178 | - public function clear() { |
|
179 | - $this->session->remove('publicSharePrivateKey'); |
|
180 | - $this->session->remove('privateKey'); |
|
181 | - $this->session->remove('encryptionInitialized'); |
|
182 | - $this->session->remove('decryptAll'); |
|
183 | - $this->session->remove('decryptAllKey'); |
|
184 | - $this->session->remove('decryptAllUid'); |
|
185 | - } |
|
32 | + /** @var ISession */ |
|
33 | + protected $session; |
|
34 | + |
|
35 | + const NOT_INITIALIZED = '0'; |
|
36 | + const INIT_EXECUTED = '1'; |
|
37 | + const INIT_SUCCESSFUL = '2'; |
|
38 | + const RUN_MIGRATION = '3'; |
|
39 | + |
|
40 | + /** |
|
41 | + * @param ISession $session |
|
42 | + */ |
|
43 | + public function __construct(ISession $session) { |
|
44 | + $this->session = $session; |
|
45 | + } |
|
46 | + |
|
47 | + /** |
|
48 | + * Sets status of encryption app |
|
49 | + * |
|
50 | + * @param string $status INIT_SUCCESSFUL, INIT_EXECUTED, NOT_INITIALIZED |
|
51 | + */ |
|
52 | + public function setStatus($status) { |
|
53 | + $this->session->set('encryptionInitialized', $status); |
|
54 | + } |
|
55 | + |
|
56 | + /** |
|
57 | + * Gets status if we already tried to initialize the encryption app |
|
58 | + * |
|
59 | + * @return string init status INIT_SUCCESSFUL, INIT_EXECUTED, NOT_INITIALIZED |
|
60 | + */ |
|
61 | + public function getStatus() { |
|
62 | + $status = $this->session->get('encryptionInitialized'); |
|
63 | + if (is_null($status)) { |
|
64 | + $status = self::NOT_INITIALIZED; |
|
65 | + } |
|
66 | + |
|
67 | + return $status; |
|
68 | + } |
|
69 | + |
|
70 | + /** |
|
71 | + * check if encryption was initialized successfully |
|
72 | + * |
|
73 | + * @return bool |
|
74 | + */ |
|
75 | + public function isReady() { |
|
76 | + $status = $this->getStatus(); |
|
77 | + return $status === self::INIT_SUCCESSFUL; |
|
78 | + } |
|
79 | + |
|
80 | + /** |
|
81 | + * Gets user or public share private key from session |
|
82 | + * |
|
83 | + * @return string $privateKey The user's plaintext private key |
|
84 | + * @throws Exceptions\PrivateKeyMissingException |
|
85 | + */ |
|
86 | + public function getPrivateKey() { |
|
87 | + $key = $this->session->get('privateKey'); |
|
88 | + if (is_null($key)) { |
|
89 | + throw new Exceptions\PrivateKeyMissingException('please try to log-out and log-in again', 0); |
|
90 | + } |
|
91 | + return $key; |
|
92 | + } |
|
93 | + |
|
94 | + /** |
|
95 | + * check if private key is set |
|
96 | + * |
|
97 | + * @return boolean |
|
98 | + */ |
|
99 | + public function isPrivateKeySet() { |
|
100 | + $key = $this->session->get('privateKey'); |
|
101 | + if (is_null($key)) { |
|
102 | + return false; |
|
103 | + } |
|
104 | + |
|
105 | + return true; |
|
106 | + } |
|
107 | + |
|
108 | + /** |
|
109 | + * Sets user private key to session |
|
110 | + * |
|
111 | + * @param string $key users private key |
|
112 | + * |
|
113 | + * @note this should only be set on login |
|
114 | + */ |
|
115 | + public function setPrivateKey($key) { |
|
116 | + $this->session->set('privateKey', $key); |
|
117 | + } |
|
118 | + |
|
119 | + /** |
|
120 | + * store data needed for the decrypt all operation in the session |
|
121 | + * |
|
122 | + * @param string $user |
|
123 | + * @param string $key |
|
124 | + */ |
|
125 | + public function prepareDecryptAll($user, $key) { |
|
126 | + $this->session->set('decryptAll', true); |
|
127 | + $this->session->set('decryptAllKey', $key); |
|
128 | + $this->session->set('decryptAllUid', $user); |
|
129 | + } |
|
