nextcloud / server

apps/user_ldap/lib/Notification/Notifier.php

Indentation +61 added lines, -61 removed lines

@@ -31,72 +31,72 @@
 
 class Notifier implements INotifier {
 
-	/** @var IFactory */
-	protected $l10nFactory;
+    /** @var IFactory */
+    protected $l10nFactory;
 
-	/**
-	 * @param IFactory $l10nFactory
-	 */
-	public function __construct(\OCP\L10N\IFactory $l10nFactory) {
-		$this->l10nFactory = $l10nFactory;
-	}
+    /**
+     * @param IFactory $l10nFactory
+     */
+    public function __construct(\OCP\L10N\IFactory $l10nFactory) {
+        $this->l10nFactory = $l10nFactory;
+    }
 
-	/**
-	 * Identifier of the notifier, only use [a-z0-9_]
-	 *
-	 * @return string
-	 * @since 17.0.0
-	 */
-	public function getID(): string {
-		return 'user_ldap';
-	}
+    /**
+     * Identifier of the notifier, only use [a-z0-9_]
+     *
+     * @return string
+     * @since 17.0.0
+     */
+    public function getID(): string {
+        return 'user_ldap';
+    }
 
-	/**
-	 * Human readable name describing the notifier
-	 *
-	 * @return string
-	 * @since 17.0.0
-	 */
-	public function getName(): string {
-		return $this->l10nFactory->get('user_ldap')->t('LDAP User backend');
-	}
+    /**
+     * Human readable name describing the notifier
+     *
+     * @return string
+     * @since 17.0.0
+     */
+    public function getName(): string {
+        return $this->l10nFactory->get('user_ldap')->t('LDAP User backend');
+    }
 
-	/**
-	 * @param INotification $notification
-	 * @param string $languageCode The code of the language that should be used to prepare the notification
-	 * @return INotification
-	 * @throws \InvalidArgumentException When the notification was not prepared by a notifier
-	 */
-	public function prepare(INotification $notification, string $languageCode): INotification {
-		if ($notification->getApp() !== 'user_ldap') {
-			// Not my app => throw
-			throw new \InvalidArgumentException();
-		}
+    /**
+     * @param INotification $notification
+     * @param string $languageCode The code of the language that should be used to prepare the notification
+     * @return INotification
+     * @throws \InvalidArgumentException When the notification was not prepared by a notifier
+     */
+    public function prepare(INotification $notification, string $languageCode): INotification {
+        if ($notification->getApp() !== 'user_ldap') {
+            // Not my app => throw
+            throw new \InvalidArgumentException();
+        }
 
-		// Read the language from the notification
-		$l = $this->l10nFactory->get('user_ldap', $languageCode);
+        // Read the language from the notification
+        $l = $this->l10nFactory->get('user_ldap', $languageCode);
 
-		switch ($notification->getSubject()) {
-			// Deal with known subjects
-			case 'pwd_exp_warn_days':
-				$params = $notification->getSubjectParameters();
-				$days = (int) $params[0];
-				if ($days === 2) {
-					$notification->setParsedSubject($l->t('Your password will expire tomorrow.'));
-				} elseif ($days === 1) {
-					$notification->setParsedSubject($l->t('Your password will expire today.'));
-				} else {
-					$notification->setParsedSubject($l->n(
-						'Your password will expire within %n day.',
-						'Your password will expire within %n days.',
-						$days
-					));
-				}
-				return $notification;
+        switch ($notification->getSubject()) {
+            // Deal with known subjects
+            case 'pwd_exp_warn_days':
+                $params = $notification->getSubjectParameters();
+                $days = (int) $params[0];
+                if ($days === 2) {
+                    $notification->setParsedSubject($l->t('Your password will expire tomorrow.'));
+                } elseif ($days === 1) {
+                    $notification->setParsedSubject($l->t('Your password will expire today.'));
+                } else {
+                    $notification->setParsedSubject($l->n(
+                        'Your password will expire within %n day.',
+                        'Your password will expire within %n days.',
+                        $days
+                    ));
+                }
+                return $notification;
 
