nextcloud / server

apps/encryption/lib/AppInfo/Application.php

Indentation +186 added lines, -186 removed lines

@@ -50,213 +50,213 @@
 
 class Application extends \OCP\AppFramework\App {
 
-	/** @var IManager */
-	private $encryptionManager;
-	/** @var IConfig */
-	private $config;
+    /** @var IManager */
+    private $encryptionManager;
+    /** @var IConfig */
+    private $config;
 
-	/**
-	 * @param array $urlParams
-	 */
-	public function __construct($urlParams = []) {
-		parent::__construct('encryption', $urlParams);
-		$this->encryptionManager = \OC::$server->getEncryptionManager();
-		$this->config = \OC::$server->getConfig();
-		$this->registerServices();
-	}
+    /**
+     * @param array $urlParams
+     */
+    public function __construct($urlParams = []) {
+        parent::__construct('encryption', $urlParams);
+        $this->encryptionManager = \OC::$server->getEncryptionManager();
+        $this->config = \OC::$server->getConfig();
+        $this->registerServices();
+    }
 
-	public function setUp() {
-		if ($this->encryptionManager->isEnabled()) {
-			/** @var Setup $setup */
-			$setup = $this->getContainer()->query('UserSetup');
-			$setup->setupSystem();
-		}
-	}
+    public function setUp() {
+        if ($this->encryptionManager->isEnabled()) {
+            /** @var Setup $setup */
+            $setup = $this->getContainer()->query('UserSetup');
+            $setup->setupSystem();
+        }
+    }
 
-	/**
-	 * register hooks
-	 */
-	public function registerHooks() {
-		if (!$this->config->getSystemValueBool('maintenance')) {
-			$container = $this->getContainer();
-			$server = $container->getServer();
-			// Register our hooks and fire them.
-			$hookManager = new HookManager();
+    /**
+     * register hooks
+     */
+    public function registerHooks() {
+        if (!$this->config->getSystemValueBool('maintenance')) {
+            $container = $this->getContainer();
+            $server = $container->getServer();
+            // Register our hooks and fire them.
+            $hookManager = new HookManager();
 
-			$hookManager->registerHook([
-				new UserHooks($container->query('KeyManager'),
-					$server->getUserManager(),
-					$server->getLogger(),
-					$container->query('UserSetup'),
-					$server->getUserSession(),
-					$container->query('Util'),
-					$container->query('Session'),
-					$container->query('Crypt'),
-					$container->query('Recovery'))
-			]);
+            $hookManager->registerHook([
+                new UserHooks($container->query('KeyManager'),
+                    $server->getUserManager(),
+                    $server->getLogger(),
+                    $container->query('UserSetup'),
+                    $server->getUserSession(),
+                    $container->query('Util'),
+                    $container->query('Session'),
+                    $container->query('Crypt'),
+                    $container->query('Recovery'))
+            ]);
 
-			$hookManager->fireHooks();
-		} else {
-			// Logout user if we are in maintenance to force re-login
-			$this->getContainer()->getServer()->getUserSession()->logout();
-		}
-	}
+            $hookManager->fireHooks();
+        } else {
+            // Logout user if we are in maintenance to force re-login
+            $this->getContainer()->getServer()->getUserSession()->logout();
+        }
+    }
 
-	public function registerEncryptionModule() {
-		$container = $this->getContainer();
+    public function registerEncryptionModule() {
+        $container = $this->getContainer();
 
 
-		$this->encryptionManager->registerEncryptionModule(
-			Encryption::ID,
-			Encryption::DISPLAY_NAME,
-			function () use ($container) {
-				return new Encryption(
-				$container->query('Crypt'),
-				$container->query('KeyManager'),
-				$container->query('Util'),
-				$container->query('Session'),
-				$container->query('EncryptAll'),
-				$container->query('DecryptAll'),
-				$container->getServer()->getLogger(),
-				$container->getServer()->getL10N($container->getAppName())
-			);
-			});
-	}
+        $this->encryptionManager->registerEncryptionModule(
+            Encryption::ID,
+            Encryption::DISPLAY_NAME,
+            function () use ($container) {
+                return new Encryption(
+                $container->query('Crypt'),
+                $container->query('KeyManager'),
+                $container->query('Util'),
+                $container->query('Session'),
+                $container->query('EncryptAll'),
+                $container->query('DecryptAll'),
+                $container->getServer()->getLogger(),
+                $container->getServer()->getL10N($container->getAppName())
+            );
+            });
+    }
 
-	public function registerServices() {
-		$container = $this->getContainer();
+    public function registerServices() {
+        $container = $this->getContainer();
 
-		$container->registerService('Crypt',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-				return new Crypt($server->getLogger(),
-					$server->getUserSession(),
-					$server->getConfig(),
-					$server->getL10N($c->getAppName()));
-			});
+        $container->registerService('Crypt',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+                return new Crypt($server->getLogger(),
+                    $server->getUserSession(),
+                    $server->getConfig(),
+                    $server->getL10N($c->getAppName()));
+            });
 
-		$container->registerService('Session',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-				return new Session($server->getSession());
-			}
-		);
+        $container->registerService('Session',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+                return new Session($server->getSession());
+            }
+        );
 
-		$container->registerService('KeyManager',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
+        $container->registerService('KeyManager',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
 
-				return new KeyManager($server->getEncryptionKeyStorage(),
-					$c->query('Crypt'),
-					$server->getConfig(),
-					$server->getUserSession(),
-					new Session($server->getSession()),
-					$server->getLogger(),
-					$c->query('Util'),
-					$server->getLockingProvider()
-				);
-			});
+                return new KeyManager($server->getEncryptionKeyStorage(),
+                    $c->query('Crypt'),
+                    $server->getConfig(),
+                    $server->getUserSession(),
+                    new Session($server->getSession()),
+                    $server->getLogger(),
+                    $c->query('Util'),
+                    $server->getLockingProvider()
+                );
+            });
 
-		$container->registerService('Recovery',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
+        $container->registerService('Recovery',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
 
-				return new Recovery(
-					$server->getUserSession(),
-					$c->query('Crypt'),
-					$c->query('KeyManager'),
-					$server->getConfig(),
-					$server->getEncryptionFilesHelper(),
-					new View());
-			});
+                return new Recovery(
+                    $server->getUserSession(),
+                    $c->query('Crypt'),
+                    $c->query('KeyManager'),
+                    $server->getConfig(),
+                    $server->getEncryptionFilesHelper(),
+                    new View());
+            });
 
-		$container->registerService('RecoveryController', function (IAppContainer $c) {
-			$server = $c->getServer();
-			return new RecoveryController(
-				$c->getAppName(),
-				$server->getRequest(),
-				$server->getConfig(),
-				$server->getL10N($c->getAppName()),
-				$c->query('Recovery'));
-		});
+        $container->registerService('RecoveryController', function (IAppContainer $c) {
+            $server = $c->getServer();
+            return new RecoveryController(
+                $c->getAppName(),
+                $server->getRequest(),
+                $server->getConfig(),
+                $server->getL10N($c->getAppName()),
+                $c->query('Recovery'));
+        });
 
-		$container->registerService('StatusController', function (IAppContainer $c) {
-			$server = $c->getServer();
-			return new StatusController(
-				$c->getAppName(),
-				$server->getRequest(),
-				$server->getL10N($c->getAppName()),
-				$c->query('Session'),
-				$server->getEncryptionManager()
-			);
-		});
+        $container->registerService('StatusController', function (IAppContainer $c) {
+            $server = $c->getServer();
+            return new StatusController(
+                $c->getAppName(),
+                $server->getRequest(),
+                $server->getL10N($c->getAppName()),
+                $c->query('Session'),
+                $server->getEncryptionManager()
+            );
+        });
 
-		$container->registerService('SettingsController', function (IAppContainer $c) {
-			$server = $c->getServer();
-			return new SettingsController(
-				$c->getAppName(),
-				$server->getRequest(),
-				$server->getL10N($c->getAppName()),
-				$server->getUserManager(),
-				$server->getUserSession(),
-				$c->query('KeyManager'),
-				$c->query('Crypt'),
-				$c->query('Session'),
-				$server->getSession(),
-				$c->query('Util')
-			);
-		});
+        $container->registerService('SettingsController', function (IAppContainer $c) {
+            $server = $c->getServer();
+            return new SettingsController(
+                $c->getAppName(),
+                $server->getRequest(),
+                $server->getL10N($c->getAppName()),
+                $server->getUserManager(),
+                $server->getUserSession(),
+                $c->query('KeyManager'),
+                $c->query('Crypt'),
+                $c->query('Session'),
+                $server->getSession(),
+                $c->query('Util')
+            );
+        });
 
-		$container->registerService('UserSetup',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-				return new Setup($server->getLogger(),
-					$server->getUserSession(),
-					$c->query('Crypt'),
-					$c->query('KeyManager'));
-			});
+        $container->registerService('UserSetup',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+                return new Setup($server->getLogger(),
+                    $server->getUserSession(),
+                    $c->query('Crypt'),
+                    $c->query('KeyManager'));
+            });
 
-		$container->registerService('Util',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
+        $container->registerService('Util',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
 