130 | + |
|
131 | + /** |
|
132 | + * check if we are in decrypt all mode |
|
133 | + * |
|
134 | + * @return bool |
|
135 | + */ |
|
136 | + public function decryptAllModeActivated() { |
|
137 | + $decryptAll = $this->session->get('decryptAll'); |
|
138 | + return ($decryptAll === true); |
|
139 | + } |
|
140 | + |
|
141 | + /** |
|
142 | + * get uid used for decrypt all operation |
|
143 | + * |
|
144 | + * @return string |
|
145 | + * @throws \Exception |
|
146 | + */ |
|
147 | + public function getDecryptAllUid() { |
|
148 | + $uid = $this->session->get('decryptAllUid'); |
|
149 | + if (is_null($uid) && $this->decryptAllModeActivated()) { |
|
150 | + throw new \Exception('No uid found while in decrypt all mode'); |
|
151 | + } elseif (is_null($uid)) { |
|
152 | + throw new \Exception('Please activate decrypt all mode first'); |
|
153 | + } |
|
154 | + |
|
155 | + return $uid; |
|
156 | + } |
|
157 | + |
|
158 | + /** |
|
159 | + * get private key for decrypt all operation |
|
160 | + * |
|
161 | + * @return string |
|
162 | + * @throws PrivateKeyMissingException |
|
163 | + */ |
|
164 | + public function getDecryptAllKey() { |
|
165 | + $privateKey = $this->session->get('decryptAllKey'); |
|
166 | + if (is_null($privateKey) && $this->decryptAllModeActivated()) { |
|
167 | + throw new PrivateKeyMissingException('No private key found while in decrypt all mode'); |
|
168 | + } elseif (is_null($privateKey)) { |
|
169 | + throw new PrivateKeyMissingException('Please activate decrypt all mode first'); |
|
170 | + } |
|
171 | + |
|
172 | + return $privateKey; |
|
173 | + } |
|
174 | + |
|
175 | + /** |
|
176 | + * remove keys from session |
|
177 | + */ |
|
178 | + public function clear() { |
|
179 | + $this->session->remove('publicSharePrivateKey'); |
|
180 | + $this->session->remove('privateKey'); |
|
181 | + $this->session->remove('encryptionInitialized'); |
|
182 | + $this->session->remove('decryptAll'); |
|
183 | + $this->session->remove('decryptAllKey'); |
|
184 | + $this->session->remove('decryptAllUid'); |
|
185 | + } |
|
186 | 186 | |
187 | 187 | } |
@@ -35,127 +35,127 @@ |
||
35 | 35 | |
36 | 36 | class DecryptAll { |
37 | 37 | |
38 | - /** @var Util */ |
|
39 | - protected $util; |
|
40 | - |
|
41 | - /** @var QuestionHelper */ |
|
42 | - protected $questionHelper; |
|
43 | - |
|
44 | - /** @var Crypt */ |
|
45 | - protected $crypt; |
|
46 | - |
|
47 | - /** @var KeyManager */ |
|
48 | - protected $keyManager; |
|
49 | - |
|
50 | - /** @var Session */ |
|
51 | - protected $session; |
|
52 | - |
|
53 | - /** |
|
54 | - * @param Util $util |
|
55 | - * @param KeyManager $keyManager |
|
56 | - * @param Crypt $crypt |
|
57 | - * @param Session $session |
|
58 | - * @param QuestionHelper $questionHelper |
|
59 | - */ |
|
60 | - public function __construct( |
|
61 | - Util $util, |
|
62 | - KeyManager $keyManager, |
|
63 | - Crypt $crypt, |
|
64 | - Session $session, |
|
65 | - QuestionHelper $questionHelper |
|
66 | - ) { |
|
67 | - $this->util = $util; |
|
68 | - $this->keyManager = $keyManager; |
|
69 | - $this->crypt = $crypt; |
|
70 | - $this->session = $session; |
|
71 | - $this->questionHelper = $questionHelper; |
|
72 | - } |
|
73 | - |
|
74 | - /** |
|
75 | - * prepare encryption module to decrypt all files |
|
76 | - * |
|
77 | - * @param InputInterface $input |
|
78 | - * @param OutputInterface $output |
|
79 | - * @param $user |
|
80 | - * @return bool |
|
81 | - */ |
|
82 | - public function prepare(InputInterface $input, OutputInterface $output, $user) { |