-			default:
-				// Unknown subject => Unknown notification => throw
-				throw new \InvalidArgumentException();
-		}
-	}
+            default:
+                // Unknown subject => Unknown notification => throw
+                throw new \InvalidArgumentException();
+        }
+    }
 }

apps/user_ldap/lib/Handler/ExtStorageConfigHandler.php

Indentation +29 added lines, -29 removed lines

@@ -30,40 +30,40 @@
 use OCA\User_LDAP\User_Proxy;
 
 class ExtStorageConfigHandler extends UserContext implements IConfigHandler {
-	use SimpleSubstitutionTrait;
+    use SimpleSubstitutionTrait;
 
-	/**
-	 * @param mixed $optionValue
-	 * @return mixed the same type as $optionValue
-	 * @since 16.0.0
-	 * @throws \Exception
-	 */
-	public function handle($optionValue) {
-		$this->placeholder = 'home';
-		$user = $this->getUser();
+    /**
+     * @param mixed $optionValue
+     * @return mixed the same type as $optionValue
+     * @since 16.0.0
+     * @throws \Exception
+     */
+    public function handle($optionValue) {
+        $this->placeholder = 'home';
+        $user = $this->getUser();
 
-		if ($user === null) {
-			return $optionValue;
-		}
+        if ($user === null) {
+            return $optionValue;
+        }
 
-		$backend = $user->getBackend();
-		if (!$backend instanceof User_Proxy) {
-			return $optionValue;
-		}
+        $backend = $user->getBackend();
+        if (!$backend instanceof User_Proxy) {
+            return $optionValue;
+        }
 
-		$access = $backend->getLDAPAccess($user->getUID());
-		if (!$access) {
-			return $optionValue;
-		}
+        $access = $backend->getLDAPAccess($user->getUID());
+        if (!$access) {
+            return $optionValue;
+        }
 
-		$attribute = $access->connection->ldapExtStorageHomeAttribute;
-		if (empty($attribute)) {
-			return $optionValue;
-		}
+        $attribute = $access->connection->ldapExtStorageHomeAttribute;
+        if (empty($attribute)) {
+            return $optionValue;
+        }
 
-		$ldapUser = $access->userManager->get($user->getUID());
-		$extHome = $ldapUser->getExtStorageHome();
+        $ldapUser = $access->userManager->get($user->getUID());
+        $extHome = $ldapUser->getExtStorageHome();
 
-		return $this->processInput($optionValue, $extHome);
-	}
+        return $this->processInput($optionValue, $extHome);
+    }
 }

apps/user_ldap/lib/WizardResult.php

Indentation +40 added lines, -40 removed lines

@@ -30,50 +30,50 @@
 namespace OCA\User_LDAP;
 
 class WizardResult {
-	protected $changes = [];
-	protected $options = [];
-	protected $markedChange = false;
+    protected $changes = [];
+    protected $options = [];
+    protected $markedChange = false;
 
-	/**
-	 * @param string $key
-	 * @param mixed $value
-	 */
-	public function addChange($key, $value) {
-		$this->changes[$key] = $value;
-	}
+    /**
+     * @param string $key
+     * @param mixed $value
+     */
+    public function addChange($key, $value) {
+        $this->changes[$key] = $value;
+    }
 
 	
-	public function markChange() {
-		$this->markedChange = true;
-	}
+    public function markChange() {
+        $this->markedChange = true;
+    }
 
-	/**
-	 * @param string $key
-	 * @param array|string $values
-	 */
-	public function addOptions($key, $values) {
-		if (!is_array($values)) {
-			$values = [$values];
-		}
-		$this->options[$key] = $values;
-	}
+    /**
+     * @param string $key
+     * @param array|string $values
+     */
+    public function addOptions($key, $values) {
+        if (!is_array($values)) {
+            $values = [$values];
+        }
+        $this->options[$key] = $values;
+    }
 
-	/**
-	 * @return bool
-	 */
-	public function hasChanges() {
-		return (count($this->changes) > 0 || $this->markedChange);
-	}
+    /**
+     * @return bool
+     */
+    public function hasChanges() {
+        return (count($this->changes) > 0 || $this->markedChange);
+    }
 