-				return new Util(
-					new View(),
-					$c->query('Crypt'),
-					$server->getLogger(),
-					$server->getUserSession(),
-					$server->getConfig(),
-					$server->getUserManager());
-			});
+                return new Util(
+                    new View(),
+                    $c->query('Crypt'),
+                    $server->getLogger(),
+                    $server->getUserSession(),
+                    $server->getConfig(),
+                    $server->getUserManager());
+            });
 
-		$container->registerService('EncryptAll',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-				return new EncryptAll(
-					$c->query('UserSetup'),
-					$c->getServer()->getUserManager(),
-					new View(),
-					$c->query('KeyManager'),
-					$c->query('Util'),
-					$server->getConfig(),
-					$server->getMailer(),
-					$server->getL10N('encryption'),
-					new QuestionHelper(),
-					$server->getSecureRandom()
-				);
-			}
-		);
+        $container->registerService('EncryptAll',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+                return new EncryptAll(
+                    $c->query('UserSetup'),
+                    $c->getServer()->getUserManager(),
+                    new View(),
+                    $c->query('KeyManager'),
+                    $c->query('Util'),
+                    $server->getConfig(),
+                    $server->getMailer(),
+                    $server->getL10N('encryption'),
+                    new QuestionHelper(),
+                    $server->getSecureRandom()
+                );
+            }
+        );
 
-		$container->registerService('DecryptAll',
-			function (IAppContainer $c) {
-				return new DecryptAll(
-					$c->query('Util'),
-					$c->query('KeyManager'),
-					$c->query('Crypt'),
-					$c->query('Session'),
-					new QuestionHelper()
-				);
-			}
-		);
-	}
+        $container->registerService('DecryptAll',
+            function (IAppContainer $c) {
+                return new DecryptAll(
+                    $c->query('Util'),
+                    $c->query('KeyManager'),
+                    $c->query('Crypt'),
+                    $c->query('Session'),
+                    new QuestionHelper()
+                );
+            }
+        );
+    }
 }

apps/encryption/lib/Users/Setup.php

Indentation +50 added lines, -50 removed lines

@@ -32,58 +32,58 @@
 use OCP\IUserSession;
 
 class Setup {
-	/**
-	 * @var Crypt
-	 */
-	private $crypt;
-	/**
-	 * @var KeyManager
-	 */
-	private $keyManager;
-	/**
-	 * @var ILogger
-	 */
-	private $logger;
-	/**
-	 * @var bool|string
-	 */
-	private $user;
+    /**
+     * @var Crypt
+     */
+    private $crypt;
+    /**
+     * @var KeyManager
+     */
+    private $keyManager;
+    /**
+     * @var ILogger
+     */
+    private $logger;
+    /**
+     * @var bool|string
+     */
+    private $user;
 
 
-	/**
-	 * @param ILogger $logger
-	 * @param IUserSession $userSession
-	 * @param Crypt $crypt
-	 * @param KeyManager $keyManager
-	 */
-	public function __construct(ILogger $logger,
-								IUserSession $userSession,
-								Crypt $crypt,
-								KeyManager $keyManager) {
-		$this->logger = $logger;
-		$this->user = $userSession && $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : false;
-		$this->crypt = $crypt;
-		$this->keyManager = $keyManager;
-	}
+    /**
+     * @param ILogger $logger
+     * @param IUserSession $userSession
+     * @param Crypt $crypt
+     * @param KeyManager $keyManager
+     */
+    public function __construct(ILogger $logger,
+                                IUserSession $userSession,
+                                Crypt $crypt,
+                                KeyManager $keyManager) {
+        $this->logger = $logger;
+        $this->user = $userSession && $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : false;
+        $this->crypt = $crypt;
+        $this->keyManager = $keyManager;
+    }
 
-	/**
-	 * @param string $uid user id
-	 * @param string $password user password
-	 * @return bool
-	 */
-	public function setupUser($uid, $password) {
-		if (!$this->keyManager->userHasKeys($uid)) {
-			$keyPair = $this->crypt->createKeyPair();
-			return is_array($keyPair) ? $this->keyManager->storeKeyPair($uid, $password, $keyPair) : false;
-		}
-		return true;
-	}
+    /**
+     * @param string $uid user id
+     * @param string $password user password
+     * @return bool
+     */
+    public function setupUser($uid, $password) {
+        if (!$this->keyManager->userHasKeys($uid)) {
+            $keyPair = $this->crypt->createKeyPair();
+            return is_array($keyPair) ? $this->keyManager->storeKeyPair($uid, $password, $keyPair) : false;
+        }
+        return true;
+    }
 
-	/**
-	 * make sure that all system keys exists
-	 */
-	public function setupSystem() {
-		$this->keyManager->validateShareKey();
-		$this->keyManager->validateMasterKey();
-	}
+    /**
+     * make sure that all system keys exists
+     */
+    public function setupSystem() {
+        $this->keyManager->validateShareKey();
+        $this->keyManager->validateMasterKey();
+    }
 }