|
83 | - |
|
84 | - $question = new Question('Please enter the recovery key password: '); |
|
85 | - |
|
86 | - if($this->util->isMasterKeyEnabled()) { |
|
87 | - $output->writeln('Use master key to decrypt all files'); |
|
88 | - $user = $this->keyManager->getMasterKeyId(); |
|
89 | - $password =$this->keyManager->getMasterKeyPassword(); |
|
90 | - } else { |
|
91 | - $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
|
92 | - if (!empty($user)) { |
|
93 | - $output->writeln('You can only decrypt the users files if you know'); |
|
94 | - $output->writeln('the users password or if he activated the recovery key.'); |
|
95 | - $output->writeln(''); |
|
96 | - $questionUseLoginPassword = new ConfirmationQuestion( |
|
97 | - 'Do you want to use the users login password to decrypt all files? (y/n) ', |
|
98 | - false |
|
99 | - ); |
|
100 | - $useLoginPassword = $this->questionHelper->ask($input, $output, $questionUseLoginPassword); |
|
101 | - if ($useLoginPassword) { |
|
102 | - $question = new Question('Please enter the user\'s login password: '); |
|
103 | - } else if ($this->util->isRecoveryEnabledForUser($user) === false) { |
|
104 | - $output->writeln('No recovery key available for user ' . $user); |
|
105 | - return false; |
|
106 | - } else { |
|
107 | - $user = $recoveryKeyId; |
|
108 | - } |
|
109 | - } else { |
|
110 | - $output->writeln('You can only decrypt the files of all users if the'); |
|
111 | - $output->writeln('recovery key is enabled by the admin and activated by the users.'); |
|
112 | - $output->writeln(''); |
|
113 | - $user = $recoveryKeyId; |
|
114 | - } |
|
115 | - |
|
116 | - $question->setHidden(true); |
|
117 | - $question->setHiddenFallback(false); |
|
118 | - $password = $this->questionHelper->ask($input, $output, $question); |
|
119 | - } |
|
120 | - |
|
121 | - $privateKey = $this->getPrivateKey($user, $password); |
|
122 | - if ($privateKey !== false) { |
|
123 | - $this->updateSession($user, $privateKey); |
|
124 | - return true; |
|
125 | - } else { |
|
126 | - $output->writeln('Could not decrypt private key, maybe you entered the wrong password?'); |
|
127 | - } |
|
128 | - |
|
129 | - |
|
130 | - return false; |
|
131 | - } |
|
132 | - |
|
133 | - /** |
|
134 | - * get the private key which will be used to decrypt all files |
|
135 | - * |
|
136 | - * @param string $user |
|
137 | - * @param string $password |
|
138 | - * @return bool|string |
|
139 | - * @throws \OCA\Encryption\Exceptions\PrivateKeyMissingException |
|
140 | - */ |
|
141 | - protected function getPrivateKey($user, $password) { |
|
142 | - $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
|
143 | - $masterKeyId = $this->keyManager->getMasterKeyId(); |
|
144 | - if ($user === $recoveryKeyId) { |
|
145 | - $recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId); |
|
146 | - $privateKey = $this->crypt->decryptPrivateKey($recoveryKey, $password); |
|
147 | - } elseif ($user === $masterKeyId) { |
|
148 | - $masterKey = $this->keyManager->getSystemPrivateKey($masterKeyId); |
|
149 | - $privateKey = $this->crypt->decryptPrivateKey($masterKey, $password, $masterKeyId); |
|
150 | - } else { |
|
151 | - $userKey = $this->keyManager->getPrivateKey($user); |
|
152 | - $privateKey = $this->crypt->decryptPrivateKey($userKey, $password, $user); |
|
153 | - } |
|
154 | - |
|
155 | - return $privateKey; |
|
156 | - } |
|
157 | - |
|
158 | - protected function updateSession($user, $privateKey) { |
|
159 | - $this->session->prepareDecryptAll($user, $privateKey); |
