nextcloud / server

apps/encryption/lib/AppInfo/Application.php

Indentation +227 added lines, -227 removed lines

@@ -48,231 +48,231 @@
 
 class Application extends \OCP\AppFramework\App {
 
-	/** @var IManager */
-	private $encryptionManager;
-	/** @var IConfig */
-	private $config;
-
-	/**
-	 * @param array $urlParams
-	 * @param bool $encryptionSystemReady
-	 */
-	public function __construct($urlParams = array(), $encryptionSystemReady = true) {
-		parent::__construct('encryption', $urlParams);
-		$this->encryptionManager = \OC::$server->getEncryptionManager();
-		$this->config = \OC::$server->getConfig();
-		$this->registerServices();
-		if($encryptionSystemReady === false) {
-			/** @var Session $session */
-			$session = $this->getContainer()->query('Session');
-			$session->setStatus(Session::RUN_MIGRATION);
-		}
-
-	}
-
-	public function setUp() {
-		if ($this->encryptionManager->isEnabled()) {
-			/** @var Setup $setup */
-			$setup = $this->getContainer()->query('UserSetup');
-			$setup->setupSystem();
-		}
-	}
-
-	/**
-	 * register hooks
-	 */
-	public function registerHooks() {
-		if (!$this->config->getSystemValue('maintenance', false)) {
-
-			$container = $this->getContainer();
-			$server = $container->getServer();
-			// Register our hooks and fire them.
-			$hookManager = new HookManager();
-
-			$hookManager->registerHook([
-				new UserHooks($container->query('KeyManager'),
-					$server->getUserManager(),
-					$server->getLogger(),
-					$container->query('UserSetup'),
-					$server->getUserSession(),
-					$container->query('Util'),
-					$container->query('Session'),
-					$container->query('Crypt'),
-					$container->query('Recovery'))
-			]);
-
-			$hookManager->fireHooks();
-
-		} else {
-			// Logout user if we are in maintenance to force re-login
-			$this->getContainer()->getServer()->getUserSession()->logout();
-		}
-	}
-
-	public function registerEncryptionModule() {
-		$container = $this->getContainer();
-
-
-		$this->encryptionManager->registerEncryptionModule(
-			Encryption::ID,
-			Encryption::DISPLAY_NAME,
-			function() use ($container) {
-
-			return new Encryption(
-				$container->query('Crypt'),
-				$container->query('KeyManager'),
-				$container->query('Util'),
-				$container->query('Session'),
-				$container->query('EncryptAll'),
-				$container->query('DecryptAll'),
-				$container->getServer()->getLogger(),
-				$container->getServer()->getL10N($container->getAppName())
-			);
-		});
-
-	}
-
-	public function registerServices() {
-		$container = $this->getContainer();
-
-		$container->registerService('Crypt',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-				return new Crypt($server->getLogger(),
-					$server->getUserSession(),
-					$server->getConfig(),
-					$server->getL10N($c->getAppName()));
-			});
-
-		$container->registerService('Session',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-				return new Session($server->getSession());
-			}
-		);
-
-		$container->registerService('KeyManager',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-
-				return new KeyManager($server->getEncryptionKeyStorage(),
-					$c->query('Crypt'),
-					$server->getConfig(),
-					$server->getUserSession(),
-					new Session($server->getSession()),
-					$server->getLogger(),
-					$c->query('Util')
-				);
-			});
-
-		$container->registerService('Recovery',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-
-				return new Recovery(
-					$server->getUserSession(),
-					$c->query('Crypt'),
-					$server->getSecureRandom(),
-					$c->query('KeyManager'),
-					$server->getConfig(),
-					$server->getEncryptionKeyStorage(),
-					$server->getEncryptionFilesHelper(),
-					new View());
-			});
-
-		$container->registerService('RecoveryController', function (IAppContainer $c) {
-			$server = $c->getServer();
-			return new RecoveryController(
-				$c->getAppName(),
-				$server->getRequest(),
-				$server->getConfig(),
-				$server->getL10N($c->getAppName()),
-				$c->query('Recovery'));
-		});
-
-		$container->registerService('StatusController', function (IAppContainer $c) {
-			$server = $c->getServer();
-			return new StatusController(
-				$c->getAppName(),
-				$server->getRequest(),
-				$server->getL10N($c->getAppName()),
-				$c->query('Session'),
-				$server->getEncryptionManager()
-			);
-		});
-
-		$container->registerService('SettingsController', function (IAppContainer $c) {
-			$server = $c->getServer();
-			return new SettingsController(
-				$c->getAppName(),
-				$server->getRequest(),
-				$server->getL10N($c->getAppName()),
-				$server->getUserManager(),
-				$server->getUserSession(),
-				$c->query('KeyManager'),
-				$c->query('Crypt'),
-				$c->query('Session'),
-				$server->getSession(),
-				$c->query('Util')
-			);
-		});
-
-		$container->registerService('UserSetup',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-				return new Setup($server->getLogger(),
-					$server->getUserSession(),
-					$c->query('Crypt'),
-					$c->query('KeyManager'));
-			});
-
-		$container->registerService('Util',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-
-				return new Util(
-					new View(),
-					$c->query('Crypt'),
-					$server->getLogger(),
-					$server->getUserSession(),
-					$server->getConfig(),
-					$server->getUserManager());
-			});
-
-		$container->registerService('EncryptAll',
-			function (IAppContainer $c) {
-				$server = $c->getServer();
-				return new EncryptAll(
-					$c->query('UserSetup'),
-					$c->getServer()->getUserManager(),
-					new View(),
-					$c->query('KeyManager'),
-					$c->query('Util'),
-					$server->getConfig(),
-					$server->getMailer(),
-					$server->getL10N('encryption'),
-					new QuestionHelper(),
-					$server->getSecureRandom()
-				);
-			}
-		);
-
-		$container->registerService('DecryptAll',
-			function (IAppContainer $c) {
-				return new DecryptAll(
-					$c->query('Util'),
-					$c->query('KeyManager'),
-					$c->query('Crypt'),
-					$c->query('Session'),
-					new QuestionHelper()
-				);
-			}
-		);
-
-	}
-
-	public function registerSettings() {
-		// Register settings scripts
-		App::registerPersonal('encryption', 'settings/settings-personal');
-	}
+    /** @var IManager */
+    private $encryptionManager;
+    /** @var IConfig */
+    private $config;
+
+    /**
+     * @param array $urlParams
+     * @param bool $encryptionSystemReady
+     */
+    public function __construct($urlParams = array(), $encryptionSystemReady = true) {
+        parent::__construct('encryption', $urlParams);
+        $this->encryptionManager = \OC::$server->getEncryptionManager();
+        $this->config = \OC::$server->getConfig();
+        $this->registerServices();
+        if($encryptionSystemReady === false) {
+            /** @var Session $session */
+            $session = $this->getContainer()->query('Session');
+            $session->setStatus(Session::RUN_MIGRATION);
+        }
+
+    }
+
+    public function setUp() {
+        if ($this->encryptionManager->isEnabled()) {
+            /** @var Setup $setup */
+            $setup = $this->getContainer()->query('UserSetup');
+            $setup->setupSystem();
+        }
+    }
+
+    /**
+     * register hooks
+     */
+    public function registerHooks() {
+        if (!$this->config->getSystemValue('maintenance', false)) {
+
+            $container = $this->getContainer();
+            $server = $container->getServer();
+            // Register our hooks and fire them.
+            $hookManager = new HookManager();
+
+            $hookManager->registerHook([
+                new UserHooks($container->query('KeyManager'),
+                    $server->getUserManager(),
+                    $server->getLogger(),
+                    $container->query('UserSetup'),
+                    $server->getUserSession(),
+                    $container->query('Util'),
+                    $container->query('Session'),
+                    $container->query('Crypt'),
+                    $container->query('Recovery'))
+            ]);
+
+            $hookManager->fireHooks();
+
+        } else {
+            // Logout user if we are in maintenance to force re-login
+            $this->getContainer()->getServer()->getUserSession()->logout();
+        }
+    }
+
+    public function registerEncryptionModule() {
+        $container = $this->getContainer();
+
+
+        $this->encryptionManager->registerEncryptionModule(
+            Encryption::ID,
+            Encryption::DISPLAY_NAME,
+            function() use ($container) {
+
+            return new Encryption(
+                $container->query('Crypt'),
+                $container->query('KeyManager'),
+                $container->query('Util'),
+                $container->query('Session'),
+                $container->query('EncryptAll'),
+                $container->query('DecryptAll'),
+                $container->getServer()->getLogger(),
+                $container->getServer()->getL10N($container->getAppName())
+            );
+        });
+
+    }
+
+    public function registerServices() {
+        $container = $this->getContainer();
+
+        $container->registerService('Crypt',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+                return new Crypt($server->getLogger(),
+                    $server->getUserSession(),
+                    $server->getConfig(),
+                    $server->getL10N($c->getAppName()));
+            });
+
+        $container->registerService('Session',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+                return new Session($server->getSession());
+            }
+        );
+
+        $container->registerService('KeyManager',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+
+                return new KeyManager($server->getEncryptionKeyStorage(),
+                    $c->query('Crypt'),
+                    $server->getConfig(),
+                    $server->getUserSession(),
+                    new Session($server->getSession()),
+                    $server->getLogger(),
+                    $c->query('Util')
+                );
+            });
+
+        $container->registerService('Recovery',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+
+                return new Recovery(
+                    $server->getUserSession(),
+                    $c->query('Crypt'),
+                    $server->getSecureRandom(),
+                    $c->query('KeyManager'),
+                    $server->getConfig(),
+                    $server->getEncryptionKeyStorage(),
+                    $server->getEncryptionFilesHelper(),
+                    new View());
+            });
+
+        $container->registerService('RecoveryController', function (IAppContainer $c) {
+            $server = $c->getServer();
+            return new RecoveryController(
+                $c->getAppName(),
+                $server->getRequest(),
+                $server->getConfig(),
+                $server->getL10N($c->getAppName()),
+                $c->query('Recovery'));
+        });
+
+        $container->registerService('StatusController', function (IAppContainer $c) {
+            $server = $c->getServer();
+            return new StatusController(
+                $c->getAppName(),
+                $server->getRequest(),
+                $server->getL10N($c->getAppName()),
+                $c->query('Session'),
+                $server->getEncryptionManager()
+            );
+        });
+
+        $container->registerService('SettingsController', function (IAppContainer $c) {
+            $server = $c->getServer();
+            return new SettingsController(
+                $c->getAppName(),
+                $server->getRequest(),
+                $server->getL10N($c->getAppName()),
+                $server->getUserManager(),
+                $server->getUserSession(),
+                $c->query('KeyManager'),
+                $c->query('Crypt'),
+                $c->query('Session'),
+                $server->getSession(),
+                $c->query('Util')
+            );
+        });
+
+        $container->registerService('UserSetup',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+                return new Setup($server->getLogger(),
+                    $server->getUserSession(),
+                    $c->query('Crypt'),
+                    $c->query('KeyManager'));
+            });
+
+        $container->registerService('Util',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+
+                return new Util(
+                    new View(),
+                    $c->query('Crypt'),
+                    $server->getLogger(),
+                    $server->getUserSession(),
+                    $server->getConfig(),
+                    $server->getUserManager());
+            });
+
+        $container->registerService('EncryptAll',
+            function (IAppContainer $c) {
+                $server = $c->getServer();
+                return new EncryptAll(
+                    $c->query('UserSetup'),
+                    $c->getServer()->getUserManager(),
+                    new View(),
+                    $c->query('KeyManager'),
+                    $c->query('Util'),
+                    $server->getConfig(),
+                    $server->getMailer(),
+                    $server->getL10N('encryption'),
+                    new QuestionHelper(),
+                    $server->getSecureRandom()
+                );
+            }
+        );
+
+        $container->registerService('DecryptAll',
+            function (IAppContainer $c) {
+                return new DecryptAll(
+                    $c->query('Util'),
+                    $c->query('KeyManager'),
+                    $c->query('Crypt'),
+                    $c->query('Session'),
+                    new QuestionHelper()
+                );
+            }
+        );
+
+    }
+
+    public function registerSettings() {
+        // Register settings scripts
+        App::registerPersonal('encryption', 'settings/settings-personal');
+    }
 }