apps/encryption/lib/KeyManager.php

Indentation +717 added lines, -717 removed lines

@@ -45,721 +45,721 @@
 
 class KeyManager {
 
-	/**
-	 * @var Session
-	 */
-	protected $session;
-	/**
-	 * @var IStorage
-	 */
-	private $keyStorage;
-	/**
-	 * @var Crypt
-	 */
-	private $crypt;
-	/**
-	 * @var string
-	 */
-	private $recoveryKeyId;
-	/**
-	 * @var string
-	 */
-	private $publicShareKeyId;
-	/**
-	 * @var string
-	 */
-	private $masterKeyId;
-	/**
-	 * @var string UserID
-	 */
-	private $keyId;
-	/**
-	 * @var string
-	 */
-	private $publicKeyId = 'publicKey';
-	/**
-	 * @var string
-	 */
-	private $privateKeyId = 'privateKey';
-
-	/**
-	 * @var string
-	 */
-	private $shareKeyId = 'shareKey';
-
-	/**
-	 * @var string
-	 */
-	private $fileKeyId = 'fileKey';
-	/**
-	 * @var IConfig
-	 */
-	private $config;
-	/**
-	 * @var ILogger
-	 */
-	private $log;
-	/**
-	 * @var Util
-	 */
-	private $util;
-
-	/**
-	 * @var ILockingProvider
-	 */
-	private $lockingProvider;
-
-	/**
-	 * @param IStorage $keyStorage
-	 * @param Crypt $crypt
-	 * @param IConfig $config
-	 * @param IUserSession $userSession
-	 * @param Session $session
-	 * @param ILogger $log
-	 * @param Util $util
-	 */
-	public function __construct(
-		IStorage $keyStorage,
-		Crypt $crypt,
-		IConfig $config,
-		IUserSession $userSession,
-		Session $session,
-		ILogger $log,
-		Util $util,
-		ILockingProvider $lockingProvider
-	) {
-		$this->util = $util;
-		$this->session = $session;
-		$this->keyStorage = $keyStorage;
-		$this->crypt = $crypt;
-		$this->config = $config;
-		$this->log = $log;
-		$this->lockingProvider = $lockingProvider;
-
-		$this->recoveryKeyId = $this->config->getAppValue('encryption',
-			'recoveryKeyId');
-		if (empty($this->recoveryKeyId)) {
-			$this->recoveryKeyId = 'recoveryKey_' . substr(md5(time()), 0, 8);
-			$this->config->setAppValue('encryption',
-				'recoveryKeyId',
-				$this->recoveryKeyId);
-		}
-
-		$this->publicShareKeyId = $this->config->getAppValue('encryption',
-			'publicShareKeyId');
-		if (empty($this->publicShareKeyId)) {
-			$this->publicShareKeyId = 'pubShare_' . substr(md5(time()), 0, 8);
-			$this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
-		}
-
-		$this->masterKeyId = $this->config->getAppValue('encryption',
-			'masterKeyId');
-		if (empty($this->masterKeyId)) {
-			$this->masterKeyId = 'master_' . substr(md5(time()), 0, 8);
-			$this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
-		}
-
-		$this->keyId = $userSession && $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : false;
-		$this->log = $log;
-	}
-
-	/**
-	 * check if key pair for public link shares exists, if not we create one
-	 */
-	public function validateShareKey() {
-		$shareKey = $this->getPublicShareKey();
-		if (empty($shareKey)) {
-			$this->lockingProvider->acquireLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE, 'Encryption: shared key generation');
-			try {
-				$keyPair = $this->crypt->createKeyPair();
-
-				// Save public key
-				$this->keyStorage->setSystemUserKey(
-					$this->publicShareKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
-					Encryption::ID);
-
-				// Encrypt private key empty passphrase
-				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
-				$header = $this->crypt->generateHeader();
-				$this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
-			} catch (\Throwable $e) {
-				$this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
-				throw $e;
-			}
-			$this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
-		}
-	}
-
-	/**
-	 * check if a key pair for the master key exists, if not we create one
-	 */
-	public function validateMasterKey() {
-		if ($this->util->isMasterKeyEnabled() === false) {
-			return;
-		}
-
-		$publicMasterKey = $this->getPublicMasterKey();
-		$privateMasterKey = $this->getPrivateMasterKey();
-
-		if (empty($publicMasterKey) && empty($privateMasterKey)) {
-			// There could be a race condition here if two requests would trigger
-			// the generation the second one would enter the key generation as long
-			// as the first one didn't write the key to the keystorage yet
-			$this->lockingProvider->acquireLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE, 'Encryption: master key generation');
-			try {
-				$keyPair = $this->crypt->createKeyPair();
-
-				// Save public key
-				$this->keyStorage->setSystemUserKey(
-					$this->masterKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
-					Encryption::ID);
-
-				// Encrypt private key with system password
-				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
-				$header = $this->crypt->generateHeader();
-				$this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
-			} catch (\Throwable $e) {
-				$this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
-				throw $e;
-			}
-			$this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
-		} elseif (empty($publicMasterKey)) {
-			$this->log->error('A private master key is available but the public key could not be found. This should never happen.');
-			return;
-		} elseif (empty($privateMasterKey)) {
-			$this->log->error('A public master key is available but the private key could not be found. This should never happen.');
-			return;
-		}
-
-		if (!$this->session->isPrivateKeySet()) {
-			$masterKey = $this->getSystemPrivateKey($this->masterKeyId);
-			$decryptedMasterKey = $this->crypt->decryptPrivateKey($masterKey, $this->getMasterKeyPassword(), $this->masterKeyId);
-			$this->session->setPrivateKey($decryptedMasterKey);
-		}
-
-		// after the encryption key is available we are ready to go
-		$this->session->setStatus(Session::INIT_SUCCESSFUL);
-	}
-
-	/**
-	 * @return bool
-	 */
-	public function recoveryKeyExists() {
-		$key = $this->getRecoveryKey();
-		return !empty($key);
-	}
-
-	/**
-	 * get recovery key
-	 *
-	 * @return string
-	 */
-	public function getRecoveryKey() {
-		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->publicKeyId, Encryption::ID);
-	}
-
-	/**
-	 * get recovery key ID
-	 *
-	 * @return string
-	 */
-	public function getRecoveryKeyId() {
-		return $this->recoveryKeyId;
-	}
-
-	/**
-	 * @param string $password
-	 * @return bool
-	 */
-	public function checkRecoveryPassword($password) {
-		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->privateKeyId, Encryption::ID);
-		$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
-
-		if ($decryptedRecoveryKey) {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param string $uid
-	 * @param string $password
-	 * @param array $keyPair
-	 * @return bool
-	 */
-	public function storeKeyPair($uid, $password, $keyPair) {
-		// Save Public Key
-		$this->setPublicKey($uid, $keyPair['publicKey']);
-
-		$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password, $uid);
-
-		$header = $this->crypt->generateHeader();
-
-		if ($encryptedKey) {
-			$this->setPrivateKey($uid, $header . $encryptedKey);
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param string $password
-	 * @param array $keyPair
-	 * @return bool
-	 */
-	public function setRecoveryKey($password, $keyPair) {
-		// Save Public Key
-		$this->keyStorage->setSystemUserKey($this->getRecoveryKeyId().
-			'.' . $this->publicKeyId,
-			$keyPair['publicKey'],
-			Encryption::ID);
-
-		$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password);
-		$header = $this->crypt->generateHeader();
-
-		if ($encryptedKey) {
-			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param $userId
-	 * @param $key
-	 * @return bool
-	 */
-	public function setPublicKey($userId, $key) {
-		return $this->keyStorage->setUserKey($userId, $this->publicKeyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * @param $userId
-	 * @param string $key
-	 * @return bool
-	 */
-	public function setPrivateKey($userId, $key) {
-		return $this->keyStorage->setUserKey($userId,
-			$this->privateKeyId,
-			$key,
-			Encryption::ID);
-	}
-
-	/**
-	 * write file key to key storage
-	 *
-	 * @param string $path
-	 * @param string $key
-	 * @return boolean
-	 */
-	public function setFileKey($path, $key) {
-		return $this->keyStorage->setFileKey($path, $this->fileKeyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * set all file keys (the file key and the corresponding share keys)
-	 *
-	 * @param string $path
-	 * @param array $keys
-	 */
-	public function setAllFileKeys($path, $keys) {
-		$this->setFileKey($path, $keys['data']);
-		foreach ($keys['keys'] as $uid => $keyFile) {
-			$this->setShareKey($path, $uid, $keyFile);
-		}
-	}
-
-	/**
-	 * write share key to the key storage
-	 *
-	 * @param string $path
-	 * @param string $uid
-	 * @param string $key
-	 * @return boolean
-	 */
-	public function setShareKey($path, $uid, $key) {
-		$keyId = $uid . '.' . $this->shareKeyId;
-		return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * Decrypt private key and store it
-	 *
-	 * @param string $uid user id
-	 * @param string $passPhrase users password
-	 * @return boolean
-	 */
-	public function init($uid, $passPhrase) {
-		$this->session->setStatus(Session::INIT_EXECUTED);
-
-		try {
-			if ($this->util->isMasterKeyEnabled()) {
-				$uid = $this->getMasterKeyId();
-				$passPhrase = $this->getMasterKeyPassword();
-				$privateKey = $this->getSystemPrivateKey($uid);
-			} else {
-				$privateKey = $this->getPrivateKey($uid);
-			}
-			$privateKey = $this->crypt->decryptPrivateKey($privateKey, $passPhrase, $uid);
-		} catch (PrivateKeyMissingException $e) {
-			return false;
-		} catch (DecryptionFailedException $e) {
-			return false;
-		} catch (\Exception $e) {
-			$this->log->logException($e, [
-				'message' => 'Could not decrypt the private key from user "' . $uid . '"" during login. Assume password change on the user back-end.',
-				'level' => ILogger::WARN,
-				'app' => 'encryption',
-			]);
-			return false;
-		}
-
-		if ($privateKey) {
-			$this->session->setPrivateKey($privateKey);
-			$this->session->setStatus(Session::INIT_SUCCESSFUL);
-			return true;
-		}
-
-		return false;
-	}
-
-	/**
-	 * @param $userId
-	 * @return string
-	 * @throws PrivateKeyMissingException
-	 */
-	public function getPrivateKey($userId) {
-		$privateKey = $this->keyStorage->getUserKey($userId,
-			$this->privateKeyId, Encryption::ID);
-
-		if (strlen($privateKey) !== 0) {
-			return $privateKey;
-		}
-		throw new PrivateKeyMissingException($userId);
-	}
-
-	/**
-	 * @param string $path
-	 * @param $uid
-	 * @return string
-	 */
-	public function getFileKey($path, $uid) {
-		if ($uid === '') {
-			$uid = null;
-		}
-		$publicAccess = is_null($uid);
-		$encryptedFileKey = $this->keyStorage->getFileKey($path, $this->fileKeyId, Encryption::ID);
-
-		if (empty($encryptedFileKey)) {
-			return '';
-		}
-
-		if ($this->util->isMasterKeyEnabled()) {
-			$uid = $this->getMasterKeyId();
-			$shareKey = $this->getShareKey($path, $uid);
-			if ($publicAccess) {
-				$privateKey = $this->getSystemPrivateKey($uid);
-				$privateKey = $this->crypt->decryptPrivateKey($privateKey, $this->getMasterKeyPassword(), $uid);
-			} else {
-				// when logged in, the master key is already decrypted in the session
-				$privateKey = $this->session->getPrivateKey();
-			}
-		} elseif ($publicAccess) {
-			// use public share key for public links
-			$uid = $this->getPublicShareKeyId();
-			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->privateKeyId, Encryption::ID);
-			$privateKey = $this->crypt->decryptPrivateKey($privateKey);
-		} else {
-			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->session->getPrivateKey();
-		}
-
-		if ($encryptedFileKey && $shareKey && $privateKey) {
-			return $this->crypt->multiKeyDecrypt($encryptedFileKey,
-				$shareKey,
-				$privateKey);
-		}
-
-		return '';
-	}
-
-	/**
-	 * Get the current version of a file
-	 *
-	 * @param string $path
-	 * @param View $view
-	 * @return int
-	 */
-	public function getVersion($path, View $view) {
-		$fileInfo = $view->getFileInfo($path);
-		if ($fileInfo === false) {
-			return 0;
-		}
-		return $fileInfo->getEncryptedVersion();
-	}
-
-	/**
-	 * Set the current version of a file
-	 *
-	 * @param string $path
-	 * @param int $version
-	 * @param View $view
-	 */
-	public function setVersion($path, $version, View $view) {
-		$fileInfo= $view->getFileInfo($path);
-
-		if ($fileInfo !== false) {
-			$cache = $fileInfo->getStorage()->getCache();
-			$cache->update($fileInfo->getId(), ['encrypted' => $version, 'encryptedVersion' => $version]);
-		}
-	}
-
-	/**
-	 * get the encrypted file key
-	 *
-	 * @param string $path
-	 * @return string
-	 */
-	public function getEncryptedFileKey($path) {
-		$encryptedFileKey = $this->keyStorage->getFileKey($path,
-			$this->fileKeyId, Encryption::ID);
-
-		return $encryptedFileKey;
-	}
-
-	/**
-	 * delete share key
-	 *
-	 * @param string $path
-	 * @param string $keyId
-	 * @return boolean
-	 */
-	public function deleteShareKey($path, $keyId) {
-		return $this->keyStorage->deleteFileKey(
-			$path,
-			$keyId . '.' . $this->shareKeyId,
-			Encryption::ID);
-	}
-
-
-	/**
-	 * @param $path