-	/**
-	 * @return array
-	 */
-	public function getResultArray() {
-		$result = [];
-		$result['changes'] = $this->changes;
-		if (count($this->options) > 0) {
-			$result['options'] = $this->options;
-		}
-		return $result;
-	}
+    /**
+     * @return array
+     */
+    public function getResultArray() {
+        $result = [];
+        $result['changes'] = $this->changes;
+        if (count($this->options) > 0) {
+            $result['options'] = $this->options;
+        }
+        return $result;
+    }
 }

apps/user_ldap/lib/Migration/UUIDFixInsert.php

Indentation +58 added lines, -58 removed lines

@@ -33,69 +33,69 @@
 
 class UUIDFixInsert implements IRepairStep {
 
-	/** @var IConfig */
-	protected $config;
+    /** @var IConfig */
+    protected $config;
 
-	/** @var UserMapping */
-	protected $userMapper;
+    /** @var UserMapping */
+    protected $userMapper;
 
-	/** @var GroupMapping */
-	protected $groupMapper;
+    /** @var GroupMapping */
+    protected $groupMapper;
 
-	/** @var IJobList */
-	protected $jobList;
+    /** @var IJobList */
+    protected $jobList;
 
-	public function __construct(IConfig $config, UserMapping $userMapper, GroupMapping $groupMapper, IJobList $jobList) {
-		$this->config = $config;
-		$this->userMapper = $userMapper;
-		$this->groupMapper = $groupMapper;
-		$this->jobList = $jobList;
-	}
+    public function __construct(IConfig $config, UserMapping $userMapper, GroupMapping $groupMapper, IJobList $jobList) {
+        $this->config = $config;
+        $this->userMapper = $userMapper;
+        $this->groupMapper = $groupMapper;
+        $this->jobList = $jobList;
+    }
 
-	/**
-	 * Returns the step's name
-	 *
-	 * @return string
-	 * @since 9.1.0
-	 */
-	public function getName() {
-		return 'Insert UUIDFix background job for user and group in batches';
-	}
+    /**
+     * Returns the step's name
+     *
+     * @return string
+     * @since 9.1.0
+     */
+    public function getName() {
+        return 'Insert UUIDFix background job for user and group in batches';
+    }
 
-	/**
-	 * Run repair step.
-	 * Must throw exception on error.
-	 *
-	 * @param IOutput $output
-	 * @throws \Exception in case of failure
-	 * @since 9.1.0
-	 */
-	public function run(IOutput $output) {
-		$installedVersion = $this->config->getAppValue('user_ldap', 'installed_version', '1.2.1');
-		if (version_compare($installedVersion, '1.2.1') !== -1) {
-			return;
-		}
+    /**
+     * Run repair step.
+     * Must throw exception on error.
+     *
+     * @param IOutput $output
+     * @throws \Exception in case of failure
+     * @since 9.1.0
+     */
+    public function run(IOutput $output) {
+        $installedVersion = $this->config->getAppValue('user_ldap', 'installed_version', '1.2.1');
+        if (version_compare($installedVersion, '1.2.1') !== -1) {
+            return;
+        }
 
-		foreach ([$this->userMapper, $this->groupMapper] as $mapper) {
-			$offset = 0;
-			$batchSize = 50;
-			$jobClass = $mapper instanceof UserMapping ? UUIDFixUser::class : UUIDFixGroup::class;
-			do {
-				$retry = false;
-				$records = $mapper->getList($offset, $batchSize);
-				if (count($records) === 0) {
-					continue;
-				}
-				try {
-					$this->jobList->add($jobClass, ['records' => $records]);
-					$offset += $batchSize;
-				} catch (\InvalidArgumentException $e) {
-					if (strpos($e->getMessage(), 'Background job arguments can\'t exceed 4000') !== false) {
-						$batchSize = (int)floor(count($records) * 0.8);
-						$retry = true;
-					}
-				}
-			} while (count($records) === $batchSize || $retry);
-		}
-	}
+        foreach ([$this->userMapper, $this->groupMapper] as $mapper) {
+            $offset = 0;
+            $batchSize = 50;
+            $jobClass = $mapper instanceof UserMapping ? UUIDFixUser::class : UUIDFixGroup::class;
+            do {
+                $retry = false;
+                $records = $mapper->getList($offset, $batchSize);
+                if (count($records) === 0) {
+                    continue;
+                }
+                try {
+                    $this->jobList->add($jobClass, ['records' => $records]);
+                    $offset += $batchSize;
+                } catch (\InvalidArgumentException $e) {
+                    if (strpos($e->getMessage(), 'Background job arguments can\'t exceed 4000') !== false) {
+                        $batchSize = (int)floor(count($records) * 0.8);
+                        $retry = true;
+                    }
+                }
+            } while (count($records) === $batchSize || $retry);
+        }
+    }
 }