apps/encryption/lib/KeyManager.php

Indentation +681 added lines, -681 removed lines

@@ -38,685 +38,685 @@
 
 class KeyManager {
 
-	/**
-	 * @var Session
-	 */
-	protected $session;
-	/**
-	 * @var IStorage
-	 */
-	private $keyStorage;
-	/**
-	 * @var Crypt
-	 */
-	private $crypt;
-	/**
-	 * @var string
-	 */
-	private $recoveryKeyId;
-	/**
-	 * @var string
-	 */
-	private $publicShareKeyId;
-	/**
-	 * @var string
-	 */
-	private $masterKeyId;
-	/**
-	 * @var string UserID
-	 */
-	private $keyId;
-	/**
-	 * @var string
-	 */
-	private $publicKeyId = 'publicKey';
-	/**
-	 * @var string
-	 */
-	private $privateKeyId = 'privateKey';
-
-	/**
-	 * @var string
-	 */
-	private $shareKeyId = 'shareKey';
-
-	/**
-	 * @var string
-	 */
-	private $fileKeyId = 'fileKey';
-	/**
-	 * @var IConfig
-	 */
-	private $config;
-	/**
-	 * @var ILogger
-	 */
-	private $log;
-	/**
-	 * @var Util
-	 */
-	private $util;
-
-	/**
-	 * @param IStorage $keyStorage
-	 * @param Crypt $crypt
-	 * @param IConfig $config
-	 * @param IUserSession $userSession
-	 * @param Session $session
-	 * @param ILogger $log
-	 * @param Util $util
-	 */
-	public function __construct(
-		IStorage $keyStorage,
-		Crypt $crypt,
-		IConfig $config,
-		IUserSession $userSession,
-		Session $session,
-		ILogger $log,
-		Util $util
-	) {
-
-		$this->util = $util;
-		$this->session = $session;
-		$this->keyStorage = $keyStorage;
-		$this->crypt = $crypt;
-		$this->config = $config;
-		$this->log = $log;
-
-		$this->recoveryKeyId = $this->config->getAppValue('encryption',
-			'recoveryKeyId');
-		if (empty($this->recoveryKeyId)) {
-			$this->recoveryKeyId = 'recoveryKey_' . substr(md5(time()), 0, 8);
-			$this->config->setAppValue('encryption',
-				'recoveryKeyId',
-				$this->recoveryKeyId);
-		}
-
-		$this->publicShareKeyId = $this->config->getAppValue('encryption',
-			'publicShareKeyId');
-		if (empty($this->publicShareKeyId)) {
-			$this->publicShareKeyId = 'pubShare_' . substr(md5(time()), 0, 8);
-			$this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
-		}
-
-		$this->masterKeyId = $this->config->getAppValue('encryption',
-			'masterKeyId');
-		if (empty($this->masterKeyId)) {
-			$this->masterKeyId = 'master_' . substr(md5(time()), 0, 8);
-			$this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
-		}
-
-		$this->keyId = $userSession && $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : false;
-		$this->log = $log;
-	}
-
-	/**
-	 * check if key pair for public link shares exists, if not we create one
-	 */
-	public function validateShareKey() {
-		$shareKey = $this->getPublicShareKey();
-		if (empty($shareKey)) {
-			$keyPair = $this->crypt->createKeyPair();
-
-			// Save public key
-			$this->keyStorage->setSystemUserKey(
-				$this->publicShareKeyId . '.publicKey', $keyPair['publicKey'],
-				Encryption::ID);
-
-			// Encrypt private key empty passphrase
-			$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
-			$header = $this->crypt->generateHeader();
-			$this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
-		}
-	}
-
-	/**
-	 * check if a key pair for the master key exists, if not we create one
-	 */
-	public function validateMasterKey() {
-
-		if ($this->util->isMasterKeyEnabled() === false) {
-			return;
-		}
-
-		$publicMasterKey = $this->getPublicMasterKey();
-		if (empty($publicMasterKey)) {
-			$keyPair = $this->crypt->createKeyPair();
-
-			// Save public key
-			$this->keyStorage->setSystemUserKey(
-				$this->masterKeyId . '.publicKey', $keyPair['publicKey'],
-				Encryption::ID);
-
-			// Encrypt private key with system password
-			$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
-			$header = $this->crypt->generateHeader();
-			$this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
-		}
-
-		if (!$this->session->isPrivateKeySet()) {
-			$masterKey = $this->getSystemPrivateKey($this->masterKeyId);
-			$decryptedMasterKey = $this->crypt->decryptPrivateKey($masterKey, $this->getMasterKeyPassword(), $this->masterKeyId);
-			$this->session->setPrivateKey($decryptedMasterKey);
-		}
-
-		// after the encryption key is available we are ready to go
-		$this->session->setStatus(Session::INIT_SUCCESSFUL);
-	}
-
-	/**
-	 * @return bool
-	 */
-	public function recoveryKeyExists() {
-		$key = $this->getRecoveryKey();
-		return (!empty($key));
-	}
-
-	/**
-	 * get recovery key
-	 *
-	 * @return string
-	 */
-	public function getRecoveryKey() {
-		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.publicKey', Encryption::ID);
-	}
-
-	/**
-	 * get recovery key ID
-	 *
-	 * @return string
-	 */
-	public function getRecoveryKeyId() {
-		return $this->recoveryKeyId;
-	}
-
-	/**
-	 * @param string $password
-	 * @return bool
-	 */
-	public function checkRecoveryPassword($password) {
-		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.privateKey', Encryption::ID);
-		$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
-
-		if ($decryptedRecoveryKey) {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param string $uid
-	 * @param string $password
-	 * @param string $keyPair
-	 * @return bool
-	 */
-	public function storeKeyPair($uid, $password, $keyPair) {
-		// Save Public Key
-		$this->setPublicKey($uid, $keyPair['publicKey']);
-
-		$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password, $uid);
-
-		$header = $this->crypt->generateHeader();
-
-		if ($encryptedKey) {
-			$this->setPrivateKey($uid, $header . $encryptedKey);
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param string $password
-	 * @param array $keyPair
-	 * @return bool
-	 */
-	public function setRecoveryKey($password, $keyPair) {
-		// Save Public Key
-		$this->keyStorage->setSystemUserKey($this->getRecoveryKeyId().
-			'.publicKey',
-			$keyPair['publicKey'],
-			Encryption::ID);
-
-		$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password);
-		$header = $this->crypt->generateHeader();
-
-		if ($encryptedKey) {
-			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param $userId
-	 * @param $key
-	 * @return bool
-	 */
-	public function setPublicKey($userId, $key) {
-		return $this->keyStorage->setUserKey($userId, $this->publicKeyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * @param $userId
-	 * @param string $key
-	 * @return bool
-	 */
-	public function setPrivateKey($userId, $key) {
-		return $this->keyStorage->setUserKey($userId,
-			$this->privateKeyId,
-			$key,
-			Encryption::ID);
-	}
-
-	/**
-	 * write file key to key storage
-	 *
-	 * @param string $path
-	 * @param string $key
-	 * @return boolean
-	 */
-	public function setFileKey($path, $key) {
-		return $this->keyStorage->setFileKey($path, $this->fileKeyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * set all file keys (the file key and the corresponding share keys)
-	 *
-	 * @param string $path
-	 * @param array $keys
-	 */
-	public function setAllFileKeys($path, $keys) {
-		$this->setFileKey($path, $keys['data']);
-		foreach ($keys['keys'] as $uid => $keyFile) {
-			$this->setShareKey($path, $uid, $keyFile);
-		}
-	}
-
-	/**
-	 * write share key to the key storage
-	 *
-	 * @param string $path
-	 * @param string $uid
-	 * @param string $key
-	 * @return boolean
-	 */
-	public function setShareKey($path, $uid, $key) {
-		$keyId = $uid . '.' . $this->shareKeyId;
-		return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * Decrypt private key and store it
-	 *
-	 * @param string $uid user id
-	 * @param string $passPhrase users password
-	 * @return boolean
-	 */
-	public function init($uid, $passPhrase) {
-
-		$this->session->setStatus(Session::INIT_EXECUTED);
-
-		try {
-			if($this->util->isMasterKeyEnabled()) {
-				$uid = $this->getMasterKeyId();
-				$passPhrase = $this->getMasterKeyPassword();
-				$privateKey = $this->getSystemPrivateKey($uid);
-			} else {
-				$privateKey = $this->getPrivateKey($uid);
-			}
-			$privateKey = $this->crypt->decryptPrivateKey($privateKey, $passPhrase, $uid);
-		} catch (PrivateKeyMissingException $e) {
-			return false;
-		} catch (DecryptionFailedException $e) {
-			return false;
-		} catch (\Exception $e) {
-			$this->log->warning(
-				'Could not decrypt the private key from user "' . $uid . '"" during login. ' .
-				'Assume password change on the user back-end. Error message: '
-				. $e->getMessage()
-			);
-			return false;
-		}
-
-		if ($privateKey) {
-			$this->session->setPrivateKey($privateKey);
-			$this->session->setStatus(Session::INIT_SUCCESSFUL);
-			return true;
-		}
-
-		return false;
-	}
-
-	/**
-	 * @param $userId
-	 * @return string
-	 * @throws PrivateKeyMissingException
-	 */
-	public function getPrivateKey($userId) {
-		$privateKey = $this->keyStorage->getUserKey($userId,
-			$this->privateKeyId, Encryption::ID);
-
-		if (strlen($privateKey) !== 0) {
-			return $privateKey;
-		}
-		throw new PrivateKeyMissingException($userId);
-	}
-
-	/**
-	 * @param string $path
-	 * @param $uid
-	 * @return string
-	 */
-	public function getFileKey($path, $uid) {
-		if ($uid === '') {
-			$uid = null;
-		}
-		$publicAccess = is_null($uid);
-		$encryptedFileKey = $this->keyStorage->getFileKey($path, $this->fileKeyId, Encryption::ID);
-
-		if (empty($encryptedFileKey)) {
-			return '';
-		}
-
-		if ($this->util->isMasterKeyEnabled()) {
-			$uid = $this->getMasterKeyId();
-			$shareKey = $this->getShareKey($path, $uid);
-			if ($publicAccess) {
-				$privateKey = $this->getSystemPrivateKey($uid);
-				$privateKey = $this->crypt->decryptPrivateKey($privateKey, $this->getMasterKeyPassword(), $uid);
-			} else {
-				// when logged in, the master key is already decrypted in the session
-				$privateKey = $this->session->getPrivateKey();
-			}
-		} else if ($publicAccess) {
-			// use public share key for public links
-			$uid = $this->getPublicShareKeyId();
-			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.privateKey', Encryption::ID);
-			$privateKey = $this->crypt->decryptPrivateKey($privateKey);
-		} else {
-			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->session->getPrivateKey();
-		}
-
-		if ($encryptedFileKey && $shareKey && $privateKey) {
-			return $this->crypt->multiKeyDecrypt($encryptedFileKey,
-				$shareKey,
-				$privateKey);
-		}
-
-		return '';
-	}
-
-	/**
-	 * Get the current version of a file
-	 *
-	 * @param string $path
-	 * @param View $view
-	 * @return int
-	 */
-	public function getVersion($path, View $view) {
-		$fileInfo = $view->getFileInfo($path);
-		if($fileInfo === false) {
-			return 0;
-		}
-		return $fileInfo->getEncryptedVersion();
-	}
-
-	/**
-	 * Set the current version of a file
-	 *
-	 * @param string $path
-	 * @param int $version
-	 * @param View $view
-	 */
-	public function setVersion($path, $version, View $view) {
-		$fileInfo= $view->getFileInfo($path);
-
-		if($fileInfo !== false) {
-			$cache = $fileInfo->getStorage()->getCache();
-			$cache->update($fileInfo->getId(), ['encrypted' => $version, 'encryptedVersion' => $version]);
-		}
-	}
-
-	/**
-	 * get the encrypted file key
-	 *
-	 * @param string $path
-	 * @return string
-	 */
-	public function getEncryptedFileKey($path) {
-		$encryptedFileKey = $this->keyStorage->getFileKey($path,
-			$this->fileKeyId, Encryption::ID);
-
-		return $encryptedFileKey;
-	}
-
-	/**
-	 * delete share key
-	 *
-	 * @param string $path
-	 * @param string $keyId
-	 * @return boolean
-	 */
-	public function deleteShareKey($path, $keyId) {
-		return $this->keyStorage->deleteFileKey(
-			$path,
-			$keyId . '.' . $this->shareKeyId,
-			Encryption::ID);
-	}
-
-
-	/**
-	 * @param $path
-	 * @param $uid
-	 * @return mixed
-	 */
-	public function getShareKey($path, $uid) {
-		$keyId = $uid . '.' . $this->shareKeyId;
-		return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
-	}
-
-	/**
-	 * check if user has a private and a public key
-	 *
-	 * @param string $userId
-	 * @return bool
-	 * @throws PrivateKeyMissingException
-	 * @throws PublicKeyMissingException
-	 */
-	public function userHasKeys($userId) {
-		$privateKey = $publicKey = true;
-		$exception = null;
-
-		try {
-			$this->getPrivateKey($userId);
-		} catch (PrivateKeyMissingException $e) {
-			$privateKey = false;
-			$exception = $e;
-		}
-		try {
-			$this->getPublicKey($userId);
-		} catch (PublicKeyMissingException $e) {
-			$publicKey = false;
-			$exception = $e;
-		}
-
-		if ($privateKey && $publicKey) {
-			return true;
-		} elseif (!$privateKey && !$publicKey) {
-			return false;
-		} else {
-			throw $exception;
-		}
-	}
-
-	/**
-	 * @param $userId
-	 * @return mixed
-	 * @throws PublicKeyMissingException
-	 */
-	public function getPublicKey($userId) {
-		$publicKey = $this->keyStorage->getUserKey($userId, $this->publicKeyId, Encryption::ID);
-
-		if (strlen($publicKey) !== 0) {
-			return $publicKey;
-		}
-		throw new PublicKeyMissingException($userId);
-	}
-
-	public function getPublicShareKeyId() {
-		return $this->publicShareKeyId;
-	}
-
-	/**
-	 * get public key for public link shares
-	 *
-	 * @return string
-	 */
-	public function getPublicShareKey() {
-		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.publicKey', Encryption::ID);
-	}
-
-	/**
-	 * @param string $purpose
-	 * @param string $uid
-	 */
-	public function backupUserKeys($purpose, $uid) {
-		$this->keyStorage->backupUserKeys(Encryption::ID, $purpose, $uid);
-	}
-
-	/**
-	 * creat a backup of the users private and public key and then  delete it
-	 *
-	 * @param string $uid
-	 */
-	public function deleteUserKeys($uid) {
-		$this->deletePublicKey($uid);
-		$this->deletePrivateKey($uid);
-	}
-
-	/**
-	 * @param $uid
-	 * @return bool
-	 */
-	public function deletePublicKey($uid) {
-		return $this->keyStorage->deleteUserKey($uid, $this->publicKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $uid
-	 * @return bool
-	 */
-	private function deletePrivateKey($uid) {
-		return $this->keyStorage->deleteUserKey($uid, $this->privateKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $path
-	 * @return bool
-	 */
-	public function deleteAllFileKeys($path) {
-		return $this->keyStorage->deleteAllFileKeys($path);
-	}
-
-	/**
-	 * @param array $userIds
-	 * @return array
-	 * @throws PublicKeyMissingException
-	 */
-	public function getPublicKeys(array $userIds) {
-		$keys = [];
-
-		foreach ($userIds as $userId) {
-			try {
-				$keys[$userId] = $this->getPublicKey($userId);
-			} catch (PublicKeyMissingException $e) {
-				continue;
-			}
-		}
-
-		return $keys;
-
-	}
-
-	/**
-	 * @param string $keyId
-	 * @return string returns openssl key
-	 */
-	public function getSystemPrivateKey($keyId) {
-		return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $keyId
-	 * @param string $key
-	 * @return string returns openssl key
-	 */
-	public function setSystemPrivateKey($keyId, $key) {
-		return $this->keyStorage->setSystemUserKey(
-			$keyId . '.' . $this->privateKeyId,
-			$key,
-			Encryption::ID);
-	}
-
-	/**
-	 * add system keys such as the public share key and the recovery key
-	 *
-	 * @param array $accessList
-	 * @param array $publicKeys
-	 * @param string $uid
-	 * @return array
-	 * @throws PublicKeyMissingException
-	 */
-	public function addSystemKeys(array $accessList, array $publicKeys, $uid) {
-		if (!empty($accessList['public'])) {
-			$publicShareKey = $this->getPublicShareKey();
-			if (empty($publicShareKey)) {
-				throw new PublicKeyMissingException($this->getPublicShareKeyId());
-			}
-			$publicKeys[$this->getPublicShareKeyId()] = $publicShareKey;
-		}
-
-		if ($this->recoveryKeyExists() &&
-			$this->util->isRecoveryEnabledForUser($uid)) {
-
-			$publicKeys[$this->getRecoveryKeyId()] = $this->getRecoveryKey();
-		}
-
-		return $publicKeys;
-	}
-
-	/**
-	 * get master key password
-	 *
-	 * @return string
-	 * @throws \Exception
-	 */
-	public function getMasterKeyPassword() {
-		$password = $this->config->getSystemValue('secret');
-		if (empty($password)){
-			throw new \Exception('Can not get secret from Nextcloud instance');
-		}
-
-		return $password;
-	}
-
-	/**
-	 * return master key id
-	 *
-	 * @return string
-	 */
-	public function getMasterKeyId() {
-		return $this->masterKeyId;
-	}
-
-	/**
-	 * get public master key
-	 *
-	 * @return string
-	 */
-	public function getPublicMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.publicKey', Encryption::ID);
-	}
+    /**
+     * @var Session
+     */
+    protected $session;
+    /**
+     * @var IStorage
+     */
+    private $keyStorage;
+    /**
+     * @var Crypt
+     */
+    private $crypt;
+    /**
+     * @var string
+     */
+    private $recoveryKeyId;
+    /**
+     * @var string
+     */
+    private $publicShareKeyId;
+    /**
+     * @var string
+     */
+    private $masterKeyId;
+    /**
+     * @var string UserID
+     */
+    private $keyId;
+    /**
+     * @var string
+     */
+    private $publicKeyId = 'publicKey';
+    /**
+     * @var string
+     */
+    private $privateKeyId = 'privateKey';
+
+    /**
+     * @var string
+     */
+    private $shareKeyId = 'shareKey';
+
+    /**
+     * @var string
+     */
+    private $fileKeyId = 'fileKey';
+    /**
+     * @var IConfig
+     */
+    private $config;
+    /**
+     * @var ILogger
+     */
+    private $log;
+    /**
+     * @var Util
+     */
+    private $util;
+
+    /**
+     * @param IStorage $keyStorage
+     * @param Crypt $crypt
+     * @param IConfig $config
+     * @param IUserSession $userSession
+     * @param Session $session
+     * @param ILogger $log
+     * @param Util $util
+     */
+    public function __construct(
+        IStorage $keyStorage,
+        Crypt $crypt,
+        IConfig $config,
+        IUserSession $userSession,
+        Session $session,
+        ILogger $log,
+        Util $util
+    ) {
+