-	 * @param $uid
-	 * @return mixed
-	 */
-	public function getShareKey($path, $uid) {
-		$keyId = $uid . '.' . $this->shareKeyId;
-		return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
-	}
-
-	/**
-	 * check if user has a private and a public key
-	 *
-	 * @param string $userId
-	 * @return bool
-	 * @throws PrivateKeyMissingException
-	 * @throws PublicKeyMissingException
-	 */
-	public function userHasKeys($userId) {
-		$privateKey = $publicKey = true;
-		$exception = null;
-
-		try {
-			$this->getPrivateKey($userId);
-		} catch (PrivateKeyMissingException $e) {
-			$privateKey = false;
-			$exception = $e;
-		}
-		try {
-			$this->getPublicKey($userId);
-		} catch (PublicKeyMissingException $e) {
-			$publicKey = false;
-			$exception = $e;
-		}
-
-		if ($privateKey && $publicKey) {
-			return true;
-		} elseif (!$privateKey && !$publicKey) {
-			return false;
-		} else {
-			throw $exception;
-		}
-	}
-
-	/**
-	 * @param $userId
-	 * @return mixed
-	 * @throws PublicKeyMissingException
-	 */
-	public function getPublicKey($userId) {
-		$publicKey = $this->keyStorage->getUserKey($userId, $this->publicKeyId, Encryption::ID);
-
-		if (strlen($publicKey) !== 0) {
-			return $publicKey;
-		}
-		throw new PublicKeyMissingException($userId);
-	}
-
-	public function getPublicShareKeyId() {
-		return $this->publicShareKeyId;
-	}
-
-	/**
-	 * get public key for public link shares
-	 *
-	 * @return string
-	 */
-	public function getPublicShareKey() {
-		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->publicKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $purpose
-	 * @param string $uid
-	 */
-	public function backupUserKeys($purpose, $uid) {
-		$this->keyStorage->backupUserKeys(Encryption::ID, $purpose, $uid);
-	}
-
-	/**
-	 * creat a backup of the users private and public key and then  delete it
-	 *
-	 * @param string $uid
-	 */
-	public function deleteUserKeys($uid) {
-		$this->deletePublicKey($uid);
-		$this->deletePrivateKey($uid);
-	}
-
-	/**
-	 * @param $uid
-	 * @return bool
-	 */
-	public function deletePublicKey($uid) {
-		return $this->keyStorage->deleteUserKey($uid, $this->publicKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $uid
-	 * @return bool
-	 */
-	private function deletePrivateKey($uid) {
-		return $this->keyStorage->deleteUserKey($uid, $this->privateKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $path
-	 * @return bool
-	 */
-	public function deleteAllFileKeys($path) {
-		return $this->keyStorage->deleteAllFileKeys($path);
-	}
-
-	/**
-	 * @param array $userIds
-	 * @return array
-	 * @throws PublicKeyMissingException
-	 */
-	public function getPublicKeys(array $userIds) {
-		$keys = [];
-
-		foreach ($userIds as $userId) {
-			try {
-				$keys[$userId] = $this->getPublicKey($userId);
-			} catch (PublicKeyMissingException $e) {
-				continue;
-			}
-		}
-
-		return $keys;
-	}
-
-	/**
-	 * @param string $keyId
-	 * @return string returns openssl key
-	 */
-	public function getSystemPrivateKey($keyId) {
-		return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $keyId
-	 * @param string $key
-	 * @return string returns openssl key
-	 */
-	public function setSystemPrivateKey($keyId, $key) {
-		return $this->keyStorage->setSystemUserKey(
-			$keyId . '.' . $this->privateKeyId,
-			$key,
-			Encryption::ID);
-	}
-
-	/**
-	 * add system keys such as the public share key and the recovery key
-	 *
-	 * @param array $accessList
-	 * @param array $publicKeys
-	 * @param string $uid
-	 * @return array
-	 * @throws PublicKeyMissingException
-	 */
-	public function addSystemKeys(array $accessList, array $publicKeys, $uid) {
-		if (!empty($accessList['public'])) {
-			$publicShareKey = $this->getPublicShareKey();
-			if (empty($publicShareKey)) {
-				throw new PublicKeyMissingException($this->getPublicShareKeyId());
-			}
-			$publicKeys[$this->getPublicShareKeyId()] = $publicShareKey;
-		}
-
-		if ($this->recoveryKeyExists() &&
-			$this->util->isRecoveryEnabledForUser($uid)) {
-			$publicKeys[$this->getRecoveryKeyId()] = $this->getRecoveryKey();
-		}
-
-		return $publicKeys;
-	}
-
-	/**
-	 * get master key password
-	 *
-	 * @return string
-	 * @throws \Exception
-	 */
-	public function getMasterKeyPassword() {
-		$password = $this->config->getSystemValue('secret');
-		if (empty($password)) {
-			throw new \Exception('Can not get secret from Nextcloud instance');
-		}
-
-		return $password;
-	}
-
-	/**
-	 * return master key id
-	 *
-	 * @return string
-	 */
-	public function getMasterKeyId() {
-		return $this->masterKeyId;
-	}
-
-	/**
-	 * get public master key
-	 *
-	 * @return string
-	 */
-	public function getPublicMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->publicKeyId, Encryption::ID);
-	}
-
-	/**
-	 * get public master key
-	 *
-	 * @return string
-	 */
-	public function getPrivateMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->privateKeyId, Encryption::ID);
-	}
+    /**
+     * @var Session
+     */
+    protected $session;
+    /**
+     * @var IStorage
+     */
+    private $keyStorage;
+    /**
+     * @var Crypt
+     */
+    private $crypt;
+    /**
+     * @var string
+     */
+    private $recoveryKeyId;
+    /**
+     * @var string
+     */
+    private $publicShareKeyId;
+    /**
+     * @var string
+     */
+    private $masterKeyId;
+    /**
+     * @var string UserID
+     */
+    private $keyId;
+    /**
+     * @var string
+     */
+    private $publicKeyId = 'publicKey';
+    /**
+     * @var string
+     */
+    private $privateKeyId = 'privateKey';
+
+    /**
+     * @var string
+     */
+    private $shareKeyId = 'shareKey';
+
+    /**
+     * @var string
+     */
+    private $fileKeyId = 'fileKey';
+    /**
+     * @var IConfig
+     */
+    private $config;
+    /**
+     * @var ILogger
+     */
+    private $log;
+    /**
+     * @var Util
+     */
+    private $util;
+
+    /**
+     * @var ILockingProvider
+     */
+    private $lockingProvider;
+
+    /**
+     * @param IStorage $keyStorage
+     * @param Crypt $crypt
+     * @param IConfig $config
+     * @param IUserSession $userSession
+     * @param Session $session
+     * @param ILogger $log
+     * @param Util $util
+     */
+    public function __construct(
+        IStorage $keyStorage,
+        Crypt $crypt,
+        IConfig $config,
+        IUserSession $userSession,
+        Session $session,
+        ILogger $log,
+        Util $util,
+        ILockingProvider $lockingProvider
+    ) {
+        $this->util = $util;
+        $this->session = $session;
+        $this->keyStorage = $keyStorage;
+        $this->crypt = $crypt;
+        $this->config = $config;
+        $this->log = $log;
+        $this->lockingProvider = $lockingProvider;
+
+        $this->recoveryKeyId = $this->config->getAppValue('encryption',
+            'recoveryKeyId');
+        if (empty($this->recoveryKeyId)) {
+            $this->recoveryKeyId = 'recoveryKey_' . substr(md5(time()), 0, 8);
+            $this->config->setAppValue('encryption',
+                'recoveryKeyId',
+                $this->recoveryKeyId);
+        }
+
+        $this->publicShareKeyId = $this->config->getAppValue('encryption',
+            'publicShareKeyId');
+        if (empty($this->publicShareKeyId)) {
+            $this->publicShareKeyId = 'pubShare_' . substr(md5(time()), 0, 8);
+            $this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
+        }
+
+        $this->masterKeyId = $this->config->getAppValue('encryption',
+            'masterKeyId');
+        if (empty($this->masterKeyId)) {
+            $this->masterKeyId = 'master_' . substr(md5(time()), 0, 8);
+            $this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
+        }
+
+        $this->keyId = $userSession && $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : false;
+        $this->log = $log;
+    }
+
+    /**
+     * check if key pair for public link shares exists, if not we create one
+     */
+    public function validateShareKey() {
+        $shareKey = $this->getPublicShareKey();
+        if (empty($shareKey)) {
+            $this->lockingProvider->acquireLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE, 'Encryption: shared key generation');
+            try {
+                $keyPair = $this->crypt->createKeyPair();
+
+                // Save public key
+                $this->keyStorage->setSystemUserKey(
+                    $this->publicShareKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
+                    Encryption::ID);
+
+                // Encrypt private key empty passphrase
+                $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
+                $header = $this->crypt->generateHeader();
+                $this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
+            } catch (\Throwable $e) {
+                $this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
+                throw $e;
+            }
+            $this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
+        }
+    }
+
+    /**
+     * check if a key pair for the master key exists, if not we create one
+     */
+    public function validateMasterKey() {
+        if ($this->util->isMasterKeyEnabled() === false) {
+            return;
+        }
+
+        $publicMasterKey = $this->getPublicMasterKey();
+        $privateMasterKey = $this->getPrivateMasterKey();
+
+        if (empty($publicMasterKey) && empty($privateMasterKey)) {
+            // There could be a race condition here if two requests would trigger
+            // the generation the second one would enter the key generation as long
+            // as the first one didn't write the key to the keystorage yet
+            $this->lockingProvider->acquireLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE, 'Encryption: master key generation');
+            try {
+                $keyPair = $this->crypt->createKeyPair();
+
+                // Save public key
+                $this->keyStorage->setSystemUserKey(
+                    $this->masterKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
+                    Encryption::ID);
+
+                // Encrypt private key with system password
+                $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
+                $header = $this->crypt->generateHeader();
+                $this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
+            } catch (\Throwable $e) {
+                $this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
+                throw $e;
+            }
+            $this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
+        } elseif (empty($publicMasterKey)) {
+            $this->log->error('A private master key is available but the public key could not be found. This should never happen.');
+            return;
+        } elseif (empty($privateMasterKey)) {
+            $this->log->error('A public master key is available but the private key could not be found. This should never happen.');
+            return;
+        }
+
+        if (!$this->session->isPrivateKeySet()) {
+            $masterKey = $this->getSystemPrivateKey($this->masterKeyId);
+            $decryptedMasterKey = $this->crypt->decryptPrivateKey($masterKey, $this->getMasterKeyPassword(), $this->masterKeyId);
+            $this->session->setPrivateKey($decryptedMasterKey);
+        }
+
+        // after the encryption key is available we are ready to go
+        $this->session->setStatus(Session::INIT_SUCCESSFUL);
+    }
+
+    /**
+     * @return bool
+     */
+    public function recoveryKeyExists() {
+        $key = $this->getRecoveryKey();
+        return !empty($key);
+    }
+
+    /**
+     * get recovery key
+     *
+     * @return string
+     */
+    public function getRecoveryKey() {
+        return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->publicKeyId, Encryption::ID);
+    }
+
+    /**
+     * get recovery key ID
+     *
+     * @return string
+     */
+    public function getRecoveryKeyId() {
+        return $this->recoveryKeyId;
+    }
+
+    /**
+     * @param string $password
+     * @return bool
+     */
+    public function checkRecoveryPassword($password) {
+        $recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->privateKeyId, Encryption::ID);
+        $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
+
+        if ($decryptedRecoveryKey) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param string $uid
+     * @param string $password
+     * @param array $keyPair
+     * @return bool
+     */
+    public function storeKeyPair($uid, $password, $keyPair) {
+        // Save Public Key
+        $this->setPublicKey($uid, $keyPair['publicKey']);
+
+        $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password, $uid);
+
+        $header = $this->crypt->generateHeader();
+
+        if ($encryptedKey) {
+            $this->setPrivateKey($uid, $header . $encryptedKey);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param string $password
+     * @param array $keyPair