|
160 | - } |
|
38 | + /** @var Util */ |
|
39 | + protected $util; |
|
40 | + |
|
41 | + /** @var QuestionHelper */ |
|
42 | + protected $questionHelper; |
|
43 | + |
|
44 | + /** @var Crypt */ |
|
45 | + protected $crypt; |
|
46 | + |
|
47 | + /** @var KeyManager */ |
|
48 | + protected $keyManager; |
|
49 | + |
|
50 | + /** @var Session */ |
|
51 | + protected $session; |
|
52 | + |
|
53 | + /** |
|
54 | + * @param Util $util |
|
55 | + * @param KeyManager $keyManager |
|
56 | + * @param Crypt $crypt |
|
57 | + * @param Session $session |
|
58 | + * @param QuestionHelper $questionHelper |
|
59 | + */ |
|
60 | + public function __construct( |
|
61 | + Util $util, |
|
62 | + KeyManager $keyManager, |
|
63 | + Crypt $crypt, |
|
64 | + Session $session, |
|
65 | + QuestionHelper $questionHelper |
|
66 | + ) { |
|
67 | + $this->util = $util; |
|
68 | + $this->keyManager = $keyManager; |
|
69 | + $this->crypt = $crypt; |
|
70 | + $this->session = $session; |
|
71 | + $this->questionHelper = $questionHelper; |
|
72 | + } |
|
73 | + |
|
74 | + /** |
|
75 | + * prepare encryption module to decrypt all files |
|
76 | + * |
|
77 | + * @param InputInterface $input |
|
78 | + * @param OutputInterface $output |
|
79 | + * @param $user |
|
80 | + * @return bool |
|
81 | + */ |
|
82 | + public function prepare(InputInterface $input, OutputInterface $output, $user) { |
|
83 | + |
|
84 | + $question = new Question('Please enter the recovery key password: '); |
|
85 | + |
|
86 | + if($this->util->isMasterKeyEnabled()) { |
|
87 | + $output->writeln('Use master key to decrypt all files'); |
|
88 | + $user = $this->keyManager->getMasterKeyId(); |
|
89 | + $password =$this->keyManager->getMasterKeyPassword(); |
|
90 | + } else { |
|
91 | + $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
|
92 | + if (!empty($user)) { |
|
93 | + $output->writeln('You can only decrypt the users files if you know'); |
|
94 | + $output->writeln('the users password or if he activated the recovery key.'); |
|
95 | + $output->writeln(''); |
|
96 | + $questionUseLoginPassword = new ConfirmationQuestion( |
|
97 | + 'Do you want to use the users login password to decrypt all files? (y/n) ', |
|
98 | + false |
|
99 | + ); |
|
100 | + $useLoginPassword = $this->questionHelper->ask($input, $output, $questionUseLoginPassword); |
|
101 | + if ($useLoginPassword) { |
|
102 | + $question = new Question('Please enter the user\'s login password: '); |
|
103 | + } else if ($this->util->isRecoveryEnabledForUser($user) === false) { |
|
104 | + $output->writeln('No recovery key available for user ' . $user); |
|
105 | + return false; |
|
106 | + } else { |
|
107 | + $user = $recoveryKeyId; |
|
108 | + } |
|
109 | + } else { |
|
110 | + $output->writeln('You can only decrypt the files of all users if the'); |
|
111 | + $output->writeln('recovery key is enabled by the admin and activated by the users.'); |
|
112 | + $output->writeln(''); |
|
113 | + $user = $recoveryKeyId; |
|
114 | + } |
|
115 | + |
|
116 | + $question->setHidden(true); |
|
117 | + $question->setHiddenFallback(false); |
|
118 | + $password = $this->questionHelper->ask($input, $output, $question); |
|
119 | + } |
|
120 | + |
|
121 | + $privateKey = $this->getPrivateKey($user, $password); |
|
122 | + if ($privateKey !== false) { |
|
123 | + $this->updateSession($user, $privateKey); |
|
124 | + return true; |
|
125 | + } else { |
|
126 | + $output->writeln('Could not decrypt private key, maybe you entered the wrong password?'); |
|
127 | + } |
|