apps/user_ldap/templates/part.wizard-server.php

Indentation +7 added lines, -7 removed lines

@@ -2,15 +2,15 @@
 		<p>
 		<select id="ldap_serverconfig_chooser" name="ldap_serverconfig_chooser">
 		<?php
-		$i = 1;
-		$sel = ' selected';
-		foreach ($_['serverConfigurationPrefixes'] as $prefix) {
-			?>
+        $i = 1;
+        $sel = ' selected';
+        foreach ($_['serverConfigurationPrefixes'] as $prefix) {
+            ?>
 			<option value="<?php p($prefix); ?>"<?php p($sel);
-			$sel = ''; ?>><?php p($l->t('%s. Server:', [$i++])); ?> <?php p(' '.$_['serverConfigurationHosts'][$prefix]); ?></option>
+            $sel = ''; ?>><?php p($l->t('%s. Server:', [$i++])); ?> <?php p(' '.$_['serverConfigurationHosts'][$prefix]); ?></option>
 			<?php
-		}
-		?>
+        }
+        ?>
 		</select>
 		<button type="button" id="ldap_action_add_configuration"
 			name="ldap_action_add_configuration" class="icon-add icon-default-style"

apps/user_ldap/ajax/setConfiguration.php

Indentation +4 added lines, -4 removed lines

@@ -36,11 +36,11 @@
 // only legacy checkboxes (Advanced and Expert tab) need to be handled here,
 // the Wizard-like tabs handle it on their own
 $chkboxes = ['ldap_configuration_active', 'ldap_override_main_server',
-	'ldap_turn_off_cert_check'];
+    'ldap_turn_off_cert_check'];
 foreach ($chkboxes as $boxid) {
-	if (!isset($_POST[$boxid])) {
-		$_POST[$boxid] = 0;
-	}
+    if (!isset($_POST[$boxid])) {
+        $_POST[$boxid] = 0;
+    }
 }
 
 $ldapWrapper = new OCA\User_LDAP\LDAP();