+        $this->util = $util;
+        $this->session = $session;
+        $this->keyStorage = $keyStorage;
+        $this->crypt = $crypt;
+        $this->config = $config;
+        $this->log = $log;
+
+        $this->recoveryKeyId = $this->config->getAppValue('encryption',
+            'recoveryKeyId');
+        if (empty($this->recoveryKeyId)) {
+            $this->recoveryKeyId = 'recoveryKey_' . substr(md5(time()), 0, 8);
+            $this->config->setAppValue('encryption',
+                'recoveryKeyId',
+                $this->recoveryKeyId);
+        }
+
+        $this->publicShareKeyId = $this->config->getAppValue('encryption',
+            'publicShareKeyId');
+        if (empty($this->publicShareKeyId)) {
+            $this->publicShareKeyId = 'pubShare_' . substr(md5(time()), 0, 8);
+            $this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
+        }
+
+        $this->masterKeyId = $this->config->getAppValue('encryption',
+            'masterKeyId');
+        if (empty($this->masterKeyId)) {
+            $this->masterKeyId = 'master_' . substr(md5(time()), 0, 8);
+            $this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
+        }
+
+        $this->keyId = $userSession && $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : false;
+        $this->log = $log;
+    }
+
+    /**
+     * check if key pair for public link shares exists, if not we create one
+     */
+    public function validateShareKey() {
+        $shareKey = $this->getPublicShareKey();
+        if (empty($shareKey)) {
+            $keyPair = $this->crypt->createKeyPair();
+
+            // Save public key
+            $this->keyStorage->setSystemUserKey(
+                $this->publicShareKeyId . '.publicKey', $keyPair['publicKey'],
+                Encryption::ID);
+
+            // Encrypt private key empty passphrase
+            $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
+            $header = $this->crypt->generateHeader();
+            $this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
+        }
+    }
+
+    /**
+     * check if a key pair for the master key exists, if not we create one
+     */
+    public function validateMasterKey() {
+
+        if ($this->util->isMasterKeyEnabled() === false) {
+            return;
+        }
+
+        $publicMasterKey = $this->getPublicMasterKey();
+        if (empty($publicMasterKey)) {
+            $keyPair = $this->crypt->createKeyPair();
+
+            // Save public key
+            $this->keyStorage->setSystemUserKey(
+                $this->masterKeyId . '.publicKey', $keyPair['publicKey'],
+                Encryption::ID);
+
+            // Encrypt private key with system password
+            $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
+            $header = $this->crypt->generateHeader();
+            $this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
+        }
+
+        if (!$this->session->isPrivateKeySet()) {
+            $masterKey = $this->getSystemPrivateKey($this->masterKeyId);
+            $decryptedMasterKey = $this->crypt->decryptPrivateKey($masterKey, $this->getMasterKeyPassword(), $this->masterKeyId);
+            $this->session->setPrivateKey($decryptedMasterKey);
+        }
+
+        // after the encryption key is available we are ready to go
+        $this->session->setStatus(Session::INIT_SUCCESSFUL);
+    }
+
+    /**
+     * @return bool
+     */
+    public function recoveryKeyExists() {
+        $key = $this->getRecoveryKey();
+        return (!empty($key));
+    }
+
+    /**
+     * get recovery key
+     *
+     * @return string
+     */
+    public function getRecoveryKey() {
+        return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.publicKey', Encryption::ID);
+    }
+
+    /**
+     * get recovery key ID
+     *
+     * @return string
+     */
+    public function getRecoveryKeyId() {
+        return $this->recoveryKeyId;
+    }
+
+    /**
+     * @param string $password
+     * @return bool
+     */
+    public function checkRecoveryPassword($password) {
+        $recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.privateKey', Encryption::ID);
+        $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
+
+        if ($decryptedRecoveryKey) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param string $uid
+     * @param string $password
+     * @param string $keyPair
+     * @return bool
+     */
+    public function storeKeyPair($uid, $password, $keyPair) {
+        // Save Public Key
+        $this->setPublicKey($uid, $keyPair['publicKey']);
+
+        $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password, $uid);
+
+        $header = $this->crypt->generateHeader();
+
+        if ($encryptedKey) {
+            $this->setPrivateKey($uid, $header . $encryptedKey);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param string $password
+     * @param array $keyPair
+     * @return bool
+     */
+    public function setRecoveryKey($password, $keyPair) {
+        // Save Public Key
+        $this->keyStorage->setSystemUserKey($this->getRecoveryKeyId().
+            '.publicKey',
+            $keyPair['publicKey'],
+            Encryption::ID);
+
+        $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password);
+        $header = $this->crypt->generateHeader();
+
+        if ($encryptedKey) {
+            $this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param $userId
+     * @param $key
+     * @return bool
+     */
+    public function setPublicKey($userId, $key) {
+        return $this->keyStorage->setUserKey($userId, $this->publicKeyId, $key, Encryption::ID);
+    }
+
+    /**
+     * @param $userId
+     * @param string $key
+     * @return bool
+     */
+    public function setPrivateKey($userId, $key) {
+        return $this->keyStorage->setUserKey($userId,
+            $this->privateKeyId,
+            $key,
+            Encryption::ID);
+    }
+
+    /**
+     * write file key to key storage
+     *
+     * @param string $path
+     * @param string $key
+     * @return boolean
+     */
+    public function setFileKey($path, $key) {
+        return $this->keyStorage->setFileKey($path, $this->fileKeyId, $key, Encryption::ID);
+    }
+
+    /**
+     * set all file keys (the file key and the corresponding share keys)
+     *
+     * @param string $path
+     * @param array $keys
+     */
+    public function setAllFileKeys($path, $keys) {
+        $this->setFileKey($path, $keys['data']);
+        foreach ($keys['keys'] as $uid => $keyFile) {
+            $this->setShareKey($path, $uid, $keyFile);
+        }
+    }
+
+    /**
+     * write share key to the key storage
+     *
+     * @param string $path
+     * @param string $uid
+     * @param string $key
+     * @return boolean
+     */
+    public function setShareKey($path, $uid, $key) {
+        $keyId = $uid . '.' . $this->shareKeyId;
+        return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
+    }
+
+    /**
+     * Decrypt private key and store it
+     *
+     * @param string $uid user id
+     * @param string $passPhrase users password
+     * @return boolean
+     */
+    public function init($uid, $passPhrase) {
+
+        $this->session->setStatus(Session::INIT_EXECUTED);
+
+        try {
+            if($this->util->isMasterKeyEnabled()) {
+                $uid = $this->getMasterKeyId();
+                $passPhrase = $this->getMasterKeyPassword();
+                $privateKey = $this->getSystemPrivateKey($uid);
+            } else {
+                $privateKey = $this->getPrivateKey($uid);
+            }
+            $privateKey = $this->crypt->decryptPrivateKey($privateKey, $passPhrase, $uid);
+        } catch (PrivateKeyMissingException $e) {
+            return false;
+        } catch (DecryptionFailedException $e) {
+            return false;
+        } catch (\Exception $e) {
+            $this->log->warning(
+                'Could not decrypt the private key from user "' . $uid . '"" during login. ' .
+                'Assume password change on the user back-end. Error message: '
+                . $e->getMessage()
+            );
+            return false;
+        }
+
+        if ($privateKey) {
+            $this->session->setPrivateKey($privateKey);
+            $this->session->setStatus(Session::INIT_SUCCESSFUL);
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * @param $userId
+     * @return string
+     * @throws PrivateKeyMissingException
+     */
+    public function getPrivateKey($userId) {
+        $privateKey = $this->keyStorage->getUserKey($userId,
+            $this->privateKeyId, Encryption::ID);
+
+        if (strlen($privateKey) !== 0) {
+            return $privateKey;
+        }
+        throw new PrivateKeyMissingException($userId);
+    }
+
+    /**
+     * @param string $path
+     * @param $uid
+     * @return string
+     */
+    public function getFileKey($path, $uid) {
+        if ($uid === '') {
+            $uid = null;
+        }
+        $publicAccess = is_null($uid);
+        $encryptedFileKey = $this->keyStorage->getFileKey($path, $this->fileKeyId, Encryption::ID);
+
+        if (empty($encryptedFileKey)) {
+            return '';
+        }
+
+        if ($this->util->isMasterKeyEnabled()) {
+            $uid = $this->getMasterKeyId();
+            $shareKey = $this->getShareKey($path, $uid);
+            if ($publicAccess) {
+                $privateKey = $this->getSystemPrivateKey($uid);
+                $privateKey = $this->crypt->decryptPrivateKey($privateKey, $this->getMasterKeyPassword(), $uid);
+            } else {
+                // when logged in, the master key is already decrypted in the session
+                $privateKey = $this->session->getPrivateKey();
+            }
+        } else if ($publicAccess) {
+            // use public share key for public links
+            $uid = $this->getPublicShareKeyId();
+            $shareKey = $this->getShareKey($path, $uid);
+            $privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.privateKey', Encryption::ID);
+            $privateKey = $this->crypt->decryptPrivateKey($privateKey);
+        } else {
+            $shareKey = $this->getShareKey($path, $uid);
+            $privateKey = $this->session->getPrivateKey();
+        }
+
+        if ($encryptedFileKey && $shareKey && $privateKey) {
+            return $this->crypt->multiKeyDecrypt($encryptedFileKey,
+                $shareKey,
+                $privateKey);
+        }
+
+        return '';
+    }
+
+    /**
+     * Get the current version of a file
+     *
+     * @param string $path
+     * @param View $view
+     * @return int
+     */
+    public function getVersion($path, View $view) {
+        $fileInfo = $view->getFileInfo($path);
+        if($fileInfo === false) {
+            return 0;
+        }
+        return $fileInfo->getEncryptedVersion();
+    }
+
+    /**
+     * Set the current version of a file
+     *
+     * @param string $path
+     * @param int $version
+     * @param View $view
+     */
+    public function setVersion($path, $version, View $view) {
+        $fileInfo= $view->getFileInfo($path);
+
+        if($fileInfo !== false) {
+            $cache = $fileInfo->getStorage()->getCache();
+            $cache->update($fileInfo->getId(), ['encrypted' => $version, 'encryptedVersion' => $version]);
+        }
+    }
+
+    /**
+     * get the encrypted file key
+     *
+     * @param string $path
+     * @return string
+     */
+    public function getEncryptedFileKey($path) {
+        $encryptedFileKey = $this->keyStorage->getFileKey($path,
+            $this->fileKeyId, Encryption::ID);
+
+        return $encryptedFileKey;
+    }
+
+    /**
+     * delete share key
+     *
+     * @param string $path
+     * @param string $keyId
+     * @return boolean
+     */
+    public function deleteShareKey($path, $keyId) {
+        return $this->keyStorage->deleteFileKey(
+            $path,
+            $keyId . '.' . $this->shareKeyId,
+            Encryption::ID);
+    }
+
+
+    /**
+     * @param $path
+     * @param $uid
+     * @return mixed
+     */
+    public function getShareKey($path, $uid) {
+        $keyId = $uid . '.' . $this->shareKeyId;
+        return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
+    }
+
+    /**
+     * check if user has a private and a public key
+     *
+     * @param string $userId
+     * @return bool
+     * @throws PrivateKeyMissingException
+     * @throws PublicKeyMissingException
+     */
+    public function userHasKeys($userId) {
+        $privateKey = $publicKey = true;
+        $exception = null;
+
+        try {
+            $this->getPrivateKey($userId);
+        } catch (PrivateKeyMissingException $e) {
+            $privateKey = false;
+            $exception = $e;
+        }
+        try {
+            $this->getPublicKey($userId);
+        } catch (PublicKeyMissingException $e) {
+            $publicKey = false;
+            $exception = $e;
+        }
+
+        if ($privateKey && $publicKey) {
+            return true;
+        } elseif (!$privateKey && !$publicKey) {
+            return false;
+        } else {
+            throw $exception;
+        }
+    }
+
+    /**
+     * @param $userId
+     * @return mixed
+     * @throws PublicKeyMissingException
+     */
+    public function getPublicKey($userId) {
+        $publicKey = $this->keyStorage->getUserKey($userId, $this->publicKeyId, Encryption::ID);
+
+        if (strlen($publicKey) !== 0) {
+            return $publicKey;
+        }
+        throw new PublicKeyMissingException($userId);
+    }
+
+    public function getPublicShareKeyId() {
+        return $this->publicShareKeyId;
+    }
+
+    /**
+     * get public key for public link shares
+     *
+     * @return string
+     */
+    public function getPublicShareKey() {
+        return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.publicKey', Encryption::ID);
+    }
+
+    /**
+     * @param string $purpose
+     * @param string $uid
+     */
+    public function backupUserKeys($purpose, $uid) {
+        $this->keyStorage->backupUserKeys(Encryption::ID, $purpose, $uid);
+    }
+
+    /**
+     * creat a backup of the users private and public key and then  delete it
+     *
+     * @param string $uid
+     */
+    public function deleteUserKeys($uid) {
+        $this->deletePublicKey($uid);
+        $this->deletePrivateKey($uid);
+    }
+
+    /**
+     * @param $uid
+     * @return bool
+     */
+    public function deletePublicKey($uid) {
+        return $this->keyStorage->deleteUserKey($uid, $this->publicKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $uid
+     * @return bool
+     */
+    private function deletePrivateKey($uid) {
+        return $this->keyStorage->deleteUserKey($uid, $this->privateKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $path
+     * @return bool
+     */
+    public function deleteAllFileKeys($path) {
+        return $this->keyStorage->deleteAllFileKeys($path);
+    }
+
+    /**
+     * @param array $userIds
+     * @return array
+     * @throws PublicKeyMissingException
+     */
+    public function getPublicKeys(array $userIds) {
+        $keys = [];
+
+        foreach ($userIds as $userId) {
+            try {
+                $keys[$userId] = $this->getPublicKey($userId);
+            } catch (PublicKeyMissingException $e) {
+                continue;
+            }
+        }
+
+        return $keys;
+
+    }
+
+    /**
+     * @param string $keyId
+     * @return string returns openssl key
+     */
+    public function getSystemPrivateKey($keyId) {
+        return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $keyId
+     * @param string $key
+     * @return string returns openssl key
+     */
+    public function setSystemPrivateKey($keyId, $key) {
+        return $this->keyStorage->setSystemUserKey(
+            $keyId . '.' . $this->privateKeyId,
+            $key,
+            Encryption::ID);
+    }
+
+    /**
+     * add system keys such as the public share key and the recovery key
+     *
+     * @param array $accessList
+     * @param array $publicKeys
+     * @param string $uid
+     * @return array
+     * @throws PublicKeyMissingException
+     */
+    public function addSystemKeys(array $accessList, array $publicKeys, $uid) {
+        if (!empty($accessList['public'])) {
+            $publicShareKey = $this->getPublicShareKey();
+            if (empty($publicShareKey)) {
+                throw new PublicKeyMissingException($this->getPublicShareKeyId());
+            }
+            $publicKeys[$this->getPublicShareKeyId()] = $publicShareKey;
+        }
+
+        if ($this->recoveryKeyExists() &&
+            $this->util->isRecoveryEnabledForUser($uid)) {
+
+            $publicKeys[$this->getRecoveryKeyId()] = $this->getRecoveryKey();
+        }
+
+        return $publicKeys;
+    }
+
+    /**
+     * get master key password
+     *
+     * @return string
+     * @throws \Exception
+     */
+    public function getMasterKeyPassword() {
+        $password = $this->config->getSystemValue('secret');
+        if (empty($password)){
+            throw new \Exception('Can not get secret from Nextcloud instance');
+        }
+
+        return $password;
+    }
+
+    /**
+     * return master key id
+     *
+     * @return string
+     */
+    public function getMasterKeyId() {
+        return $this->masterKeyId;
+    }
+
+    /**
+     * get public master key
+     *
+     * @return string
+     */
+    public function getPublicMasterKey() {
+        return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.publicKey', Encryption::ID);
+    }
 }