128 | + |
|
129 | + |
|
130 | + return false; |
|
131 | + } |
|
132 | + |
|
133 | + /** |
|
134 | + * get the private key which will be used to decrypt all files |
|
135 | + * |
|
136 | + * @param string $user |
|
137 | + * @param string $password |
|
138 | + * @return bool|string |
|
139 | + * @throws \OCA\Encryption\Exceptions\PrivateKeyMissingException |
|
140 | + */ |
|
141 | + protected function getPrivateKey($user, $password) { |
|
142 | + $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
|
143 | + $masterKeyId = $this->keyManager->getMasterKeyId(); |
|
144 | + if ($user === $recoveryKeyId) { |
|
145 | + $recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId); |
|
146 | + $privateKey = $this->crypt->decryptPrivateKey($recoveryKey, $password); |
|
147 | + } elseif ($user === $masterKeyId) { |
|
148 | + $masterKey = $this->keyManager->getSystemPrivateKey($masterKeyId); |
|
149 | + $privateKey = $this->crypt->decryptPrivateKey($masterKey, $password, $masterKeyId); |
|
150 | + } else { |
|
151 | + $userKey = $this->keyManager->getPrivateKey($user); |
|
152 | + $privateKey = $this->crypt->decryptPrivateKey($userKey, $password, $user); |
|
153 | + } |
|
154 | + |
|
155 | + return $privateKey; |
|
156 | + } |
|
157 | + |
|
158 | + protected function updateSession($user, $privateKey) { |
|
159 | + $this->session->prepareDecryptAll($user, $privateKey); |
|
160 | + } |
|
161 | 161 | } |
@@ -28,38 +28,38 @@ |
||
28 | 28 | |
29 | 29 | class HookManager { |
30 | 30 | |
31 | - private $hookInstances = []; |
|
31 | + private $hookInstances = []; |
|
32 | 32 | |
33 | - /** |
|
34 | - * @param array|IHook $instances |
|
35 | - * - This accepts either a single instance of IHook or an array of instances of IHook |
|
36 | - * @return bool |
|
37 | - */ |
|
38 | - public function registerHook($instances) { |
|
39 | - if (is_array($instances)) { |
|
40 | - foreach ($instances as $instance) { |
|
41 | - if (!$instance instanceof IHook) { |
|
42 | - return false; |
|
43 | - } |
|
44 | - $this->hookInstances[] = $instance; |
|
45 | - } |
|
33 | + /** |
|
34 | + * @param array|IHook $instances |
|
35 | + * - This accepts either a single instance of IHook or an array of instances of IHook |
|
36 | + * @return bool |
|
37 | + */ |
|
38 | + public function registerHook($instances) { |
|
39 | + if (is_array($instances)) { |
|
40 | + foreach ($instances as $instance) { |
|
41 | + if (!$instance instanceof IHook) { |
|
42 | + return false; |
|
43 | + } |
|
44 | + $this->hookInstances[] = $instance; |
|
45 | + } |
|
46 | 46 | |
47 | - } elseif ($instances instanceof IHook) { |
|
48 | - $this->hookInstances[] = $instances; |
|
49 | - } |
|
50 | - return true; |
|
51 | - } |
|
47 | + } elseif ($instances instanceof IHook) { |
|
48 | + $this->hookInstances[] = $instances; |
|
49 | + } |
|
50 | + return true; |
|
51 | + } |
|
52 | 52 | |
53 | - public function fireHooks() { |
|
54 | - foreach ($this->hookInstances as $instance) { |
|
55 | - /** |
|
56 | - * Fire off the add hooks method of each instance stored in cache |
|
57 | - * |
|
58 | - * @var $instance IHook |
|
59 | - */ |
|
60 | - $instance->addHooks(); |
|
61 | - } |
|
53 | + public function fireHooks() { |
|
54 | + foreach ($this->hookInstances as $instance) { |
|
55 | + /** |
|
56 | + * Fire off the add hooks method of each instance stored in cache |
|
57 | + * |
|
58 | + * @var $instance IHook |
|
59 | + */ |
|
60 | + $instance->addHooks(); |
|
61 | + } |
|
62 | 62 | |
63 | - } |
|
63 | + } |
|
64 | 64 | |
65 | 65 | } |