apps/encryption/lib/Hooks/UserHooks.php

Indentation +300 added lines, -300 removed lines

@@ -44,304 +44,304 @@
 
 class UserHooks implements IHook {
 
-	/**
-	 * list of user for which we perform a password reset
-	 * @var array
-	 */
-	protected static $passwordResetUsers = [];
-
-	/**
-	 * @var KeyManager
-	 */
-	private $keyManager;
-	/**
-	 * @var IUserManager
-	 */
-	private $userManager;
-	/**
-	 * @var ILogger
-	 */
-	private $logger;
-	/**
-	 * @var Setup
-	 */
-	private $userSetup;
-	/**
-	 * @var IUserSession
-	 */
-	private $userSession;
-	/**
-	 * @var Util
-	 */
-	private $util;
-	/**
-	 * @var Session
-	 */
-	private $session;
-	/**
-	 * @var Recovery
-	 */
-	private $recovery;
-	/**
-	 * @var Crypt
-	 */
-	private $crypt;
-
-	/**
-	 * UserHooks constructor.
-	 *
-	 * @param KeyManager $keyManager
-	 * @param IUserManager $userManager
-	 * @param ILogger $logger
-	 * @param Setup $userSetup
-	 * @param IUserSession $userSession
-	 * @param Util $util
-	 * @param Session $session
-	 * @param Crypt $crypt
-	 * @param Recovery $recovery
-	 */
-	public function __construct(KeyManager $keyManager,
-								IUserManager $userManager,
-								ILogger $logger,
-								Setup $userSetup,
-								IUserSession $userSession,
-								Util $util,
-								Session $session,
-								Crypt $crypt,
-								Recovery $recovery) {
-		$this->keyManager = $keyManager;
-		$this->userManager = $userManager;
-		$this->logger = $logger;
-		$this->userSetup = $userSetup;
-		$this->userSession = $userSession;
-		$this->util = $util;
-		$this->session = $session;
-		$this->recovery = $recovery;
-		$this->crypt = $crypt;
-	}
-
-	/**
-	 * Connects Hooks
-	 *
-	 * @return null
-	 */
-	public function addHooks() {
-		OCUtil::connectHook('OC_User', 'post_login', $this, 'login');
-		OCUtil::connectHook('OC_User', 'logout', $this, 'logout');
-
-		// this hooks only make sense if no master key is used
-		if ($this->util->isMasterKeyEnabled() === false) {
-			OCUtil::connectHook('OC_User',
-				'post_setPassword',
-				$this,
-				'setPassphrase');
-
-			OCUtil::connectHook('OC_User',
-				'pre_setPassword',
-				$this,
-				'preSetPassphrase');
-
-			OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
-				'post_passwordReset',
-				$this,
-				'postPasswordReset');
-
-			OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
-				'pre_passwordReset',
-				$this,
-				'prePasswordReset');
-
-			OCUtil::connectHook('OC_User',
-				'post_createUser',
-				$this,
-				'postCreateUser');
-
-			OCUtil::connectHook('OC_User',
-				'post_deleteUser',
-				$this,
-				'postDeleteUser');
-		}
-	}
-
-
-	/**
-	 * Startup encryption backend upon user login
-	 *
-	 * @note This method should never be called for users using client side encryption
-	 * @param array $params
-	 * @return boolean|null
-	 */
-	public function login($params) {
-		// ensure filesystem is loaded
-		if (!\OC\Files\Filesystem::$loaded) {
-			$this->setupFS($params['uid']);
-		}
-		if ($this->util->isMasterKeyEnabled() === false) {
-			$this->userSetup->setupUser($params['uid'], $params['password']);
-		}
-
-		$this->keyManager->init($params['uid'], $params['password']);
-	}
-
-	/**
-	 * remove keys from session during logout
-	 */
-	public function logout() {
-		$this->session->clear();
-	}
-
-	/**
-	 * setup encryption backend upon user created
-	 *
-	 * @note This method should never be called for users using client side encryption
-	 * @param array $params
-	 */
-	public function postCreateUser($params) {
-		$this->userSetup->setupUser($params['uid'], $params['password']);
-	}
-
-	/**
-	 * cleanup encryption backend upon user deleted
-	 *
-	 * @param array $params : uid, password
-	 * @note This method should never be called for users using client side encryption
-	 */
-	public function postDeleteUser($params) {
-		$this->keyManager->deletePublicKey($params['uid']);
-	}
-
-	public function prePasswordReset($params) {
-		$user = $params['uid'];
-		self::$passwordResetUsers[$user] = true;
-	}
-
-	public function postPasswordReset($params) {
-		$uid = $params['uid'];
-		$password = $params['password'];
-		$this->keyManager->backupUserKeys('passwordReset', $uid);
-		$this->keyManager->deleteUserKeys($uid);
-		$this->userSetup->setupUser($uid, $password);
-		unset(self::$passwordResetUsers[$uid]);
-	}
-
-	/**
-	 * If the password can't be changed within Nextcloud, than update the key password in advance.
-	 *
-	 * @param array $params : uid, password
-	 * @return boolean|null
-	 */
-	public function preSetPassphrase($params) {
-		$user = $this->userManager->get($params['uid']);
-
-		if ($user && !$user->canChangePassword()) {
-			$this->setPassphrase($params);
-		}
-	}
-
-	/**
-	 * Change a user's encryption passphrase
-	 *
-	 * @param array $params keys: uid, password
-	 * @return boolean|null
-	 */
-	public function setPassphrase($params) {
-
-		// if we are in the process to resetting a user password, we have nothing
-		// to do here
-		if (isset(self::$passwordResetUsers[$params['uid']])) {
-			return true;
-		}
-
-		// Get existing decrypted private key
-		$user = $this->userSession->getUser();
-
-		// current logged in user changes his own password
-		if ($user && $params['uid'] === $user->getUID()) {
-			$privateKey = $this->session->getPrivateKey();
-
-			// Encrypt private key with new user pwd as passphrase
-			$encryptedPrivateKey = $this->crypt->encryptPrivateKey($privateKey, $params['password'], $params['uid']);
-
-			// Save private key
-			if ($encryptedPrivateKey) {
-				$this->keyManager->setPrivateKey($user->getUID(),
-					$this->crypt->generateHeader() . $encryptedPrivateKey);
-			} else {
-				$this->logger->error('Encryption could not update users encryption password');
-			}
-
-			// NOTE: Session does not need to be updated as the
-			// private key has not changed, only the passphrase
-			// used to decrypt it has changed
-		} else { // admin changed the password for a different user, create new keys and re-encrypt file keys