+     * @return bool
+     */
+    public function setRecoveryKey($password, $keyPair) {
+        // Save Public Key
+        $this->keyStorage->setSystemUserKey($this->getRecoveryKeyId().
+            '.' . $this->publicKeyId,
+            $keyPair['publicKey'],
+            Encryption::ID);
+
+        $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password);
+        $header = $this->crypt->generateHeader();
+
+        if ($encryptedKey) {
+            $this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param $userId
+     * @param $key
+     * @return bool
+     */
+    public function setPublicKey($userId, $key) {
+        return $this->keyStorage->setUserKey($userId, $this->publicKeyId, $key, Encryption::ID);
+    }
+
+    /**
+     * @param $userId
+     * @param string $key
+     * @return bool
+     */
+    public function setPrivateKey($userId, $key) {
+        return $this->keyStorage->setUserKey($userId,
+            $this->privateKeyId,
+            $key,
+            Encryption::ID);
+    }
+
+    /**
+     * write file key to key storage
+     *
+     * @param string $path
+     * @param string $key
+     * @return boolean
+     */
+    public function setFileKey($path, $key) {
+        return $this->keyStorage->setFileKey($path, $this->fileKeyId, $key, Encryption::ID);
+    }
+
+    /**
+     * set all file keys (the file key and the corresponding share keys)
+     *
+     * @param string $path
+     * @param array $keys
+     */
+    public function setAllFileKeys($path, $keys) {
+        $this->setFileKey($path, $keys['data']);
+        foreach ($keys['keys'] as $uid => $keyFile) {
+            $this->setShareKey($path, $uid, $keyFile);
+        }
+    }
+
+    /**
+     * write share key to the key storage
+     *
+     * @param string $path
+     * @param string $uid
+     * @param string $key
+     * @return boolean
+     */
+    public function setShareKey($path, $uid, $key) {
+        $keyId = $uid . '.' . $this->shareKeyId;
+        return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
+    }
+
+    /**
+     * Decrypt private key and store it
+     *
+     * @param string $uid user id
+     * @param string $passPhrase users password
+     * @return boolean
+     */
+    public function init($uid, $passPhrase) {
+        $this->session->setStatus(Session::INIT_EXECUTED);
+
+        try {
+            if ($this->util->isMasterKeyEnabled()) {
+                $uid = $this->getMasterKeyId();
+                $passPhrase = $this->getMasterKeyPassword();
+                $privateKey = $this->getSystemPrivateKey($uid);
+            } else {
+                $privateKey = $this->getPrivateKey($uid);
+            }
+            $privateKey = $this->crypt->decryptPrivateKey($privateKey, $passPhrase, $uid);
+        } catch (PrivateKeyMissingException $e) {
+            return false;
+        } catch (DecryptionFailedException $e) {
+            return false;
+        } catch (\Exception $e) {
+            $this->log->logException($e, [
+                'message' => 'Could not decrypt the private key from user "' . $uid . '"" during login. Assume password change on the user back-end.',
+                'level' => ILogger::WARN,
+                'app' => 'encryption',
+            ]);
+            return false;
+        }
+
+        if ($privateKey) {
+            $this->session->setPrivateKey($privateKey);
+            $this->session->setStatus(Session::INIT_SUCCESSFUL);
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * @param $userId
+     * @return string
+     * @throws PrivateKeyMissingException
+     */
+    public function getPrivateKey($userId) {
+        $privateKey = $this->keyStorage->getUserKey($userId,
+            $this->privateKeyId, Encryption::ID);
+
+        if (strlen($privateKey) !== 0) {
+            return $privateKey;
+        }
+        throw new PrivateKeyMissingException($userId);
+    }
+
+    /**
+     * @param string $path
+     * @param $uid
+     * @return string
+     */
+    public function getFileKey($path, $uid) {
+        if ($uid === '') {
+            $uid = null;
+        }
+        $publicAccess = is_null($uid);
+        $encryptedFileKey = $this->keyStorage->getFileKey($path, $this->fileKeyId, Encryption::ID);
+
+        if (empty($encryptedFileKey)) {
+            return '';
+        }
+
+        if ($this->util->isMasterKeyEnabled()) {
+            $uid = $this->getMasterKeyId();
+            $shareKey = $this->getShareKey($path, $uid);
+            if ($publicAccess) {
+                $privateKey = $this->getSystemPrivateKey($uid);
+                $privateKey = $this->crypt->decryptPrivateKey($privateKey, $this->getMasterKeyPassword(), $uid);
+            } else {
+                // when logged in, the master key is already decrypted in the session
+                $privateKey = $this->session->getPrivateKey();
+            }
+        } elseif ($publicAccess) {
+            // use public share key for public links
+            $uid = $this->getPublicShareKeyId();
+            $shareKey = $this->getShareKey($path, $uid);
+            $privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->privateKeyId, Encryption::ID);
+            $privateKey = $this->crypt->decryptPrivateKey($privateKey);
+        } else {
+            $shareKey = $this->getShareKey($path, $uid);
+            $privateKey = $this->session->getPrivateKey();
+        }
+
+        if ($encryptedFileKey && $shareKey && $privateKey) {
+            return $this->crypt->multiKeyDecrypt($encryptedFileKey,
+                $shareKey,
+                $privateKey);
+        }
+
+        return '';
+    }
+
+    /**
+     * Get the current version of a file
+     *
+     * @param string $path
+     * @param View $view
+     * @return int
+     */
+    public function getVersion($path, View $view) {
+        $fileInfo = $view->getFileInfo($path);
+        if ($fileInfo === false) {
+            return 0;
+        }
+        return $fileInfo->getEncryptedVersion();
+    }
+
+    /**
+     * Set the current version of a file
+     *
+     * @param string $path
+     * @param int $version
+     * @param View $view
+     */
+    public function setVersion($path, $version, View $view) {
+        $fileInfo= $view->getFileInfo($path);
+
+        if ($fileInfo !== false) {
+            $cache = $fileInfo->getStorage()->getCache();
+            $cache->update($fileInfo->getId(), ['encrypted' => $version, 'encryptedVersion' => $version]);
+        }
+    }
+
+    /**
+     * get the encrypted file key
+     *
+     * @param string $path
+     * @return string
+     */
+    public function getEncryptedFileKey($path) {
+        $encryptedFileKey = $this->keyStorage->getFileKey($path,
+            $this->fileKeyId, Encryption::ID);
+
+        return $encryptedFileKey;
+    }
+
+    /**
+     * delete share key
+     *
+     * @param string $path
+     * @param string $keyId
+     * @return boolean
+     */
+    public function deleteShareKey($path, $keyId) {
+        return $this->keyStorage->deleteFileKey(
+            $path,
+            $keyId . '.' . $this->shareKeyId,
+            Encryption::ID);
+    }
+
+
+    /**
+     * @param $path
+     * @param $uid
+     * @return mixed
+     */
+    public function getShareKey($path, $uid) {
+        $keyId = $uid . '.' . $this->shareKeyId;
+        return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
+    }
+
+    /**
+     * check if user has a private and a public key
+     *
+     * @param string $userId
+     * @return bool
+     * @throws PrivateKeyMissingException
+     * @throws PublicKeyMissingException
+     */
+    public function userHasKeys($userId) {
+        $privateKey = $publicKey = true;
+        $exception = null;
+
+        try {
+            $this->getPrivateKey($userId);
+        } catch (PrivateKeyMissingException $e) {
+            $privateKey = false;
+            $exception = $e;
+        }
+        try {
+            $this->getPublicKey($userId);
+        } catch (PublicKeyMissingException $e) {
+            $publicKey = false;
+            $exception = $e;
+        }
+
+        if ($privateKey && $publicKey) {
+            return true;
+        } elseif (!$privateKey && !$publicKey) {
+            return false;
+        } else {
+            throw $exception;
+        }
+    }
+
+    /**
+     * @param $userId
+     * @return mixed
+     * @throws PublicKeyMissingException
+     */
+    public function getPublicKey($userId) {
+        $publicKey = $this->keyStorage->getUserKey($userId, $this->publicKeyId, Encryption::ID);
+
+        if (strlen($publicKey) !== 0) {
+            return $publicKey;
+        }
+        throw new PublicKeyMissingException($userId);
+    }
+
+    public function getPublicShareKeyId() {
+        return $this->publicShareKeyId;
+    }
+
+    /**
+     * get public key for public link shares
+     *
+     * @return string
+     */
+    public function getPublicShareKey() {
+        return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->publicKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $purpose
+     * @param string $uid
+     */
+    public function backupUserKeys($purpose, $uid) {
+        $this->keyStorage->backupUserKeys(Encryption::ID, $purpose, $uid);
+    }
+
+    /**
+     * creat a backup of the users private and public key and then  delete it
+     *
+     * @param string $uid
+     */
+    public function deleteUserKeys($uid) {
+        $this->deletePublicKey($uid);
+        $this->deletePrivateKey($uid);
+    }
+
+    /**
+     * @param $uid
+     * @return bool
+     */
+    public function deletePublicKey($uid) {
+        return $this->keyStorage->deleteUserKey($uid, $this->publicKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $uid
+     * @return bool
+     */
+    private function deletePrivateKey($uid) {
+        return $this->keyStorage->deleteUserKey($uid, $this->privateKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $path
+     * @return bool
+     */
+    public function deleteAllFileKeys($path) {
+        return $this->keyStorage->deleteAllFileKeys($path);
+    }
+
+    /**
+     * @param array $userIds
+     * @return array
+     * @throws PublicKeyMissingException
+     */
+    public function getPublicKeys(array $userIds) {
+        $keys = [];
+
+        foreach ($userIds as $userId) {
+            try {
+                $keys[$userId] = $this->getPublicKey($userId);
+            } catch (PublicKeyMissingException $e) {
+                continue;
+            }
+        }
+
+        return $keys;
+    }
+
+    /**
+     * @param string $keyId
+     * @return string returns openssl key
+     */
+    public function getSystemPrivateKey($keyId) {
+        return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $keyId
+     * @param string $key
+     * @return string returns openssl key
+     */
+    public function setSystemPrivateKey($keyId, $key) {
+        return $this->keyStorage->setSystemUserKey(
+            $keyId . '.' . $this->privateKeyId,
+            $key,
+            Encryption::ID);
+    }
+
+    /**
+     * add system keys such as the public share key and the recovery key
+     *
+     * @param array $accessList
+     * @param array $publicKeys
+     * @param string $uid
+     * @return array
+     * @throws PublicKeyMissingException
+     */
+    public function addSystemKeys(array $accessList, array $publicKeys, $uid) {
+        if (!empty($accessList['public'])) {
+            $publicShareKey = $this->getPublicShareKey();
+            if (empty($publicShareKey)) {
+                throw new PublicKeyMissingException($this->getPublicShareKeyId());
+            }
+            $publicKeys[$this->getPublicShareKeyId()] = $publicShareKey;
+        }
+
+        if ($this->recoveryKeyExists() &&
+            $this->util->isRecoveryEnabledForUser($uid)) {
+            $publicKeys[$this->getRecoveryKeyId()] = $this->getRecoveryKey();
+        }
+
+        return $publicKeys;
+    }
+
+    /**
+     * get master key password
+     *
+     * @return string
+     * @throws \Exception
+     */
+    public function getMasterKeyPassword() {
+        $password = $this->config->getSystemValue('secret');
+        if (empty($password)) {
+            throw new \Exception('Can not get secret from Nextcloud instance');
+        }
+
+        return $password;
+    }
+
+    /**
+     * return master key id
+     *
+     * @return string
+     */
+    public function getMasterKeyId() {
+        return $this->masterKeyId;
+    }
+
+    /**
+     * get public master key
+     *
+     * @return string
+     */
+    public function getPublicMasterKey() {
+        return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->publicKeyId, Encryption::ID);
+    }
+
+    /**
+     * get public master key
+     *
+     * @return string
+     */
+    public function getPrivateMasterKey() {
+        return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->privateKeyId, Encryption::ID);
+    }
 }