Spacing +25 added lines, -25 removed lines

@@ -126,7 +126,7 @@ 
 		$this->recoveryKeyId = $this->config->getAppValue('encryption',
 			'recoveryKeyId');
 		if (empty($this->recoveryKeyId)) {
-			$this->recoveryKeyId = 'recoveryKey_' . substr(md5(time()), 0, 8);
+			$this->recoveryKeyId = 'recoveryKey_'.substr(md5(time()), 0, 8);
 			$this->config->setAppValue('encryption',
 				'recoveryKeyId',
 				$this->recoveryKeyId);
@@ -135,14 +135,14 @@ 
 		$this->publicShareKeyId = $this->config->getAppValue('encryption',
 			'publicShareKeyId');
 		if (empty($this->publicShareKeyId)) {
-			$this->publicShareKeyId = 'pubShare_' . substr(md5(time()), 0, 8);
+			$this->publicShareKeyId = 'pubShare_'.substr(md5(time()), 0, 8);
 			$this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
 		}
 
 		$this->masterKeyId = $this->config->getAppValue('encryption',
 			'masterKeyId');
 		if (empty($this->masterKeyId)) {
-			$this->masterKeyId = 'master_' . substr(md5(time()), 0, 8);
+			$this->masterKeyId = 'master_'.substr(md5(time()), 0, 8);
 			$this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
 		}
 
@@ -160,13 +160,13 @@ 
 
 			// Save public key
 			$this->keyStorage->setSystemUserKey(
-				$this->publicShareKeyId . '.publicKey', $keyPair['publicKey'],
+				$this->publicShareKeyId.'.publicKey', $keyPair['publicKey'],
 				Encryption::ID);
 
 			// Encrypt private key empty passphrase
 			$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
 			$header = $this->crypt->generateHeader();
-			$this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
+			$this->setSystemPrivateKey($this->publicShareKeyId, $header.$encryptedKey);
 		}
 	}
 
@@ -185,13 +185,13 @@ 
 
 			// Save public key
 			$this->keyStorage->setSystemUserKey(
-				$this->masterKeyId . '.publicKey', $keyPair['publicKey'],
+				$this->masterKeyId.'.publicKey', $keyPair['publicKey'],
 				Encryption::ID);
 
 			// Encrypt private key with system password
 			$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
 			$header = $this->crypt->generateHeader();
-			$this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
+			$this->setSystemPrivateKey($this->masterKeyId, $header.$encryptedKey);
 		}
 
 		if (!$this->session->isPrivateKeySet()) {
@@ -218,7 +218,7 @@ 
 	 * @return string
 	 */
 	public function getRecoveryKey() {
-		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.publicKey', Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId.'.publicKey', Encryption::ID);
 	}
 
 	/**
@@ -235,7 +235,7 @@ 
 	 * @return bool
 	 */
 	public function checkRecoveryPassword($password) {
-		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.privateKey', Encryption::ID);
+		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId.'.privateKey', Encryption::ID);
 		$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
 
 		if ($decryptedRecoveryKey) {
@@ -259,7 +259,7 @@ 
 		$header = $this->crypt->generateHeader();
 
 		if ($encryptedKey) {
-			$this->setPrivateKey($uid, $header . $encryptedKey);
+			$this->setPrivateKey($uid, $header.$encryptedKey);
 			return true;
 		}
 		return false;
@@ -281,7 +281,7 @@ 
 		$header = $this->crypt->generateHeader();
 
 		if ($encryptedKey) {
-			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
+			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header.$encryptedKey);
 			return true;
 		}
 		return false;
@@ -341,7 +341,7 @@ 
 	 * @return boolean
 	 */
 	public function setShareKey($path, $uid, $key) {
-		$keyId = $uid . '.' . $this->shareKeyId;
+		$keyId = $uid.'.'.$this->shareKeyId;
 		return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
 	}
 
@@ -357,7 +357,7 @@ 
 		$this->session->setStatus(Session::INIT_EXECUTED);
 
 		try {
-			if($this->util->isMasterKeyEnabled()) {
+			if ($this->util->isMasterKeyEnabled()) {
 				$uid = $this->getMasterKeyId();
 				$passPhrase = $this->getMasterKeyPassword();
 				$privateKey = $this->getSystemPrivateKey($uid);
@@ -371,7 +371,7 @@ 
 			return false;
 		} catch (\Exception $e) {
 			$this->log->warning(
-				'Could not decrypt the private key from user "' . $uid . '"" during login. ' .
+				'Could not decrypt the private key from user "'.$uid.'"" during login. '.
 				'Assume password change on the user back-end. Error message: '
 				. $e->getMessage()
 			);
@@ -432,7 +432,7 @@ 
 			// use public share key for public links
 			$uid = $this->getPublicShareKeyId();
 			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.privateKey', Encryption::ID);
+			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId.'.privateKey', Encryption::ID);
 			$privateKey = $this->crypt->decryptPrivateKey($privateKey);
 		} else {
 			$shareKey = $this->getShareKey($path, $uid);
@@ -457,7 +457,7 @@ 
 	 */
 	public function getVersion($path, View $view) {
 		$fileInfo = $view->getFileInfo($path);
-		if($fileInfo === false) {
+		if ($fileInfo === false) {
 			return 0;
 		}
 		return $fileInfo->getEncryptedVersion();
@@ -471,9 +471,9 @@ 
 	 * @param View $view
 	 */
 	public function setVersion($path, $version, View $view) {
-		$fileInfo= $view->getFileInfo($path);
+		$fileInfo = $view->getFileInfo($path);
 
-		if($fileInfo !== false) {
+		if ($fileInfo !== false) {
 			$cache = $fileInfo->getStorage()->getCache();
 			$cache->update($fileInfo->getId(), ['encrypted' => $version, 'encryptedVersion' => $version]);
 		}
@@ -502,7 +502,7 @@ 
 	public function deleteShareKey($path, $keyId) {
 		return $this->keyStorage->deleteFileKey(
 			$path,
-			$keyId . '.' . $this->shareKeyId,
+			$keyId.'.'.$this->shareKeyId,
 			Encryption::ID);
 	}
 
@@ -513,7 +513,7 @@ 
 	 * @return mixed
 	 */
 	public function getShareKey($path, $uid) {
-		$keyId = $uid . '.' . $this->shareKeyId;
+		$keyId = $uid.'.'.$this->shareKeyId;
 		return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
 	}
 
@@ -575,7 +575,7 @@ 
 	 * @return string
 	 */
 	public function getPublicShareKey() {
-		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.publicKey', Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId.'.publicKey', Encryption::ID);
 	}
 
 	/**
@@ -645,7 +645,7 @@ 
 	 * @return string returns openssl key
 	 */
 	public function getSystemPrivateKey($keyId) {
-		return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($keyId.'.'.$this->privateKeyId, Encryption::ID);
 	}
 
 	/**
@@ -655,7 +655,7 @@ 
 	 */
 	public function setSystemPrivateKey($keyId, $key) {
 		return $this->keyStorage->setSystemUserKey(
-			$keyId . '.' . $this->privateKeyId,
+			$keyId.'.'.$this->privateKeyId,
 			$key,
 			Encryption::ID);
 	}
@@ -695,7 +695,7 @@ 
 	 */
 	public function getMasterKeyPassword() {
 		$password = $this->config->getSystemValue('secret');
-		if (empty($password)){
+		if (empty($password)) {
 			throw new \Exception('Can not get secret from Nextcloud instance');
 		}
 
@@ -717,6 +717,6 @@ 
 	 * @return string
 	 */
 	public function getPublicMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.publicKey', Encryption::ID);
+		return $this->keyStorage->getSystemUserKey($this->masterKeyId.'.publicKey', Encryption::ID);
 	}
 }