-			$userId = $params['uid'];
-			$this->initMountPoints($userId);
-			$recoveryPassword = isset($params['recoveryPassword']) ? $params['recoveryPassword'] : null;
-
-			$recoveryKeyId = $this->keyManager->getRecoveryKeyId();
-			$recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId);
-			try {
-				$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $recoveryPassword);
-			} catch (\Exception $e) {
-				$decryptedRecoveryKey = false;
-			}
-			if ($decryptedRecoveryKey === false) {
-				$message = 'Can not decrypt the recovery key. Maybe you provided the wrong password. Try again.';
-				throw new GenericEncryptionException($message, $message);
-			}
-
-			// we generate new keys if...
-			// ...we have a recovery password and the user enabled the recovery key
-			// ...encryption was activated for the first time (no keys exists)
-			// ...the user doesn't have any files
-			if (
-				($this->recovery->isRecoveryEnabledForUser($userId) && $recoveryPassword)
-				|| !$this->keyManager->userHasKeys($userId)
-				|| !$this->util->userHasFiles($userId)
-			) {
-
-				// backup old keys
-				//$this->backupAllKeys('recovery');
-
-				$newUserPassword = $params['password'];
-
-				$keyPair = $this->crypt->createKeyPair();
-
-				// Save public key
-				$this->keyManager->setPublicKey($userId, $keyPair['publicKey']);
-
-				// Encrypt private key with new password
-				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $userId);
-
-				if ($encryptedKey) {
-					$this->keyManager->setPrivateKey($userId, $this->crypt->generateHeader() . $encryptedKey);
-
-					if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files
-						$this->recovery->recoverUsersFiles($recoveryPassword, $userId);
-					}
-				} else {
-					$this->logger->error('Encryption Could not update users encryption password');
-				}
-			}
-		}
-	}
-
-	/**
-	 * init mount points for given user
-	 *
-	 * @param string $user
-	 * @throws \OC\User\NoUserException
-	 */
-	protected function initMountPoints($user) {
-		Filesystem::initMountPoints($user);
-	}
-
-	/**
-	 * setup file system for user
-	 *
-	 * @param string $uid user id
-	 */
-	protected function setupFS($uid) {
-		\OC_Util::setupFS($uid);
-	}
+    /**
+     * list of user for which we perform a password reset
+     * @var array
+     */
+    protected static $passwordResetUsers = [];
+
+    /**
+     * @var KeyManager
+     */
+    private $keyManager;
+    /**
+     * @var IUserManager
+     */
+    private $userManager;
+    /**
+     * @var ILogger
+     */
+    private $logger;
+    /**
+     * @var Setup
+     */
+    private $userSetup;
+    /**
+     * @var IUserSession
+     */
+    private $userSession;
+    /**
+     * @var Util
+     */
+    private $util;
+    /**
+     * @var Session
+     */
+    private $session;
+    /**
+     * @var Recovery
+     */
+    private $recovery;
+    /**
+     * @var Crypt
+     */
+    private $crypt;
+
+    /**
+     * UserHooks constructor.
+     *
+     * @param KeyManager $keyManager
+     * @param IUserManager $userManager
+     * @param ILogger $logger
+     * @param Setup $userSetup
+     * @param IUserSession $userSession
+     * @param Util $util
+     * @param Session $session
+     * @param Crypt $crypt
+     * @param Recovery $recovery
+     */
+    public function __construct(KeyManager $keyManager,
+                                IUserManager $userManager,
+                                ILogger $logger,
+                                Setup $userSetup,
+                                IUserSession $userSession,
+                                Util $util,
+                                Session $session,
+                                Crypt $crypt,
+                                Recovery $recovery) {
+        $this->keyManager = $keyManager;
+        $this->userManager = $userManager;
+        $this->logger = $logger;
+        $this->userSetup = $userSetup;
+        $this->userSession = $userSession;
+        $this->util = $util;
+        $this->session = $session;
+        $this->recovery = $recovery;
+        $this->crypt = $crypt;
+    }
+
+    /**
+     * Connects Hooks
+     *
+     * @return null
+     */
+    public function addHooks() {
+        OCUtil::connectHook('OC_User', 'post_login', $this, 'login');
+        OCUtil::connectHook('OC_User', 'logout', $this, 'logout');
+
+        // this hooks only make sense if no master key is used
+        if ($this->util->isMasterKeyEnabled() === false) {
+            OCUtil::connectHook('OC_User',
+                'post_setPassword',
+                $this,
+                'setPassphrase');
+
+            OCUtil::connectHook('OC_User',
+                'pre_setPassword',
+                $this,
+                'preSetPassphrase');
+
+            OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
+                'post_passwordReset',
+                $this,
+                'postPasswordReset');
+
+            OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
+                'pre_passwordReset',
+                $this,
+                'prePasswordReset');
+
+            OCUtil::connectHook('OC_User',
+                'post_createUser',
+                $this,
+                'postCreateUser');
+
+            OCUtil::connectHook('OC_User',
+                'post_deleteUser',
+                $this,
+                'postDeleteUser');
+        }
+    }
+
+
+    /**
+     * Startup encryption backend upon user login
+     *
+     * @note This method should never be called for users using client side encryption
+     * @param array $params
+     * @return boolean|null
+     */
+    public function login($params) {
+        // ensure filesystem is loaded
+        if (!\OC\Files\Filesystem::$loaded) {
+            $this->setupFS($params['uid']);
+        }
+        if ($this->util->isMasterKeyEnabled() === false) {
+            $this->userSetup->setupUser($params['uid'], $params['password']);
+        }
+