Spacing +23 added lines, -23 removed lines

@@ -139,7 +139,7 @@ 
 		$this->recoveryKeyId = $this->config->getAppValue('encryption',
 			'recoveryKeyId');
 		if (empty($this->recoveryKeyId)) {
-			$this->recoveryKeyId = 'recoveryKey_' . substr(md5(time()), 0, 8);
+			$this->recoveryKeyId = 'recoveryKey_'.substr(md5(time()), 0, 8);
 			$this->config->setAppValue('encryption',
 				'recoveryKeyId',
 				$this->recoveryKeyId);
@@ -148,14 +148,14 @@ 
 		$this->publicShareKeyId = $this->config->getAppValue('encryption',
 			'publicShareKeyId');
 		if (empty($this->publicShareKeyId)) {
-			$this->publicShareKeyId = 'pubShare_' . substr(md5(time()), 0, 8);
+			$this->publicShareKeyId = 'pubShare_'.substr(md5(time()), 0, 8);
 			$this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
 		}
 
 		$this->masterKeyId = $this->config->getAppValue('encryption',
 			'masterKeyId');
 		if (empty($this->masterKeyId)) {
-			$this->masterKeyId = 'master_' . substr(md5(time()), 0, 8);
+			$this->masterKeyId = 'master_'.substr(md5(time()), 0, 8);
 			$this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
 		}
 
@@ -175,13 +175,13 @@ 
 
 				// Save public key
 				$this->keyStorage->setSystemUserKey(
-					$this->publicShareKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
+					$this->publicShareKeyId.'.'.$this->publicKeyId, $keyPair['publicKey'],
 					Encryption::ID);
 
 				// Encrypt private key empty passphrase
 				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
 				$header = $this->crypt->generateHeader();
-				$this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
+				$this->setSystemPrivateKey($this->publicShareKeyId, $header.$encryptedKey);
 			} catch (\Throwable $e) {
 				$this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
 				throw $e;
@@ -211,13 +211,13 @@ 
 
 				// Save public key
 				$this->keyStorage->setSystemUserKey(
-					$this->masterKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
+					$this->masterKeyId.'.'.$this->publicKeyId, $keyPair['publicKey'],
 					Encryption::ID);
 
 				// Encrypt private key with system password
 				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
 				$header = $this->crypt->generateHeader();
-				$this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
+				$this->setSystemPrivateKey($this->masterKeyId, $header.$encryptedKey);
 			} catch (\Throwable $e) {
 				$this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
 				throw $e;
@@ -255,7 +255,7 @@ 
 	 * @return string
 	 */
 	public function getRecoveryKey() {
-		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->publicKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId.'.'.$this->publicKeyId, Encryption::ID);
 	}
 