settings/Controller/UsersController.php

Indentation +944 added lines, -944 removed lines

@@ -60,949 +60,949 @@
  * @package OC\Settings\Controller
  */
 class UsersController extends Controller {
-	/** @var IL10N */
-	private $l10n;
-	/** @var IUserSession */
-	private $userSession;
-	/** @var bool */
-	private $isAdmin;
-	/** @var IUserManager */
-	private $userManager;
-	/** @var IGroupManager */
-	private $groupManager;
-	/** @var IConfig */
-	private $config;
-	/** @var ILogger */
-	private $log;
-	/** @var IMailer */
-	private $mailer;
-	/** @var bool contains the state of the encryption app */
-	private $isEncryptionAppEnabled;
-	/** @var bool contains the state of the admin recovery setting */
-	private $isRestoreEnabled = false;
-	/** @var IAvatarManager */
-	private $avatarManager;
-	/** @var AccountManager */
-	private $accountManager;
-	/** @var ISecureRandom */
-	private $secureRandom;
-	/** @var NewUserMailHelper */
-	private $newUserMailHelper;
-	/** @var ITimeFactory */
-	private $timeFactory;
-	/** @var ICrypto */
-	private $crypto;
-	/** @var Manager */
-	private $keyManager;
-	/** @var IJobList */
-	private $jobList;
-	/** @var IManager */
-	private $encryptionManager;
-
-	/**
-	 * @param string $appName
-	 * @param IRequest $request
-	 * @param IUserManager $userManager
-	 * @param IGroupManager $groupManager
-	 * @param IUserSession $userSession
-	 * @param IConfig $config
-	 * @param bool $isAdmin
-	 * @param IL10N $l10n
-	 * @param ILogger $log
-	 * @param IMailer $mailer
-	 * @param IURLGenerator $urlGenerator
-	 * @param IAppManager $appManager
-	 * @param IAvatarManager $avatarManager
-	 * @param AccountManager $accountManager
-	 * @param ISecureRandom $secureRandom
-	 * @param NewUserMailHelper $newUserMailHelper
-	 * @param ITimeFactory $timeFactory
-	 * @param ICrypto $crypto
-	 * @param Manager $keyManager
-	 * @param IJobList $jobList
-	 * @param IManager $encryptionManager
-	 */
-	public function __construct($appName,
-								IRequest $request,
-								IUserManager $userManager,
-								IGroupManager $groupManager,
-								IUserSession $userSession,
-								IConfig $config,
-								$isAdmin,
-								IL10N $l10n,
-								ILogger $log,
-								IMailer $mailer,
-								IURLGenerator $urlGenerator,
-								IAppManager $appManager,
-								IAvatarManager $avatarManager,
-								AccountManager $accountManager,
-								ISecureRandom $secureRandom,
-								NewUserMailHelper $newUserMailHelper,
-								ITimeFactory $timeFactory,
-								ICrypto $crypto,
-								Manager $keyManager,
-								IJobList $jobList,
-								IManager $encryptionManager) {
-		parent::__construct($appName, $request);
-		$this->userManager = $userManager;
-		$this->groupManager = $groupManager;
-		$this->userSession = $userSession;
-		$this->config = $config;
-		$this->isAdmin = $isAdmin;
-		$this->l10n = $l10n;
-		$this->log = $log;
-		$this->mailer = $mailer;
-		$this->avatarManager = $avatarManager;
-		$this->accountManager = $accountManager;
-		$this->secureRandom = $secureRandom;
-		$this->newUserMailHelper = $newUserMailHelper;
-		$this->timeFactory = $timeFactory;
-		$this->crypto = $crypto;
-		$this->keyManager = $keyManager;
-		$this->jobList = $jobList;
-		$this->encryptionManager = $encryptionManager;
-
-		// check for encryption state - TODO see formatUserForIndex
-		$this->isEncryptionAppEnabled = $appManager->isEnabledForUser('encryption');
-		if($this->isEncryptionAppEnabled) {
-			// putting this directly in empty is possible in PHP 5.5+
-			$result = $config->getAppValue('encryption', 'recoveryAdminEnabled', 0);
-			$this->isRestoreEnabled = !empty($result);
-		}
-	}
-
-	/**
-	 * @param IUser $user
-	 * @param array $userGroups
-	 * @return array
-	 */
-	private function formatUserForIndex(IUser $user, array $userGroups = null) {
-
-		// TODO: eliminate this encryption specific code below and somehow
-		// hook in additional user info from other apps
-
-		// recovery isn't possible if admin or user has it disabled and encryption
-		// is enabled - so we eliminate the else paths in the conditional tree
-		// below
-		$restorePossible = false;
-
-		if ($this->isEncryptionAppEnabled) {
-			if ($this->isRestoreEnabled) {
-				// check for the users recovery setting
-				$recoveryMode = $this->config->getUserValue($user->getUID(), 'encryption', 'recoveryEnabled', '0');
-				// method call inside empty is possible with PHP 5.5+
-				$recoveryModeEnabled = !empty($recoveryMode);
-				if ($recoveryModeEnabled) {
-					// user also has recovery mode enabled
-					$restorePossible = true;
-				}
-			} else {
-				$modules = $this->encryptionManager->getEncryptionModules();
-				$restorePossible = true;
-				foreach ($modules as $id => $module) {
-					/* @var IEncryptionModule $instance */
-					$instance = call_user_func($module['callback']);
-					if ($instance->needDetailedAccessList()) {
-						$restorePossible = false;
-						break;
-					}
-				}
-			}
-		} else {
-			// recovery is possible if encryption is disabled (plain files are
-			// available)
-			$restorePossible = true;
-		}
-
-		$subAdminGroups = $this->groupManager->getSubAdmin()->getSubAdminsGroups($user);
-		foreach($subAdminGroups as $key => $subAdminGroup) {
-			$subAdminGroups[$key] = $subAdminGroup->getGID();
-		}
-
-		$displayName = $user->getEMailAddress();
-		if (is_null($displayName)) {
-			$displayName = '';
-		}
-
-		$avatarAvailable = false;
-		try {
-			$avatarAvailable = $this->avatarManager->getAvatar($user->getUID())->exists();
-		} catch (\Exception $e) {
-			//No avatar yet
-		}
-
-		return [
-			'name' => $user->getUID(),
-			'displayname' => $user->getDisplayName(),
-			'groups' => (empty($userGroups)) ? $this->groupManager->getUserGroupIds($user) : $userGroups,
-			'subadmin' => $subAdminGroups,
-			'quota' => $user->getQuota(),
-			'storageLocation' => $user->getHome(),
-			'lastLogin' => $user->getLastLogin() * 1000,
-			'backend' => $user->getBackendClassName(),
-			'email' => $displayName,
-			'isRestoreDisabled' => !$restorePossible,
-			'isAvatarAvailable' => $avatarAvailable,
-			'isEnabled' => $user->isEnabled(),
-		];
-	}
-
-	/**
-	 * @param array $userIDs Array with schema [$uid => $displayName]
-	 * @return IUser[]
-	 */
-	private function getUsersForUID(array $userIDs) {
-		$users = [];
-		foreach ($userIDs as $uid => $displayName) {
-			$users[$uid] = $this->userManager->get($uid);
-		}
-		return $users;
-	}
-
-	/**
-	 * @NoAdminRequired
-	 *
-	 * @param int $offset
-	 * @param int $limit
-	 * @param string $gid GID to filter for
-	 * @param string $pattern Pattern to search for in the username
-	 * @param string $backend Backend to filter for (class-name)
-	 * @return DataResponse
-	 *
-	 * TODO: Tidy up and write unit tests - code is mainly static method calls
-	 */
-	public function index($offset = 0, $limit = 10, $gid = '', $pattern = '', $backend = '') {
-		// Remove backends
-		if(!empty($backend)) {
-			$activeBackends = $this->userManager->getBackends();
-			$this->userManager->clearBackends();
-			foreach($activeBackends as $singleActiveBackend) {
-				if($backend === get_class($singleActiveBackend)) {
-					$this->userManager->registerBackend($singleActiveBackend);
-					break;
-				}
-			}
-		}
-
-		$users = [];
-		if ($this->isAdmin) {
-			if($gid !== '' && $gid !== '_disabledUsers') {
-				$batch = $this->getUsersForUID($this->groupManager->displayNamesInGroup($gid, $pattern, $limit, $offset));
-			} else {
-				$batch = $this->userManager->search($pattern, $limit, $offset);
-			}
-
-			foreach ($batch as $user) {
-				if( ($gid !== '_disabledUsers' && $user->isEnabled()) ||
-					($gid === '_disabledUsers' && !$user->isEnabled())
-				) {
-					$users[] = $this->formatUserForIndex($user);
-				}
-			}
-
-		} else {
-			$subAdminOfGroups = $this->groupManager->getSubAdmin()->getSubAdminsGroups($this->userSession->getUser());
-			// New class returns IGroup[] so convert back
-			$gids = [];
-			foreach ($subAdminOfGroups as $group) {
-				$gids[] = $group->getGID();
-			}
-			$subAdminOfGroups = $gids;
-
-			// Set the $gid parameter to an empty value if the subadmin has no rights to access a specific group
-			if($gid !== '' && $gid !== '_disabledUsers' && !in_array($gid, $subAdminOfGroups)) {
-				$gid = '';
-			}
-
-			// Batch all groups the user is subadmin of when a group is specified
-			$batch = [];
-			if($gid === '') {
-				foreach($subAdminOfGroups as $group) {
-					$groupUsers = $this->groupManager->displayNamesInGroup($group, $pattern, $limit, $offset);
-
-					foreach($groupUsers as $uid => $displayName) {
-						$batch[$uid] = $displayName;
-					}
-				}
-			} else {
-				$batch = $this->groupManager->displayNamesInGroup($gid, $pattern, $limit, $offset);
-			}
-			$batch = $this->getUsersForUID($batch);
-
-			foreach ($batch as $user) {
-				// Only add the groups, this user is a subadmin of
-				$userGroups = array_values(array_intersect(
-					$this->groupManager->getUserGroupIds($user),
-					$subAdminOfGroups
-				));
-				if( ($gid !== '_disabledUsers' && $user->isEnabled()) ||
-					($gid === '_disabledUsers' && !$user->isEnabled())
-				) {
-					$users[] = $this->formatUserForIndex($user, $userGroups);
-				}
-			}
-		}
-
-		return new DataResponse($users);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @PasswordConfirmationRequired
-	 *
-	 * @param string $username
-	 * @param string $password
-	 * @param array $groups
-	 * @param string $email
-	 * @return DataResponse
-	 */
-	public function create($username, $password, array $groups=[], $email='') {
-		if($email !== '' && !$this->mailer->validateMailAddress($email)) {
-			return new DataResponse(
-				[
-					'message' => (string)$this->l10n->t('Invalid mail address')
-				],
-				Http::STATUS_UNPROCESSABLE_ENTITY
-			);
-		}
-
-		$currentUser = $this->userSession->getUser();
-
-		if (!$this->isAdmin) {
-			if (!empty($groups)) {
-				foreach ($groups as $key => $group) {
-					$groupObject = $this->groupManager->get($group);
-					if($groupObject === null) {
-						unset($groups[$key]);
-						continue;
-					}
-
-					if (!$this->groupManager->getSubAdmin()->isSubAdminofGroup($currentUser, $groupObject)) {
-						unset($groups[$key]);
-					}
-				}
-			}
-
-			if (empty($groups)) {
-				return new DataResponse(
-					[
-						'message' => $this->l10n->t('No valid group selected'),
-					],
-					Http::STATUS_FORBIDDEN
-				);
-			}
-		}
-
-		if ($this->userManager->userExists($username)) {
-			return new DataResponse(
-				[
-					'message' => (string)$this->l10n->t('A user with that name already exists.')
-				],
-				Http::STATUS_CONFLICT
-			);
-		}
-
-		$generatePasswordResetToken = false;
-		if ($password === '') {
-			if ($email === '') {
-				return new DataResponse(
-					[
-						'message' => (string)$this->l10n->t('To send a password link to the user an email address is required.')
-					],
-					Http::STATUS_UNPROCESSABLE_ENTITY
-				);
-			}
-
-			$password = $this->secureRandom->generate(32);
-			$generatePasswordResetToken = true;
-		}
-
-		try {
-			$user = $this->userManager->createUser($username, $password);
-		} catch (\Exception $exception) {
-			$message = $exception->getMessage();
-			if (!$message) {
-				$message = $this->l10n->t('Unable to create user.');
-			}
-			return new DataResponse(
-				[
-					'message' => (string) $message,
-				],
-				Http::STATUS_FORBIDDEN
-			);
-		}
-
-		if($user instanceof IUser) {
-			if($groups !== null) {
-				foreach($groups as $groupName) {
-					$group = $this->groupManager->get($groupName);
-
-					if(empty($group)) {
-						$group = $this->groupManager->createGroup($groupName);
-					}
-					$group->addUser($user);
-				}
-			}
-			/**
-			 * Send new user mail only if a mail is set
-			 */
-			if($email !== '') {
-				$user->setEMailAddress($email);
-				try {
-					$emailTemplate = $this->newUserMailHelper->generateTemplate($user, $generatePasswordResetToken);
-					$this->newUserMailHelper->sendMail($user, $emailTemplate);
-				} catch(\Exception $e) {
-					$this->log->error("Can't send new user mail to $email: " . $e->getMessage(), ['app' => 'settings']);
-				}
-			}
-			// fetch users groups
-			$userGroups = $this->groupManager->getUserGroupIds($user);
-
-			return new DataResponse(
-				$this->formatUserForIndex($user, $userGroups),
-				Http::STATUS_CREATED
-			);
-		}
-
-		return new DataResponse(
-			[
-				'message' => (string) $this->l10n->t('Unable to create user.')
-			],
-			Http::STATUS_FORBIDDEN
-		);
-
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @PasswordConfirmationRequired
-	 *
-	 * @param string $id
-	 * @return DataResponse
-	 */
-	public function destroy($id) {
-		$userId = $this->userSession->getUser()->getUID();
-		$user = $this->userManager->get($id);
-
-		if($userId === $id) {
-			return new DataResponse(
-				[
-					'status' => 'error',
-					'data' => [
-						'message' => (string) $this->l10n->t('Unable to delete user.')
-					]
-				],
-				Http::STATUS_FORBIDDEN
-			);
-		}
-
-		if(!$this->isAdmin && !$this->groupManager->getSubAdmin()->isUserAccessible($this->userSession->getUser(), $user)) {
-			return new DataResponse(
-				[
-					'status' => 'error',
-					'data' => [
-						'message' => (string)$this->l10n->t('Authentication error')
-					]
-				],
-				Http::STATUS_FORBIDDEN
-			);
-		}
-
-		if($user) {
-			if($user->delete()) {
-				return new DataResponse(
-					[
-						'status' => 'success',
-						'data' => [
-							'username' => $id
-						]
-					],
-					Http::STATUS_NO_CONTENT
-				);
-			}
-		}
-
-		return new DataResponse(
-			[
-				'status' => 'error',
-				'data' => [
-					'message' => (string)$this->l10n->t('Unable to delete user.')
-				]
-			],
-			Http::STATUS_FORBIDDEN
-		);
-	}
-
-	/**
-	 * @NoAdminRequired
-	 *
-	 * @param string $id
-	 * @param int $enabled
-	 * @return DataResponse
-	 */
-	public function setEnabled($id, $enabled) {
-		$enabled = (bool)$enabled;
-		if($enabled) {
-			$errorMsgGeneral = (string) $this->l10n->t('Error while enabling user.');
-		} else {
-			$errorMsgGeneral = (string) $this->l10n->t('Error while disabling user.');
-		}
-
-		$userId = $this->userSession->getUser()->getUID();
-		$user = $this->userManager->get($id);
-
-		if ($userId === $id) {
-			return new DataResponse(
-				[
-					'status' => 'error',
-					'data' => [
-						'message' => $errorMsgGeneral
-					]
-				], Http::STATUS_FORBIDDEN
-			);
-		}
-
-		if($user) {
-			if (!$this->isAdmin && !$this->groupManager->getSubAdmin()->isUserAccessible($this->userSession->getUser(), $user)) {
-				return new DataResponse(
-					[
-						'status' => 'error',
-						'data' => [
-							'message' => (string) $this->l10n->t('Authentication error')
-						]
-					],
-					Http::STATUS_FORBIDDEN
-				);
-			}
-
-			$user->setEnabled($enabled);
-			return new DataResponse(
-				[
-					'status' => 'success',
-					'data' => [
-						'username' => $id,
-						'enabled' => $enabled
-					]
-				]
-			);
-		} else {
-			return new DataResponse(
-				[
-					'status' => 'error',
-					'data' => [
-						'message' => $errorMsgGeneral
-					]
-				],
-				Http::STATUS_FORBIDDEN
-			);
-		}
-
-	}
-
-	/**
-	 * Set the mail address of a user