+        $this->keyManager->init($params['uid'], $params['password']);
+    }
+
+    /**
+     * remove keys from session during logout
+     */
+    public function logout() {
+        $this->session->clear();
+    }
+
+    /**
+     * setup encryption backend upon user created
+     *
+     * @note This method should never be called for users using client side encryption
+     * @param array $params
+     */
+    public function postCreateUser($params) {
+        $this->userSetup->setupUser($params['uid'], $params['password']);
+    }
+
+    /**
+     * cleanup encryption backend upon user deleted
+     *
+     * @param array $params : uid, password
+     * @note This method should never be called for users using client side encryption
+     */
+    public function postDeleteUser($params) {
+        $this->keyManager->deletePublicKey($params['uid']);
+    }
+
+    public function prePasswordReset($params) {
+        $user = $params['uid'];
+        self::$passwordResetUsers[$user] = true;
+    }
+
+    public function postPasswordReset($params) {
+        $uid = $params['uid'];
+        $password = $params['password'];
+        $this->keyManager->backupUserKeys('passwordReset', $uid);
+        $this->keyManager->deleteUserKeys($uid);
+        $this->userSetup->setupUser($uid, $password);
+        unset(self::$passwordResetUsers[$uid]);
+    }
+
+    /**
+     * If the password can't be changed within Nextcloud, than update the key password in advance.
+     *
+     * @param array $params : uid, password
+     * @return boolean|null
+     */
+    public function preSetPassphrase($params) {
+        $user = $this->userManager->get($params['uid']);
+
+        if ($user && !$user->canChangePassword()) {
+            $this->setPassphrase($params);
+        }
+    }
+
+    /**
+     * Change a user's encryption passphrase
+     *
+     * @param array $params keys: uid, password
+     * @return boolean|null
+     */
+    public function setPassphrase($params) {
+
+        // if we are in the process to resetting a user password, we have nothing
+        // to do here
+        if (isset(self::$passwordResetUsers[$params['uid']])) {
+            return true;
+        }
+
+        // Get existing decrypted private key
+        $user = $this->userSession->getUser();
+
+        // current logged in user changes his own password
+        if ($user && $params['uid'] === $user->getUID()) {
+            $privateKey = $this->session->getPrivateKey();
+
+            // Encrypt private key with new user pwd as passphrase
+            $encryptedPrivateKey = $this->crypt->encryptPrivateKey($privateKey, $params['password'], $params['uid']);
+
+            // Save private key
+            if ($encryptedPrivateKey) {
+                $this->keyManager->setPrivateKey($user->getUID(),
+                    $this->crypt->generateHeader() . $encryptedPrivateKey);
+            } else {
+                $this->logger->error('Encryption could not update users encryption password');
+            }
+
+            // NOTE: Session does not need to be updated as the
+            // private key has not changed, only the passphrase
+            // used to decrypt it has changed
+        } else { // admin changed the password for a different user, create new keys and re-encrypt file keys
+            $userId = $params['uid'];
+            $this->initMountPoints($userId);
+            $recoveryPassword = isset($params['recoveryPassword']) ? $params['recoveryPassword'] : null;
+
+            $recoveryKeyId = $this->keyManager->getRecoveryKeyId();
+            $recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId);
+            try {
+                $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $recoveryPassword);
+            } catch (\Exception $e) {
+                $decryptedRecoveryKey = false;
+            }
+            if ($decryptedRecoveryKey === false) {
+                $message = 'Can not decrypt the recovery key. Maybe you provided the wrong password. Try again.';
+                throw new GenericEncryptionException($message, $message);
+            }
+
+            // we generate new keys if...
+            // ...we have a recovery password and the user enabled the recovery key
+            // ...encryption was activated for the first time (no keys exists)
+            // ...the user doesn't have any files
+            if (
+                ($this->recovery->isRecoveryEnabledForUser($userId) && $recoveryPassword)
+                || !$this->keyManager->userHasKeys($userId)
+                || !$this->util->userHasFiles($userId)
+            ) {
+
+                // backup old keys
+                //$this->backupAllKeys('recovery');
+
+                $newUserPassword = $params['password'];
+
+                $keyPair = $this->crypt->createKeyPair();
+
+                // Save public key
+                $this->keyManager->setPublicKey($userId, $keyPair['publicKey']);
+
+                // Encrypt private key with new password
+                $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $userId);
+
+                if ($encryptedKey) {
+                    $this->keyManager->setPrivateKey($userId, $this->crypt->generateHeader() . $encryptedKey);
+
+                    if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files
+                        $this->recovery->recoverUsersFiles($recoveryPassword, $userId);
+                    }
+                } else {
+                    $this->logger->error('Encryption Could not update users encryption password');
+                }
+            }
+        }
+    }
+
+    /**
+     * init mount points for given user
+     *
+     * @param string $user
+     * @throws \OC\User\NoUserException
+     */
+    protected function initMountPoints($user) {
+        Filesystem::initMountPoints($user);
+    }
+
+    /**
+     * setup file system for user
+     *
+     * @param string $uid user id
+     */
+    protected function setupFS($uid) {
+        \OC_Util::setupFS($uid);
+    }
 }