 	/**
@@ -272,7 +272,7 @@ 
 	 * @return bool
 	 */
 	public function checkRecoveryPassword($password) {
-		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->privateKeyId, Encryption::ID);
+		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId.'.'.$this->privateKeyId, Encryption::ID);
 		$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
 
 		if ($decryptedRecoveryKey) {
@@ -296,7 +296,7 @@ 
 		$header = $this->crypt->generateHeader();
 
 		if ($encryptedKey) {
-			$this->setPrivateKey($uid, $header . $encryptedKey);
+			$this->setPrivateKey($uid, $header.$encryptedKey);
 			return true;
 		}
 		return false;
@@ -310,7 +310,7 @@ 
 	public function setRecoveryKey($password, $keyPair) {
 		// Save Public Key
 		$this->keyStorage->setSystemUserKey($this->getRecoveryKeyId().
-			'.' . $this->publicKeyId,
+			'.'.$this->publicKeyId,
 			$keyPair['publicKey'],
 			Encryption::ID);
 
@@ -318,7 +318,7 @@ 
 		$header = $this->crypt->generateHeader();
 
 		if ($encryptedKey) {
-			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
+			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header.$encryptedKey);
 			return true;
 		}
 		return false;
@@ -378,7 +378,7 @@ 
 	 * @return boolean
 	 */
 	public function setShareKey($path, $uid, $key) {
-		$keyId = $uid . '.' . $this->shareKeyId;
+		$keyId = $uid.'.'.$this->shareKeyId;
 		return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
 	}
 
@@ -407,7 +407,7 @@ 
 			return false;
 		} catch (\Exception $e) {
 			$this->log->logException($e, [
-				'message' => 'Could not decrypt the private key from user "' . $uid . '"" during login. Assume password change on the user back-end.',
+				'message' => 'Could not decrypt the private key from user "'.$uid.'"" during login. Assume password change on the user back-end.',
 				'level' => ILogger::WARN,
 				'app' => 'encryption',
 			]);
@@ -468,7 +468,7 @@ 
 			// use public share key for public links
 			$uid = $this->getPublicShareKeyId();
 			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->privateKeyId, Encryption::ID);
+			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId.'.'.$this->privateKeyId, Encryption::ID);
 			$privateKey = $this->crypt->decryptPrivateKey($privateKey);
 		} else {
 			$shareKey = $this->getShareKey($path, $uid);
@@ -507,7 +507,7 @@ 
 	 * @param View $view
 	 */
 	public function setVersion($path, $version, View $view) {
-		$fileInfo= $view->getFileInfo($path);
+		$fileInfo = $view->getFileInfo($path);
 
 		if ($fileInfo !== false) {
 			$cache = $fileInfo->getStorage()->getCache();
@@ -538,7 +538,7 @@ 
 	public function deleteShareKey($path, $keyId) {
 		return $this->keyStorage->deleteFileKey(
 			$path,
-			$keyId . '.' . $this->shareKeyId,
+			$keyId.'.'.$this->shareKeyId,
 			Encryption::ID);
 	}
 
@@ -549,7 +549,7 @@ 
 	 * @return mixed
 	 */
 	public function getShareKey($path, $uid) {
-		$keyId = $uid . '.' . $this->shareKeyId;
+		$keyId = $uid.'.'.$this->shareKeyId;
 		return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
 	}
 
@@ -611,7 +611,7 @@ 
 	 * @return string
 	 */
 	public function getPublicShareKey() {
-		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->publicKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId.'.'.$this->publicKeyId, Encryption::ID);
 	}
 
 	/**
@@ -680,7 +680,7 @@ 
 	 * @return string returns openssl key
 	 */
 	public function getSystemPrivateKey($keyId) {
-		return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($keyId.'.'.$this->privateKeyId, Encryption::ID);
 	}
 
 	/**
@@ -690,7 +690,7 @@ 
 	 */
 	public function setSystemPrivateKey($keyId, $key) {
 		return $this->keyStorage->setSystemUserKey(
-			$keyId . '.' . $this->privateKeyId,
+			$keyId.'.'.$this->privateKeyId,
 			$key,
 			Encryption::ID);
 	}
@@ -751,7 +751,7 @@ 
 	 * @return string
 	 */
 	public function getPublicMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->publicKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->masterKeyId.'.'.$this->publicKeyId, Encryption::ID);
 	}
 
 	/**
@@ -760,6 +760,6 @@ 
 	 * @return string
 	 */
 	public function getPrivateMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->privateKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->masterKeyId.'.'.$this->privateKeyId, Encryption::ID);
 	}
 }

apps/settings/lib/Controller/ChangePasswordController.php

Indentation +212 added lines, -212 removed lines

@@ -47,234 +47,234 @@
 
 class ChangePasswordController extends Controller {
 
-	/** @var string */
-	private $userId;
+    /** @var string */
+    private $userId;
 
-	/** @var IUserManager */
-	private $userManager;
+    /** @var IUserManager */
+    private $userManager;
 
-	/** @var IL10N */
-	private $l;
+    /** @var IL10N */
+    private $l;
 
-	/** @var IGroupManager */
-	private $groupManager;
+    /** @var IGroupManager */
+    private $groupManager;
 
-	/** @var Session */
-	private $userSession;
+    /** @var Session */
+    private $userSession;
 
-	/** @var IAppManager */
-	private $appManager;
+    /** @var IAppManager */
+    private $appManager;
 
-	public function __construct(string $appName,
-								IRequest $request,
-								string $userId,
-								IUserManager $userManager,
-								IUserSession $userSession,
-								IGroupManager $groupManager,
-								IAppManager $appManager,
-								IL10N $l) {
-		parent::__construct($appName, $request);
+    public function __construct(string $appName,
+                                IRequest $request,
+                                string $userId,
+                                IUserManager $userManager,
+                                IUserSession $userSession,
+                                IGroupManager $groupManager,
+                                IAppManager $appManager,
+                                IL10N $l) {
+        parent::__construct($appName, $request);
 
-		$this->userId = $userId;
-		$this->userManager = $userManager;
-		$this->userSession = $userSession;
-		$this->groupManager = $groupManager;
-		$this->appManager = $appManager;
-		$this->l = $l;
-	}
+        $this->userId = $userId;
+        $this->userManager = $userManager;
+        $this->userSession = $userSession;
+        $this->groupManager = $groupManager;
+        $this->appManager = $appManager;
+        $this->l = $l;
+    }
 
-	/**
-	 * @NoAdminRequired
-	 * @NoSubAdminRequired
-	 * @BruteForceProtection(action=changePersonalPassword)
-	 */
-	public function changePersonalPassword(string $oldpassword = '', string $newpassword = null): JSONResponse {
-		$loginName = $this->userSession->getLoginName();
-		/** @var IUser $user */
-		$user = $this->userManager->checkPassword($loginName, $oldpassword);
-		if ($user === false) {
-			$response = new JSONResponse([
-				'status' => 'error',
-				'data' => [
-					'message' => $this->l->t('Wrong password'),
-				],
-			]);
-			$response->throttle();
-			return $response;
-		}
+    /**
+     * @NoAdminRequired
+     * @NoSubAdminRequired
+     * @BruteForceProtection(action=changePersonalPassword)
+     */
+    public function changePersonalPassword(string $oldpassword = '', string $newpassword = null): JSONResponse {
+        $loginName = $this->userSession->getLoginName();
+        /** @var IUser $user */
+        $user = $this->userManager->checkPassword($loginName, $oldpassword);
+        if ($user === false) {
+            $response = new JSONResponse([
+                'status' => 'error',
+                'data' => [
+                    'message' => $this->l->t('Wrong password'),
+                ],
+            ]);
+            $response->throttle();
+            return $response;
+        }
 
-		try {
-			if ($newpassword === null || $user->setPassword($newpassword) === false) {
-				return new JSONResponse([
-					'status' => 'error'
-				]);
-			}
-			// password policy app throws exception
-		} catch (HintException $e) {
-			return new JSONResponse([
-				'status' => 'error',
-				'data' => [
-					'message' => $e->getHint(),
-				],
-			]);
-		}
+        try {
+            if ($newpassword === null || $user->setPassword($newpassword) === false) {
+                return new JSONResponse([
+                    'status' => 'error'
+                ]);
+            }
+            // password policy app throws exception
+        } catch (HintException $e) {
+            return new JSONResponse([
+                'status' => 'error',
+                'data' => [
+                    'message' => $e->getHint(),
+                ],
+            ]);
+        }
 
-		$this->userSession->updateSessionTokenPassword($newpassword);
+        $this->userSession->updateSessionTokenPassword($newpassword);
 
-		return new JSONResponse([
-			'status' => 'success',
-			'data' => [
-				'message' => $this->l->t('Saved'),
-			],
-		]);
-	}
+        return new JSONResponse([
+            'status' => 'success',
+            'data' => [
+                'message' => $this->l->t('Saved'),
+            ],
+        ]);
+    }
 
-	/**
-	 * @NoAdminRequired
-	 * @PasswordConfirmationRequired
-	 */
-	public function changeUserPassword(string $username = null, string $password = null, string $recoveryPassword = null): JSONResponse {
-		if ($username === null) {
-			return new JSONResponse([
-				'status' => 'error',
-				'data' => [
-					'message' => $this->l->t('No user supplied'),
-				],
-			]);
-		}
+    /**
+     * @NoAdminRequired
+     * @PasswordConfirmationRequired
+     */
+    public function changeUserPassword(string $username = null, string $password = null, string $recoveryPassword = null): JSONResponse {
+        if ($username === null) {
+            return new JSONResponse([
+                'status' => 'error',
+                'data' => [
+                    'message' => $this->l->t('No user supplied'),
+                ],
+            ]);
+        }
 