-	 *
-	 * @NoAdminRequired
-	 * @NoSubadminRequired
-	 * @PasswordConfirmationRequired
-	 *
-	 * @param string $account
-	 * @param bool $onlyVerificationCode only return verification code without updating the data
-	 * @return DataResponse
-	 */
-	public function getVerificationCode($account, $onlyVerificationCode) {
-
-		$user = $this->userSession->getUser();
-
-		if ($user === null) {
-			return new DataResponse([], Http::STATUS_BAD_REQUEST);
-		}
-
-		$accountData = $this->accountManager->getUser($user);
-		$cloudId = $user->getCloudId();
-		$message = "Use my Federated Cloud ID to share with me: " . $cloudId;
-		$signature = $this->signMessage($user, $message);
-
-		$code = $message . ' ' . $signature;
-		$codeMd5 = $message . ' ' . md5($signature);
-
-		switch ($account) {
-			case 'verify-twitter':
-				$accountData[AccountManager::PROPERTY_TWITTER]['verified'] = AccountManager::VERIFICATION_IN_PROGRESS;
-				$msg = $this->l10n->t('In order to verify your Twitter account, post the following tweet on Twitter (please make sure to post it without any line breaks):');
-				$code = $codeMd5;
-				$type = AccountManager::PROPERTY_TWITTER;
-				$data = $accountData[AccountManager::PROPERTY_TWITTER]['value'];
-				$accountData[AccountManager::PROPERTY_TWITTER]['signature'] = $signature;
-				break;
-			case 'verify-website':
-				$accountData[AccountManager::PROPERTY_WEBSITE]['verified'] = AccountManager::VERIFICATION_IN_PROGRESS;
-				$msg = $this->l10n->t('In order to verify your Website, store the following content in your web-root at \'.well-known/CloudIdVerificationCode.txt\' (please make sure that the complete text is in one line):');
-				$type = AccountManager::PROPERTY_WEBSITE;
-				$data = $accountData[AccountManager::PROPERTY_WEBSITE]['value'];
-				$accountData[AccountManager::PROPERTY_WEBSITE]['signature'] = $signature;
-				break;
-			default:
-				return new DataResponse([], Http::STATUS_BAD_REQUEST);
-		}
-
-		if ($onlyVerificationCode === false) {
-			$this->accountManager->updateUser($user, $accountData);
-
-			$this->jobList->add('OC\Settings\BackgroundJobs\VerifyUserData',
-				[
-					'verificationCode' => $code,
-					'data' => $data,
-					'type' => $type,
-					'uid' => $user->getUID(),
-					'try' => 0,
-					'lastRun' => $this->getCurrentTime()
-				]
-			);
-		}
-
-		return new DataResponse(['msg' => $msg, 'code' => $code]);
-	}
-
-	/**
-	 * get current timestamp
-	 *
-	 * @return int
-	 */
-	protected function getCurrentTime() {
-		return time();
-	}
-
-	/**
-	 * sign message with users private key
-	 *
-	 * @param IUser $user
-	 * @param string $message
-	 *
-	 * @return string base64 encoded signature
-	 */
-	protected function signMessage(IUser $user, $message) {
-		$privateKey = $this->keyManager->getKey($user)->getPrivate();
-		openssl_sign(json_encode($message), $signature, $privateKey, OPENSSL_ALGO_SHA512);
-		$signatureBase64 = base64_encode($signature);
-
-		return $signatureBase64;
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @NoSubadminRequired
-	 * @PasswordConfirmationRequired
-	 *
-	 * @param string $avatarScope
-	 * @param string $displayname
-	 * @param string $displaynameScope
-	 * @param string $phone
-	 * @param string $phoneScope
-	 * @param string $email
-	 * @param string $emailScope
-	 * @param string $website
-	 * @param string $websiteScope
-	 * @param string $address
-	 * @param string $addressScope
-	 * @param string $twitter
-	 * @param string $twitterScope
-	 * @return DataResponse
-	 */
-	public function setUserSettings($avatarScope,
-									$displayname,
-									$displaynameScope,
-									$phone,
-									$phoneScope,
-									$email,
-									$emailScope,
-									$website,
-									$websiteScope,
-									$address,
-									$addressScope,
-									$twitter,
-									$twitterScope
-	) {
-
-		if (!empty($email) && !$this->mailer->validateMailAddress($email)) {
-			return new DataResponse(
-				[
-					'status' => 'error',
-					'data' => [
-						'message' => (string) $this->l10n->t('Invalid mail address')
-					]
-				],
-				Http::STATUS_UNPROCESSABLE_ENTITY
-			);
-		}
-
-		$data = [
-			AccountManager::PROPERTY_AVATAR =>  ['scope' => $avatarScope],
-			AccountManager::PROPERTY_DISPLAYNAME => ['value' => $displayname, 'scope' => $displaynameScope],
-			AccountManager::PROPERTY_EMAIL=> ['value' => $email, 'scope' => $emailScope],
-			AccountManager::PROPERTY_WEBSITE => ['value' => $website, 'scope' => $websiteScope],
-			AccountManager::PROPERTY_ADDRESS => ['value' => $address, 'scope' => $addressScope],
-			AccountManager::PROPERTY_PHONE => ['value' => $phone, 'scope' => $phoneScope],
-			AccountManager::PROPERTY_TWITTER => ['value' => $twitter, 'scope' => $twitterScope]
-		];
-
-		$user = $this->userSession->getUser();
-
-		try {
-			$this->saveUserSettings($user, $data);
-			return new DataResponse(
-				[
-					'status' => 'success',
-					'data' => [
-						'userId' => $user->getUID(),
-						'avatarScope' => $avatarScope,
-						'displayname' => $displayname,
-						'displaynameScope' => $displaynameScope,
-						'email' => $email,
-						'emailScope' => $emailScope,
-						'website' => $website,
-						'websiteScope' => $websiteScope,
-						'address' => $address,
-						'addressScope' => $addressScope,
-						'message' => (string) $this->l10n->t('Settings saved')
-					]
-				],
-				Http::STATUS_OK
-			);
-		} catch (ForbiddenException $e) {
-			return new DataResponse([
-				'status' => 'error',
-				'data' => [
-					'message' => $e->getMessage()
-				],
-			]);
-		}
-
-	}
-
-
-	/**
-	 * update account manager with new user data
-	 *
-	 * @param IUser $user
-	 * @param array $data
-	 * @throws ForbiddenException
-	 */
-	protected function saveUserSettings(IUser $user, $data) {
-
-		// keep the user back-end up-to-date with the latest display name and email
-		// address
-		$oldDisplayName = $user->getDisplayName();
-		$oldDisplayName = is_null($oldDisplayName) ? '' : $oldDisplayName;
-		if (isset($data[AccountManager::PROPERTY_DISPLAYNAME]['value'])
-			&& $oldDisplayName !== $data[AccountManager::PROPERTY_DISPLAYNAME]['value']
-		) {
-			$result = $user->setDisplayName($data[AccountManager::PROPERTY_DISPLAYNAME]['value']);
-			if ($result === false) {
-				throw new ForbiddenException($this->l10n->t('Unable to change full name'));
-			}
-		}
-
-		$oldEmailAddress = $user->getEMailAddress();
-		$oldEmailAddress = is_null($oldEmailAddress) ? '' : $oldEmailAddress;
-		if (isset($data[AccountManager::PROPERTY_EMAIL]['value'])
-			&& $oldEmailAddress !== $data[AccountManager::PROPERTY_EMAIL]['value']
-		) {
-			// this is the only permission a backend provides and is also used
-			// for the permission of setting a email address
-			if (!$user->canChangeDisplayName()) {
-				throw new ForbiddenException($this->l10n->t('Unable to change email address'));
-			}
-			$user->setEMailAddress($data[AccountManager::PROPERTY_EMAIL]['value']);
-		}
-
-		$this->accountManager->updateUser($user, $data);
-	}
-
-	/**
-	 * Count all unique users visible for the current admin/subadmin.
-	 *
-	 * @NoAdminRequired
-	 *
-	 * @return DataResponse
-	 */
-	public function stats() {
-		$userCount = 0;
-		if ($this->isAdmin) {
-			$countByBackend = $this->userManager->countUsers();
-
-			if (!empty($countByBackend)) {
-				foreach ($countByBackend as $count) {
-					$userCount += $count;
-				}
-			}
-		} else {
-			$groups = $this->groupManager->getSubAdmin()->getSubAdminsGroups($this->userSession->getUser());
-
-			$uniqueUsers = [];
-			foreach ($groups as $group) {
-				foreach($group->getUsers() as $uid => $displayName) {
-					$uniqueUsers[$uid] = true;
-				}
-			}
-
-			$userCount = count($uniqueUsers);
-		}
-
-		return new DataResponse(
-			[
-				'totalUsers' => $userCount
-			]
-		);
-	}
-
-
-	/**
-	 * Set the displayName of a user
-	 *
-	 * @NoAdminRequired
-	 * @NoSubadminRequired
-	 * @PasswordConfirmationRequired
-	 * @todo merge into saveUserSettings
-	 *
-	 * @param string $username
-	 * @param string $displayName
-	 * @return DataResponse
-	 */
-	public function setDisplayName($username, $displayName) {
-		$currentUser = $this->userSession->getUser();
-		$user = $this->userManager->get($username);
-
-		if ($user === null ||
-			!$user->canChangeDisplayName() ||
-			(
-				!$this->groupManager->isAdmin($currentUser->getUID()) &&
-				!$this->groupManager->getSubAdmin()->isUserAccessible($currentUser, $user) &&
-				$currentUser->getUID() !== $username
-
-			)
-		) {
-			return new DataResponse([
-				'status' => 'error',
-				'data' => [
-					'message' => $this->l10n->t('Authentication error'),
-				],
-			]);
-		}
-
-		$userData = $this->accountManager->getUser($user);
-		$userData[AccountManager::PROPERTY_DISPLAYNAME]['value'] = $displayName;
-
-
-		try {
-			$this->saveUserSettings($user, $userData);
-			return new DataResponse([
-				'status' => 'success',
-				'data' => [
-					'message' => $this->l10n->t('Your full name has been changed.'),
-					'username' => $username,
-					'displayName' => $displayName,
-				],
-			]);
-		} catch (ForbiddenException $e) {
-			return new DataResponse([
-				'status' => 'error',
-				'data' => [
-					'message' => $e->getMessage(),
-					'displayName' => $user->getDisplayName(),
-				],
-			]);
-		}
-	}
-
-	/**
-	 * Set the mail address of a user
-	 *
-	 * @NoAdminRequired
-	 * @NoSubadminRequired
-	 * @PasswordConfirmationRequired
-	 *
-	 * @param string $id
-	 * @param string $mailAddress
-	 * @return DataResponse
-	 */
-	public function setEMailAddress($id, $mailAddress) {
-		$user = $this->userManager->get($id);
-		if (!$this->isAdmin
-			&& !$this->groupManager->getSubAdmin()->isUserAccessible($this->userSession->getUser(), $user)
-		) {
-			return new DataResponse(
-				[
-					'status' => 'error',
-					'data' => [
-						'message' => (string) $this->l10n->t('Forbidden')
-					]
-				],
-				Http::STATUS_FORBIDDEN
-			);
-		}
-
-		if($mailAddress !== '' && !$this->mailer->validateMailAddress($mailAddress)) {
-			return new DataResponse(
-				[
-					'status' => 'error',
-					'data' => [
-						'message' => (string) $this->l10n->t('Invalid mail address')
-					]
-				],
-				Http::STATUS_UNPROCESSABLE_ENTITY
-			);
-		}
-
-		if (!$user) {
-			return new DataResponse(
-				[
-					'status' => 'error',
-					'data' => [
-						'message' => (string) $this->l10n->t('Invalid user')
-					]
-				],
-				Http::STATUS_UNPROCESSABLE_ENTITY
-			);
-		}
-		// this is the only permission a backend provides and is also used
-		// for the permission of setting a email address
-		if (!$user->canChangeDisplayName()) {
-			return new DataResponse(
-				[
-					'status' => 'error',
-					'data' => [
-						'message' => (string) $this->l10n->t('Unable to change mail address')
-					]
-				],
-				Http::STATUS_FORBIDDEN
-			);
-		}
-
-		$userData = $this->accountManager->getUser($user);
-		$userData[AccountManager::PROPERTY_EMAIL]['value'] = $mailAddress;
-
-		try {
-			$this->saveUserSettings($user, $userData);
-			return new DataResponse(
-				[
-					'status' => 'success',
-					'data' => [
-						'username' => $id,
-						'mailAddress' => $mailAddress,
-						'message' => (string) $this->l10n->t('Email saved')
-					]
-				],
-				Http::STATUS_OK
-			);
-		} catch (ForbiddenException $e) {
-			return new DataResponse([
-				'status' => 'error',
-				'data' => [
-					'message' => $e->getMessage()
-				],
-			]);
-		}
-	}
+    /** @var IL10N */
+    private $l10n;
+    /** @var IUserSession */
+    private $userSession;
+    /** @var bool */
+    private $isAdmin;
+    /** @var IUserManager */
+    private $userManager;
+    /** @var IGroupManager */
+    private $groupManager;
+    /** @var IConfig */
+    private $config;
+    /** @var ILogger */
+    private $log;
+    /** @var IMailer */
+    private $mailer;
+    /** @var bool contains the state of the encryption app */
+    private $isEncryptionAppEnabled;
+    /** @var bool contains the state of the admin recovery setting */
+    private $isRestoreEnabled = false;
+    /** @var IAvatarManager */
+    private $avatarManager;
+    /** @var AccountManager */
+    private $accountManager;
+    /** @var ISecureRandom */
+    private $secureRandom;
+    /** @var NewUserMailHelper */
+    private $newUserMailHelper;
+    /** @var ITimeFactory */
+    private $timeFactory;
+    /** @var ICrypto */
+    private $crypto;
+    /** @var Manager */
+    private $keyManager;
+    /** @var IJobList */
+    private $jobList;
+    /** @var IManager */
+    private $encryptionManager;
+
+    /**
+     * @param string $appName
+     * @param IRequest $request
+     * @param IUserManager $userManager
+     * @param IGroupManager $groupManager
+     * @param IUserSession $userSession
+     * @param IConfig $config
+     * @param bool $isAdmin
+     * @param IL10N $l10n
+     * @param ILogger $log
+     * @param IMailer $mailer
+     * @param IURLGenerator $urlGenerator
+     * @param IAppManager $appManager
+     * @param IAvatarManager $avatarManager
+     * @param AccountManager $accountManager
+     * @param ISecureRandom $secureRandom
+     * @param NewUserMailHelper $newUserMailHelper
+     * @param ITimeFactory $timeFactory
+     * @param ICrypto $crypto
+     * @param Manager $keyManager
+     * @param IJobList $jobList
+     * @param IManager $encryptionManager
+     */
+    public function __construct($appName,
+                                IRequest $request,
+                                IUserManager $userManager,
+                                IGroupManager $groupManager,
+                                IUserSession $userSession,
+                                IConfig $config,
+                                $isAdmin,
+                                IL10N $l10n,
+                                ILogger $log,
+                                IMailer $mailer,
+                                IURLGenerator $urlGenerator,
+                                IAppManager $appManager,
+                                IAvatarManager $avatarManager,
+                                AccountManager $accountManager,
+                                ISecureRandom $secureRandom,
+                                NewUserMailHelper $newUserMailHelper,
+                                ITimeFactory $timeFactory,
+                                ICrypto $crypto,
+                                Manager $keyManager,
+                                IJobList $jobList,
+                                IManager $encryptionManager) {
+        parent::__construct($appName, $request);
+        $this->userManager = $userManager;
+        $this->groupManager = $groupManager;
+        $this->userSession = $userSession;
+        $this->config = $config;
+        $this->isAdmin = $isAdmin;
+        $this->l10n = $l10n;
+        $this->log = $log;
+        $this->mailer = $mailer;
+        $this->avatarManager = $avatarManager;
+        $this->accountManager = $accountManager;
+        $this->secureRandom = $secureRandom;
+        $this->newUserMailHelper = $newUserMailHelper;
+        $this->timeFactory = $timeFactory;
+        $this->crypto = $crypto;
+        $this->keyManager = $keyManager;