apps/settings/lib/Controller/LogSettingsController.php

Indentation +22 added lines, -22 removed lines

@@ -35,28 +35,28 @@
 
 class LogSettingsController extends Controller {
 
-	/** @var Log */
-	private $log;
+    /** @var Log */
+    private $log;
 
-	public function __construct(string $appName, IRequest $request, Log $logger) {
-		parent::__construct($appName, $request);
-		$this->log = $logger;
-	}
+    public function __construct(string $appName, IRequest $request, Log $logger) {
+        parent::__construct($appName, $request);
+        $this->log = $logger;
+    }
 
-	/**
-	 * download logfile
-	 *
-	 * @NoCSRFRequired
-	 *
-	 * @return StreamResponse
-	 */
-	public function download() {
-		if (!$this->log instanceof Log) {
-			throw new \UnexpectedValueException('Log file not available');
-		}
-		$resp = new StreamResponse($this->log->getLogPath());
-		$resp->addHeader('Content-Type', 'application/octet-stream');
-		$resp->addHeader('Content-Disposition', 'attachment; filename="nextcloud.log"');
-		return $resp;
-	}
+    /**
+     * download logfile
+     *
+     * @NoCSRFRequired
+     *
+     * @return StreamResponse
+     */
+    public function download() {
+        if (!$this->log instanceof Log) {
+            throw new \UnexpectedValueException('Log file not available');
+        }
+        $resp = new StreamResponse($this->log->getLogPath());
+        $resp->addHeader('Content-Type', 'application/octet-stream');
+        $resp->addHeader('Content-Disposition', 'attachment; filename="nextcloud.log"');
+        return $resp;
+    }
 }

apps/settings/templates/settings/admin/overview.php

Indentation +2 added lines, -2 removed lines

@@ -46,9 +46,9 @@
 	</div>
 
 	<div id="postsetupchecks" data-check-wellknown="<?php if ($_['checkForWorkingWellKnownSetup']) {
-	p('true');
+    p('true');
 } else {
-	p('false');
+    p('false');
 } ?>">
 		<ul class="errors hidden"></ul>
 		<ul class="warnings hidden"></ul>