-		if ($password === null) {
-			return new JSONResponse([
-				'status' => 'error',
-				'data' => [
-					'message' => $this->l->t('Unable to change password'),
-				],
-			]);
-		}
+        if ($password === null) {
+            return new JSONResponse([
+                'status' => 'error',
+                'data' => [
+                    'message' => $this->l->t('Unable to change password'),
+                ],
+            ]);
+        }
 
-		$currentUser = $this->userSession->getUser();
-		$targetUser = $this->userManager->get($username);
-		if ($currentUser === null || $targetUser === null ||
-			!($this->groupManager->isAdmin($this->userId) ||
-			 $this->groupManager->getSubAdmin()->isUserAccessible($currentUser, $targetUser))
-		) {
-			return new JSONResponse([
-				'status' => 'error',
-				'data' => [
-					'message' => $this->l->t('Authentication error'),
-				],
-			]);
-		}
+        $currentUser = $this->userSession->getUser();
+        $targetUser = $this->userManager->get($username);
+        if ($currentUser === null || $targetUser === null ||
+            !($this->groupManager->isAdmin($this->userId) ||
+             $this->groupManager->getSubAdmin()->isUserAccessible($currentUser, $targetUser))
+        ) {
+            return new JSONResponse([
+                'status' => 'error',
+                'data' => [
+                    'message' => $this->l->t('Authentication error'),
+                ],
+            ]);
+        }
 
-		if ($this->appManager->isEnabledForUser('encryption')) {
-			//handle the recovery case
-			$crypt = new \OCA\Encryption\Crypto\Crypt(
-				\OC::$server->getLogger(),
-				\OC::$server->getUserSession(),
-				\OC::$server->getConfig(),
-				\OC::$server->getL10N('encryption'));
-			$keyStorage = \OC::$server->getEncryptionKeyStorage();
-			$util = new \OCA\Encryption\Util(
-				new \OC\Files\View(),
-				$crypt,
-				\OC::$server->getLogger(),
-				\OC::$server->getUserSession(),
-				\OC::$server->getConfig(),
-				\OC::$server->getUserManager());
-			$keyManager = new \OCA\Encryption\KeyManager(
-				$keyStorage,
-				$crypt,
-				\OC::$server->getConfig(),
-				\OC::$server->getUserSession(),
-				new \OCA\Encryption\Session(\OC::$server->getSession()),
-				\OC::$server->getLogger(),
-				$util,
-				\OC::$server->getLockingProvider()
-			);
-			$recovery = new \OCA\Encryption\Recovery(
-				\OC::$server->getUserSession(),
-				$crypt,
-				$keyManager,
-				\OC::$server->getConfig(),
-				\OC::$server->getEncryptionFilesHelper(),
-				new \OC\Files\View());
-			$recoveryAdminEnabled = $recovery->isRecoveryKeyEnabled();
+        if ($this->appManager->isEnabledForUser('encryption')) {
+            //handle the recovery case
+            $crypt = new \OCA\Encryption\Crypto\Crypt(
+                \OC::$server->getLogger(),
+                \OC::$server->getUserSession(),
+                \OC::$server->getConfig(),
+                \OC::$server->getL10N('encryption'));
+            $keyStorage = \OC::$server->getEncryptionKeyStorage();
+            $util = new \OCA\Encryption\Util(
+                new \OC\Files\View(),
+                $crypt,
+                \OC::$server->getLogger(),
+                \OC::$server->getUserSession(),
+                \OC::$server->getConfig(),
+                \OC::$server->getUserManager());
+            $keyManager = new \OCA\Encryption\KeyManager(
+                $keyStorage,
+                $crypt,
+                \OC::$server->getConfig(),
+                \OC::$server->getUserSession(),
+                new \OCA\Encryption\Session(\OC::$server->getSession()),
+                \OC::$server->getLogger(),
+                $util,
+                \OC::$server->getLockingProvider()
+            );
+            $recovery = new \OCA\Encryption\Recovery(
+                \OC::$server->getUserSession(),
+                $crypt,
+                $keyManager,
+                \OC::$server->getConfig(),
+                \OC::$server->getEncryptionFilesHelper(),
+                new \OC\Files\View());
+            $recoveryAdminEnabled = $recovery->isRecoveryKeyEnabled();
 
-			$validRecoveryPassword = false;
-			$recoveryEnabledForUser = false;
-			if ($recoveryAdminEnabled) {
-				$validRecoveryPassword = $keyManager->checkRecoveryPassword($recoveryPassword);
-				$recoveryEnabledForUser = $recovery->isRecoveryEnabledForUser($username);
-			}
+            $validRecoveryPassword = false;
+            $recoveryEnabledForUser = false;
+            if ($recoveryAdminEnabled) {
+                $validRecoveryPassword = $keyManager->checkRecoveryPassword($recoveryPassword);
+                $recoveryEnabledForUser = $recovery->isRecoveryEnabledForUser($username);
+            }
 
-			if ($recoveryEnabledForUser && $recoveryPassword === '') {
-				return new JSONResponse([
-					'status' => 'error',
-					'data' => [
-						'message' => $this->l->t('Please provide an admin recovery password; otherwise, all user data will be lost.'),
-					]
-				]);
-			} elseif ($recoveryEnabledForUser && ! $validRecoveryPassword) {
-				return new JSONResponse([
-					'status' => 'error',
-					'data' => [
-						'message' => $this->l->t('Wrong admin recovery password. Please check the password and try again.'),
-					]
-				]);
-			} else { // now we know that everything is fine regarding the recovery password, let's try to change the password
-				try {
-					$result = $targetUser->setPassword($password, $recoveryPassword);
-					// password policy app throws exception
-				} catch (HintException $e) {
-					return new JSONResponse([
-						'status' => 'error',
-						'data' => [
-							'message' => $e->getHint(),
-						],
-					]);
-				}
-				if (!$result && $recoveryEnabledForUser) {
-					return new JSONResponse([
-						'status' => 'error',
-						'data' => [
-							'message' => $this->l->t('Backend doesn\'t support password change, but the user\'s encryption key was updated.'),
-						]
-					]);
-				} elseif (!$result && !$recoveryEnabledForUser) {
-					return new JSONResponse([
-						'status' => 'error',
-						'data' => [
-							'message' => $this->l->t('Unable to change password'),
-						]
-					]);
-				}
-			}
-		} else {
-			try {
-				if ($targetUser->setPassword($password) === false) {
-					return new JSONResponse([
-						'status' => 'error',
-						'data' => [
-							'message' => $this->l->t('Unable to change password'),
-						],
-					]);
-				}
-				// password policy app throws exception
-			} catch (HintException $e) {
-				return new JSONResponse([
-					'status' => 'error',
-					'data' => [
-						'message' => $e->getHint(),
-					],
-				]);
-			}
-		}
+            if ($recoveryEnabledForUser && $recoveryPassword === '') {
+                return new JSONResponse([
+                    'status' => 'error',
+                    'data' => [
+                        'message' => $this->l->t('Please provide an admin recovery password; otherwise, all user data will be lost.'),
+                    ]
+                ]);
+            } elseif ($recoveryEnabledForUser && ! $validRecoveryPassword) {
+                return new JSONResponse([
+                    'status' => 'error',
+                    'data' => [
+                        'message' => $this->l->t('Wrong admin recovery password. Please check the password and try again.'),
+                    ]
+                ]);
+            } else { // now we know that everything is fine regarding the recovery password, let's try to change the password
+                try {
+                    $result = $targetUser->setPassword($password, $recoveryPassword);
+                    // password policy app throws exception
+                } catch (HintException $e) {
+                    return new JSONResponse([
+                        'status' => 'error',
+                        'data' => [
+                            'message' => $e->getHint(),
+                        ],
+                    ]);
+                }
+                if (!$result && $recoveryEnabledForUser) {
+                    return new JSONResponse([
+                        'status' => 'error',
+                        'data' => [
+                            'message' => $this->l->t('Backend doesn\'t support password change, but the user\'s encryption key was updated.'),
+                        ]
+                    ]);
+                } elseif (!$result && !$recoveryEnabledForUser) {
+                    return new JSONResponse([
+                        'status' => 'error',
+                        'data' => [
+                            'message' => $this->l->t('Unable to change password'),
+                        ]
+                    ]);
+                }
+            }
+        } else {
+            try {
+                if ($targetUser->setPassword($password) === false) {
+                    return new JSONResponse([
+                        'status' => 'error',
+                        'data' => [
+                            'message' => $this->l->t('Unable to change password'),
+                        ],
+                    ]);
+                }
+                // password policy app throws exception
+            } catch (HintException $e) {
+                return new JSONResponse([
+                    'status' => 'error',
+                    'data' => [
+                        'message' => $e->getHint(),
+                    ],
+                ]);
+            }
+        }
 
-		return new JSONResponse([
-			'status' => 'success',
-			'data' => [
-				'username' => $username,
-			],
-		]);
-	}
+        return new JSONResponse([
+            'status' => 'success',
+            'data' => [
+                'username' => $username,
+            ],
+        ]);
+    }
 }