+        $this->jobList = $jobList;
+        $this->encryptionManager = $encryptionManager;
+
+        // check for encryption state - TODO see formatUserForIndex
+        $this->isEncryptionAppEnabled = $appManager->isEnabledForUser('encryption');
+        if($this->isEncryptionAppEnabled) {
+            // putting this directly in empty is possible in PHP 5.5+
+            $result = $config->getAppValue('encryption', 'recoveryAdminEnabled', 0);
+            $this->isRestoreEnabled = !empty($result);
+        }
+    }
+
+    /**
+     * @param IUser $user
+     * @param array $userGroups
+     * @return array
+     */
+    private function formatUserForIndex(IUser $user, array $userGroups = null) {
+
+        // TODO: eliminate this encryption specific code below and somehow
+        // hook in additional user info from other apps
+
+        // recovery isn't possible if admin or user has it disabled and encryption
+        // is enabled - so we eliminate the else paths in the conditional tree
+        // below
+        $restorePossible = false;
+
+        if ($this->isEncryptionAppEnabled) {
+            if ($this->isRestoreEnabled) {
+                // check for the users recovery setting
+                $recoveryMode = $this->config->getUserValue($user->getUID(), 'encryption', 'recoveryEnabled', '0');
+                // method call inside empty is possible with PHP 5.5+
+                $recoveryModeEnabled = !empty($recoveryMode);
+                if ($recoveryModeEnabled) {
+                    // user also has recovery mode enabled
+                    $restorePossible = true;
+                }
+            } else {
+                $modules = $this->encryptionManager->getEncryptionModules();
+                $restorePossible = true;
+                foreach ($modules as $id => $module) {
+                    /* @var IEncryptionModule $instance */
+                    $instance = call_user_func($module['callback']);
+                    if ($instance->needDetailedAccessList()) {
+                        $restorePossible = false;
+                        break;
+                    }
+                }
+            }
+        } else {
+            // recovery is possible if encryption is disabled (plain files are
+            // available)
+            $restorePossible = true;
+        }
+
+        $subAdminGroups = $this->groupManager->getSubAdmin()->getSubAdminsGroups($user);
+        foreach($subAdminGroups as $key => $subAdminGroup) {
+            $subAdminGroups[$key] = $subAdminGroup->getGID();
+        }
+
+        $displayName = $user->getEMailAddress();
+        if (is_null($displayName)) {
+            $displayName = '';
+        }
+
+        $avatarAvailable = false;
+        try {
+            $avatarAvailable = $this->avatarManager->getAvatar($user->getUID())->exists();
+        } catch (\Exception $e) {
+            //No avatar yet
+        }
+
+        return [
+            'name' => $user->getUID(),
+            'displayname' => $user->getDisplayName(),
+            'groups' => (empty($userGroups)) ? $this->groupManager->getUserGroupIds($user) : $userGroups,
+            'subadmin' => $subAdminGroups,
+            'quota' => $user->getQuota(),
+            'storageLocation' => $user->getHome(),
+            'lastLogin' => $user->getLastLogin() * 1000,
+            'backend' => $user->getBackendClassName(),
+            'email' => $displayName,
+            'isRestoreDisabled' => !$restorePossible,
+            'isAvatarAvailable' => $avatarAvailable,
+            'isEnabled' => $user->isEnabled(),
+        ];
+    }
+
+    /**
+     * @param array $userIDs Array with schema [$uid => $displayName]
+     * @return IUser[]
+     */
+    private function getUsersForUID(array $userIDs) {
+        $users = [];
+        foreach ($userIDs as $uid => $displayName) {
+            $users[$uid] = $this->userManager->get($uid);
+        }
+        return $users;
+    }
+
+    /**
+     * @NoAdminRequired
+     *
+     * @param int $offset
+     * @param int $limit
+     * @param string $gid GID to filter for
+     * @param string $pattern Pattern to search for in the username
+     * @param string $backend Backend to filter for (class-name)
+     * @return DataResponse
+     *
+     * TODO: Tidy up and write unit tests - code is mainly static method calls
+     */
+    public function index($offset = 0, $limit = 10, $gid = '', $pattern = '', $backend = '') {
+        // Remove backends
+        if(!empty($backend)) {
+            $activeBackends = $this->userManager->getBackends();
+            $this->userManager->clearBackends();
+            foreach($activeBackends as $singleActiveBackend) {
+                if($backend === get_class($singleActiveBackend)) {
+                    $this->userManager->registerBackend($singleActiveBackend);
+                    break;
+                }
+            }
+        }
+
+        $users = [];
+        if ($this->isAdmin) {
+            if($gid !== '' && $gid !== '_disabledUsers') {
+                $batch = $this->getUsersForUID($this->groupManager->displayNamesInGroup($gid, $pattern, $limit, $offset));
+            } else {
+                $batch = $this->userManager->search($pattern, $limit, $offset);
+            }
+
+            foreach ($batch as $user) {
+                if( ($gid !== '_disabledUsers' && $user->isEnabled()) ||
+                    ($gid === '_disabledUsers' && !$user->isEnabled())
+                ) {
+                    $users[] = $this->formatUserForIndex($user);
+                }
+            }
+
+        } else {
+            $subAdminOfGroups = $this->groupManager->getSubAdmin()->getSubAdminsGroups($this->userSession->getUser());
+            // New class returns IGroup[] so convert back
+            $gids = [];
+            foreach ($subAdminOfGroups as $group) {
+                $gids[] = $group->getGID();
+            }
+            $subAdminOfGroups = $gids;
+
+            // Set the $gid parameter to an empty value if the subadmin has no rights to access a specific group
+            if($gid !== '' && $gid !== '_disabledUsers' && !in_array($gid, $subAdminOfGroups)) {
+                $gid = '';
+            }
+
+            // Batch all groups the user is subadmin of when a group is specified
+            $batch = [];
+            if($gid === '') {
+                foreach($subAdminOfGroups as $group) {
+                    $groupUsers = $this->groupManager->displayNamesInGroup($group, $pattern, $limit, $offset);
+
+                    foreach($groupUsers as $uid => $displayName) {
+                        $batch[$uid] = $displayName;
+                    }
+                }
+            } else {
+                $batch = $this->groupManager->displayNamesInGroup($gid, $pattern, $limit, $offset);
+            }
+            $batch = $this->getUsersForUID($batch);
+
+            foreach ($batch as $user) {
+                // Only add the groups, this user is a subadmin of
+                $userGroups = array_values(array_intersect(
+                    $this->groupManager->getUserGroupIds($user),
+                    $subAdminOfGroups
+                ));
+                if( ($gid !== '_disabledUsers' && $user->isEnabled()) ||
+                    ($gid === '_disabledUsers' && !$user->isEnabled())
+                ) {
+                    $users[] = $this->formatUserForIndex($user, $userGroups);
+                }
+            }
+        }
+
+        return new DataResponse($users);
+    }
+
+    /**
+     * @NoAdminRequired
+     * @PasswordConfirmationRequired
+     *
+     * @param string $username
+     * @param string $password
+     * @param array $groups
+     * @param string $email
+     * @return DataResponse
+     */
+    public function create($username, $password, array $groups=[], $email='') {
+        if($email !== '' && !$this->mailer->validateMailAddress($email)) {
+            return new DataResponse(
+                [
+                    'message' => (string)$this->l10n->t('Invalid mail address')
+                ],
+                Http::STATUS_UNPROCESSABLE_ENTITY
+            );
+        }
+
+        $currentUser = $this->userSession->getUser();
+
+        if (!$this->isAdmin) {
+            if (!empty($groups)) {
+                foreach ($groups as $key => $group) {
+                    $groupObject = $this->groupManager->get($group);
+                    if($groupObject === null) {
+                        unset($groups[$key]);
+                        continue;
+                    }
+
+                    if (!$this->groupManager->getSubAdmin()->isSubAdminofGroup($currentUser, $groupObject)) {
+                        unset($groups[$key]);
+                    }
+                }
+            }
+
+            if (empty($groups)) {
+                return new DataResponse(
+                    [
+                        'message' => $this->l10n->t('No valid group selected'),
+                    ],
+                    Http::STATUS_FORBIDDEN
+                );
+            }
+        }
+
+        if ($this->userManager->userExists($username)) {
+            return new DataResponse(
+                [
+                    'message' => (string)$this->l10n->t('A user with that name already exists.')
+                ],
+                Http::STATUS_CONFLICT
+            );
+        }
+
+        $generatePasswordResetToken = false;
+        if ($password === '') {
+            if ($email === '') {
+                return new DataResponse(
+                    [
+                        'message' => (string)$this->l10n->t('To send a password link to the user an email address is required.')
+                    ],
+                    Http::STATUS_UNPROCESSABLE_ENTITY
+                );
+            }
+
+            $password = $this->secureRandom->generate(32);
+            $generatePasswordResetToken = true;
+        }
+
+        try {
+            $user = $this->userManager->createUser($username, $password);
+        } catch (\Exception $exception) {
+            $message = $exception->getMessage();
+            if (!$message) {
+                $message = $this->l10n->t('Unable to create user.');
+            }
+            return new DataResponse(
+                [
+                    'message' => (string) $message,
+                ],
+                Http::STATUS_FORBIDDEN
+            );
+        }
+
+        if($user instanceof IUser) {
+            if($groups !== null) {
+                foreach($groups as $groupName) {
+                    $group = $this->groupManager->get($groupName);
+
+                    if(empty($group)) {
+                        $group = $this->groupManager->createGroup($groupName);
+                    }
+                    $group->addUser($user);
+                }
+            }
+            /**
+             * Send new user mail only if a mail is set
+             */
+            if($email !== '') {
+                $user->setEMailAddress($email);
+                try {
+                    $emailTemplate = $this->newUserMailHelper->generateTemplate($user, $generatePasswordResetToken);
+                    $this->newUserMailHelper->sendMail($user, $emailTemplate);
+                } catch(\Exception $e) {
+                    $this->log->error("Can't send new user mail to $email: " . $e->getMessage(), ['app' => 'settings']);
+                }
+            }
+            // fetch users groups
+            $userGroups = $this->groupManager->getUserGroupIds($user);
+
+            return new DataResponse(
+                $this->formatUserForIndex($user, $userGroups),
+                Http::STATUS_CREATED
+            );
+        }
+
+        return new DataResponse(
+            [
+                'message' => (string) $this->l10n->t('Unable to create user.')
+            ],
+            Http::STATUS_FORBIDDEN
+        );
+
+    }
+
+    /**
+     * @NoAdminRequired
+     * @PasswordConfirmationRequired
+     *
+     * @param string $id
+     * @return DataResponse
+     */
+    public function destroy($id) {
+        $userId = $this->userSession->getUser()->getUID();
+        $user = $this->userManager->get($id);
+
+        if($userId === $id) {
+            return new DataResponse(
+                [
+                    'status' => 'error',
+                    'data' => [
+                        'message' => (string) $this->l10n->t('Unable to delete user.')
+                    ]
+                ],
+                Http::STATUS_FORBIDDEN
+            );
+        }
+
+        if(!$this->isAdmin && !$this->groupManager->getSubAdmin()->isUserAccessible($this->userSession->getUser(), $user)) {
+            return new DataResponse(
+                [
+                    'status' => 'error',
+                    'data' => [
+                        'message' => (string)$this->l10n->t('Authentication error')
+                    ]
+                ],
+                Http::STATUS_FORBIDDEN
+            );
+        }
+
+        if($user) {
+            if($user->delete()) {
+                return new DataResponse(
+                    [
+                        'status' => 'success',
+                        'data' => [
+                            'username' => $id
+                        ]
+                    ],
+                    Http::STATUS_NO_CONTENT
+                );
+            }
+        }
+
+        return new DataResponse(
+            [
+                'status' => 'error',
+                'data' => [
+                    'message' => (string)$this->l10n->t('Unable to delete user.')
+                ]
+            ],
+            Http::STATUS_FORBIDDEN
+        );
+    }
+
+    /**
+     * @NoAdminRequired
+     *
+     * @param string $id
+     * @param int $enabled
+     * @return DataResponse
+     */
+    public function setEnabled($id, $enabled) {
+        $enabled = (bool)$enabled;
+        if($enabled) {
+            $errorMsgGeneral = (string) $this->l10n->t('Error while enabling user.');
+        } else {
+            $errorMsgGeneral = (string) $this->l10n->t('Error while disabling user.');
+        }
+
+        $userId = $this->userSession->getUser()->getUID();
+        $user = $this->userManager->get($id);
+
+        if ($userId === $id) {
+            return new DataResponse(
+                [
+                    'status' => 'error',
+                    'data' => [
+                        'message' => $errorMsgGeneral
+                    ]
+                ], Http::STATUS_FORBIDDEN
+            );
+        }
+
+        if($user) {
+            if (!$this->isAdmin && !$this->groupManager->getSubAdmin()->isUserAccessible($this->userSession->getUser(), $user)) {
+                return new DataResponse(
+                    [
+                        'status' => 'error',
+                        'data' => [
+                            'message' => (string) $this->l10n->t('Authentication error')
+                        ]
+                    ],
+                    Http::STATUS_FORBIDDEN
+                );
+            }
+
+            $user->setEnabled($enabled);
+            return new DataResponse(
+                [
+                    'status' => 'success',
+                    'data' => [
+                        'username' => $id,
+                        'enabled' => $enabled
+                    ]
+                ]
+            );
+        } else {
+            return new DataResponse(
+                [
+                    'status' => 'error',
+                    'data' => [
+                        'message' => $errorMsgGeneral
+                    ]
+                ],
+                Http::STATUS_FORBIDDEN
+            );
+        }
+
+    }
+
+    /**
+     * Set the mail address of a user
+     *
+     * @NoAdminRequired
+     * @NoSubadminRequired
+     * @PasswordConfirmationRequired
+     *
+     * @param string $account
+     * @param bool $onlyVerificationCode only return verification code without updating the data
+     * @return DataResponse
+     */
+    public function getVerificationCode($account, $onlyVerificationCode) {
+
+        $user = $this->userSession->getUser();
+
+        if ($user === null) {
+            return new DataResponse([], Http::STATUS_BAD_REQUEST);
+        }
+
+        $accountData = $this->accountManager->getUser($user);
+        $cloudId = $user->getCloudId();
+        $message = "Use my Federated Cloud ID to share with me: " . $cloudId;
+        $signature = $this->signMessage($user, $message);
+
+        $code = $message . ' ' . $signature;
+        $codeMd5 = $message . ' ' . md5($signature);
+
+        switch ($account) {
+            case 'verify-twitter':
+                $accountData[AccountManager::PROPERTY_TWITTER]['verified'] = AccountManager::VERIFICATION_IN_PROGRESS;
+                $msg = $this->l10n->t('In order to verify your Twitter account, post the following tweet on Twitter (please make sure to post it without any line breaks):');
+                $code = $codeMd5;
+                $type = AccountManager::PROPERTY_TWITTER;
+                $data = $accountData[AccountManager::PROPERTY_TWITTER]['value'];
+                $accountData[AccountManager::PROPERTY_TWITTER]['signature'] = $signature;
+                break;
+            case 'verify-website':
+                $accountData[AccountManager::PROPERTY_WEBSITE]['verified'] = AccountManager::VERIFICATION_IN_PROGRESS;
+                $msg = $this->l10n->t('In order to verify your Website, store the following content in your web-root at \'.well-known/CloudIdVerificationCode.txt\' (please make sure that the complete text is in one line):');
+                $type = AccountManager::PROPERTY_WEBSITE;
+                $data = $accountData[AccountManager::PROPERTY_WEBSITE]['value'];
+                $accountData[AccountManager::PROPERTY_WEBSITE]['signature'] = $signature;
+                break;
+            default:
+                return new DataResponse([], Http::STATUS_BAD_REQUEST);
+        }
+
+        if ($onlyVerificationCode === false) {
+            $this->accountManager->updateUser($user, $accountData);
+
+            $this->jobList->add('OC\Settings\BackgroundJobs\VerifyUserData',
+                [
+                    'verificationCode' => $code,
+                    'data' => $data,
+                    'type' => $type,
+                    'uid' => $user->getUID(),
+                    'try' => 0,
+                    'lastRun' => $this->getCurrentTime()
+                ]
+            );
+        }
+
+        return new DataResponse(['msg' => $msg, 'code' => $code]);
+    }
+
+    /**
+     * get current timestamp
+     *
+     * @return int
+     */
+    protected function getCurrentTime() {
+        return time();
+    }
+
+    /**
+     * sign message with users private key
+     *
+     * @param IUser $user
+     * @param string $message
+     *
+     * @return string base64 encoded signature
+     */
+    protected function signMessage(IUser $user, $message) {
+        $privateKey = $this->keyManager->getKey($user)->getPrivate();
+        openssl_sign(json_encode($message), $signature, $privateKey, OPENSSL_ALGO_SHA512);
+        $signatureBase64 = base64_encode($signature);
+
+        return $signatureBase64;
+    }
+
+    /**
+     * @NoAdminRequired
+     * @NoSubadminRequired
+     * @PasswordConfirmationRequired
+     *
+     * @param string $avatarScope
+     * @param string $displayname
+     * @param string $displaynameScope
+     * @param string $phone
+     * @param string $phoneScope
+     * @param string $email
+     * @param string $emailScope
+     * @param string $website
+     * @param string $websiteScope
+     * @param string $address
+     * @param string $addressScope
+     * @param string $twitter
+     * @param string $twitterScope
+     * @return DataResponse
+     */
+    public function setUserSettings($avatarScope,
+                                    $displayname,
+                                    $displaynameScope,
+                                    $phone,
+                                    $phoneScope,
+                                    $email,
+                                    $emailScope,
+                                    $website,
+                                    $websiteScope,
+                                    $address,
+                                    $addressScope,
+                                    $twitter,
+                                    $twitterScope
+    ) {
+
+        if (!empty($email) && !$this->mailer->validateMailAddress($email)) {
+            return new DataResponse(
+                [
+                    'status' => 'error',
+                    'data' => [
+                        'message' => (string) $this->l10n->t('Invalid mail address')
+                    ]
+                ],
+                Http::STATUS_UNPROCESSABLE_ENTITY
+            );
+        }
+
+        $data = [
+            AccountManager::PROPERTY_AVATAR =>  ['scope' => $avatarScope],
+            AccountManager::PROPERTY_DISPLAYNAME => ['value' => $displayname, 'scope' => $displaynameScope],
+            AccountManager::PROPERTY_EMAIL=> ['value' => $email, 'scope' => $emailScope],
+            AccountManager::PROPERTY_WEBSITE => ['value' => $website, 'scope' => $websiteScope],
+            AccountManager::PROPERTY_ADDRESS => ['value' => $address, 'scope' => $addressScope],
+            AccountManager::PROPERTY_PHONE => ['value' => $phone, 'scope' => $phoneScope],
+            AccountManager::PROPERTY_TWITTER => ['value' => $twitter, 'scope' => $twitterScope]
+        ];
+
+        $user = $this->userSession->getUser();
+
+        try {
+            $this->saveUserSettings($user, $data);
+            return new DataResponse(
+                [
+                    'status' => 'success',
+                    'data' => [
+                        'userId' => $user->getUID(),
+                        'avatarScope' => $avatarScope,
+                        'displayname' => $displayname,
+                        'displaynameScope' => $displaynameScope,
+                        'email' => $email,
+                        'emailScope' => $emailScope,
+                        'website' => $website,
+                        'websiteScope' => $websiteScope,
+                        'address' => $address,
+                        'addressScope' => $addressScope,
+                        'message' => (string) $this->l10n->t('Settings saved')
+                    ]
+                ],
+                Http::STATUS_OK
+            );
+        } catch (ForbiddenException $e) {
+            return new DataResponse([
+                'status' => 'error',
+                'data' => [
+                    'message' => $e->getMessage()
+                ],
+            ]);
+        }
+
+    }
+
+
+    /**
+     * update account manager with new user data
+     *
+     * @param IUser $user
+     * @param array $data
+     * @throws ForbiddenException
+     */
+    protected function saveUserSettings(IUser $user, $data) {
+
+        // keep the user back-end up-to-date with the latest display name and email
+        // address
+        $oldDisplayName = $user->getDisplayName();
+        $oldDisplayName = is_null($oldDisplayName) ? '' : $oldDisplayName;
+        if (isset($data[AccountManager::PROPERTY_DISPLAYNAME]['value'])
+            && $oldDisplayName !== $data[AccountManager::PROPERTY_DISPLAYNAME]['value']
+        ) {
+            $result = $user->setDisplayName($data[AccountManager::PROPERTY_DISPLAYNAME]['value']);
+            if ($result === false) {
+                throw new ForbiddenException($this->l10n->t('Unable to change full name'));
+            }
+        }
+
+        $oldEmailAddress = $user->getEMailAddress();
+        $oldEmailAddress = is_null($oldEmailAddress) ? '' : $oldEmailAddress;
+        if (isset($data[AccountManager::PROPERTY_EMAIL]['value'])
+            && $oldEmailAddress !== $data[AccountManager::PROPERTY_EMAIL]['value']
+        ) {
+            // this is the only permission a backend provides and is also used
+            // for the permission of setting a email address
+            if (!$user->canChangeDisplayName()) {
+                throw new ForbiddenException($this->l10n->t('Unable to change email address'));
+            }
+            $user->setEMailAddress($data[AccountManager::PROPERTY_EMAIL]['value']);
+        }
+
+        $this->accountManager->updateUser($user, $data);
+    }
+
+    /**
+     * Count all unique users visible for the current admin/subadmin.
+     *
+     * @NoAdminRequired
+     *
+     * @return DataResponse
+     */
+    public function stats() {
+        $userCount = 0;
+        if ($this->isAdmin) {
+            $countByBackend = $this->userManager->countUsers();
+
+            if (!empty($countByBackend)) {
+                foreach ($countByBackend as $count) {
+                    $userCount += $count;
+                }
+            }
+        } else {
+            $groups = $this->groupManager->getSubAdmin()->getSubAdminsGroups($this->userSession->getUser());
+
+            $uniqueUsers = [];
+            foreach ($groups as $group) {
+                foreach($group->getUsers() as $uid => $displayName) {
+                    $uniqueUsers[$uid] = true;
+                }
+            }
+
+            $userCount = count($uniqueUsers);
+        }
+
+        return new DataResponse(
+            [
+                'totalUsers' => $userCount
+            ]
+        );
+    }
+
+
+    /**
+     * Set the displayName of a user
+     *
+     * @NoAdminRequired
+     * @NoSubadminRequired
+     * @PasswordConfirmationRequired
+     * @todo merge into saveUserSettings
+     *
+     * @param string $username
+     * @param string $displayName
+     * @return DataResponse
+     */
+    public function setDisplayName($username, $displayName) {
+        $currentUser = $this->userSession->getUser();
+        $user = $this->userManager->get($username);
+
+        if ($user === null ||
+            !$user->canChangeDisplayName() ||
+            (
+                !$this->groupManager->isAdmin($currentUser->getUID()) &&
+                !$this->groupManager->getSubAdmin()->isUserAccessible($currentUser, $user) &&
+                $currentUser->getUID() !== $username
+
+            )
+        ) {
+            return new DataResponse([
+                'status' => 'error',
+                'data' => [
+                    'message' => $this->l10n->t('Authentication error'),
+                ],
+            ]);
+        }
+
+        $userData = $this->accountManager->getUser($user);
+        $userData[AccountManager::PROPERTY_DISPLAYNAME]['value'] = $displayName;
+
+
+        try {
+            $this->saveUserSettings($user, $userData);
+            return new DataResponse([
+                'status' => 'success',
+                'data' => [
+                    'message' => $this->l10n->t('Your full name has been changed.'),
+                    'username' => $username,
+                    'displayName' => $displayName,
+                ],
+            ]);
+        } catch (ForbiddenException $e) {
+            return new DataResponse([
+                'status' => 'error',
+                'data' => [
+                    'message' => $e->getMessage(),
+                    'displayName' => $user->getDisplayName(),
+                ],
+            ]);
+        }
+    }
+
+    /**
+     * Set the mail address of a user
+     *
+     * @NoAdminRequired
+     * @NoSubadminRequired
+     * @PasswordConfirmationRequired
+     *
+     * @param string $id
+     * @param string $mailAddress
+     * @return DataResponse
+     */
+    public function setEMailAddress($id, $mailAddress) {
+        $user = $this->userManager->get($id);
+        if (!$this->isAdmin
+            && !$this->groupManager->getSubAdmin()->isUserAccessible($this->userSession->getUser(), $user)
+        ) {
+            return new DataResponse(
+                [
+                    'status' => 'error',
+                    'data' => [
+                        'message' => (string) $this->l10n->t('Forbidden')
+                    ]
+                ],
+                Http::STATUS_FORBIDDEN
+            );
+        }
+
+        if($mailAddress !== '' && !$this->mailer->validateMailAddress($mailAddress)) {
+            return new DataResponse(
+                [
+                    'status' => 'error',
+                    'data' => [
+                        'message' => (string) $this->l10n->t('Invalid mail address')
+                    ]
+                ],
+                Http::STATUS_UNPROCESSABLE_ENTITY
+            );
+        }
+
+        if (!$user) {
+            return new DataResponse(
+                [
+                    'status' => 'error',
+                    'data' => [
+                        'message' => (string) $this->l10n->t('Invalid user')
+                    ]
+                ],
+                Http::STATUS_UNPROCESSABLE_ENTITY
+            );
+        }
+        // this is the only permission a backend provides and is also used
+        // for the permission of setting a email address
+        if (!$user->canChangeDisplayName()) {
+            return new DataResponse(
+                [
+                    'status' => 'error',
+                    'data' => [
+                        'message' => (string) $this->l10n->t('Unable to change mail address')
+                    ]
+                ],
+                Http::STATUS_FORBIDDEN
+            );
+        }
+
+        $userData = $this->accountManager->getUser($user);
+        $userData[AccountManager::PROPERTY_EMAIL]['value'] = $mailAddress;
+
+        try {
+            $this->saveUserSettings($user, $userData);
+            return new DataResponse(
+                [
+                    'status' => 'success',
+                    'data' => [
+                        'username' => $id,
+                        'mailAddress' => $mailAddress,
+                        'message' => (string) $this->l10n->t('Email saved')
+                    ]
+                ],
+                Http::STATUS_OK
+            );
+        } catch (ForbiddenException $e) {
+            return new DataResponse([
+                'status' => 'error',
+                'data' => [
+                    'message' => $e->getMessage()
+                ],
+            ]);
+        }
+    }
 
 }