@@ -28,14 +28,14 @@ |
||
| 28 | 28 | |
| 29 | 29 | class PrivateKeyMissingException extends GenericEncryptionException { |
| 30 | 30 | |
| 31 | - /** |
|
| 32 | - * @param string $userId |
|
| 33 | - */ |
|
| 34 | - public function __construct($userId) { |
|
| 35 | - if(empty($userId)) { |
|
| 36 | - $userId = "<no-user-id-given>"; |
|
| 37 | - } |
|
| 38 | - parent::__construct("Private Key missing for user: $userId"); |
|
| 39 | - } |
|
| 31 | + /** |
|
| 32 | + * @param string $userId |
|
| 33 | + */ |
|
| 34 | + public function __construct($userId) { |
|
| 35 | + if(empty($userId)) { |
|
| 36 | + $userId = "<no-user-id-given>"; |
|
| 37 | + } |
|
| 38 | + parent::__construct("Private Key missing for user: $userId"); |
|
| 39 | + } |
|
| 40 | 40 | |
| 41 | 41 | } |
@@ -32,7 +32,7 @@ |
||
| 32 | 32 | * @param string $userId |
| 33 | 33 | */ |
| 34 | 34 | public function __construct($userId) { |
| 35 | - if(empty($userId)) { |
|
| 35 | + if (empty($userId)) { |
|
| 36 | 36 | $userId = "<no-user-id-given>"; |
| 37 | 37 | } |
| 38 | 38 | parent::__construct("Private Key missing for user: $userId"); |
@@ -38,293 +38,293 @@ |
||
| 38 | 38 | class Recovery { |
| 39 | 39 | |
| 40 | 40 | |
| 41 | - /** |
|
| 42 | - * @var null|IUser |
|
| 43 | - */ |
|
| 44 | - protected $user; |
|
| 45 | - /** |
|
| 46 | - * @var Crypt |
|
| 47 | - */ |
|
| 48 | - protected $crypt; |
|
| 49 | - /** |
|
| 50 | - * @var ISecureRandom |
|
| 51 | - */ |
|
| 52 | - private $random; |
|
| 53 | - /** |
|
| 54 | - * @var KeyManager |
|
| 55 | - */ |
|
| 56 | - private $keyManager; |
|
| 57 | - /** |
|
| 58 | - * @var IConfig |
|
| 59 | - */ |
|
| 60 | - private $config; |
|
| 61 | - /** |
|
| 62 | - * @var IStorage |
|
| 63 | - */ |
|
| 64 | - private $keyStorage; |
|
| 65 | - /** |
|
| 66 | - * @var View |
|
| 67 | - */ |
|
| 68 | - private $view; |
|
| 69 | - /** |
|
| 70 | - * @var IFile |
|
| 71 | - */ |
|
| 72 | - private $file; |
|
| 73 | - |
|
| 74 | - /** |
|
| 75 | - * @param IUserSession $user |
|
| 76 | - * @param Crypt $crypt |
|
| 77 | - * @param ISecureRandom $random |
|
| 78 | - * @param KeyManager $keyManager |
|
| 79 | - * @param IConfig $config |
|
| 80 | - * @param IStorage $keyStorage |
|
| 81 | - * @param IFile $file |
|
| 82 | - * @param View $view |
|
| 83 | - */ |
|
| 84 | - public function __construct(IUserSession $user, |
|
| 85 | - Crypt $crypt, |
|
| 86 | - ISecureRandom $random, |
|
| 87 | - KeyManager $keyManager, |
|
| 88 | - IConfig $config, |
|
| 89 | - IStorage $keyStorage, |
|
| 90 | - IFile $file, |
|
| 91 | - View $view) { |
|
| 92 | - $this->user = ($user && $user->isLoggedIn()) ? $user->getUser() : false; |
|
| 93 | - $this->crypt = $crypt; |
|
| 94 | - $this->random = $random; |
|
| 95 | - $this->keyManager = $keyManager; |
|
| 96 | - $this->config = $config; |
|
| 97 | - $this->keyStorage = $keyStorage; |
|
| 98 | - $this->view = $view; |
|
| 99 | - $this->file = $file; |
|
| 100 | - } |
|
| 101 | - |
|
| 102 | - /** |
|
| 103 | - * @param string $password |
|
| 104 | - * @return bool |
|
| 105 | - */ |
|
| 106 | - public function enableAdminRecovery($password) { |
|
| 107 | - $appConfig = $this->config; |
|
| 108 | - $keyManager = $this->keyManager; |
|
| 109 | - |
|
| 110 | - if (!$keyManager->recoveryKeyExists()) { |
|
| 111 | - $keyPair = $this->crypt->createKeyPair(); |
|
| 112 | - if(!is_array($keyPair)) { |
|
| 113 | - return false; |
|
| 114 | - } |
|
| 115 | - |
|
| 116 | - $this->keyManager->setRecoveryKey($password, $keyPair); |
|
| 117 | - } |
|
| 118 | - |
|
| 119 | - if ($keyManager->checkRecoveryPassword($password)) { |
|
| 120 | - $appConfig->setAppValue('encryption', 'recoveryAdminEnabled', 1); |
|
| 121 | - return true; |
|
| 122 | - } |
|
| 123 | - |
|
| 124 | - return false; |
|
| 125 | - } |
|
| 126 | - |
|
| 127 | - /** |
|
| 128 | - * change recovery key id |
|
| 129 | - * |
|
| 130 | - * @param string $newPassword |
|
| 131 | - * @param string $oldPassword |
|
| 132 | - * @return bool |
|
| 133 | - */ |
|
| 134 | - public function changeRecoveryKeyPassword($newPassword, $oldPassword) { |
|
| 135 | - $recoveryKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId()); |
|
| 136 | - $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $oldPassword); |
|
| 137 | - if($decryptedRecoveryKey === false) { |
|
| 138 | - return false; |
|
| 139 | - } |
|
| 140 | - $encryptedRecoveryKey = $this->crypt->encryptPrivateKey($decryptedRecoveryKey, $newPassword); |
|
| 141 | - $header = $this->crypt->generateHeader(); |
|
| 142 | - if ($encryptedRecoveryKey) { |
|
| 143 | - $this->keyManager->setSystemPrivateKey($this->keyManager->getRecoveryKeyId(), $header . $encryptedRecoveryKey); |
|
| 144 | - return true; |
|
| 145 | - } |
|
| 146 | - return false; |
|
| 147 | - } |
|
| 148 | - |
|
| 149 | - /** |
|
| 150 | - * @param string $recoveryPassword |
|
| 151 | - * @return bool |
|
| 152 | - */ |
|
| 153 | - public function disableAdminRecovery($recoveryPassword) { |
|
| 154 | - $keyManager = $this->keyManager; |
|
| 155 | - |
|
| 156 | - if ($keyManager->checkRecoveryPassword($recoveryPassword)) { |
|
| 157 | - // Set recoveryAdmin as disabled |
|
| 158 | - $this->config->setAppValue('encryption', 'recoveryAdminEnabled', 0); |
|
| 159 | - return true; |
|
| 160 | - } |
|
| 161 | - return false; |
|
| 162 | - } |
|
| 163 | - |
|
| 164 | - /** |
|
| 165 | - * check if recovery is enabled for user |
|
| 166 | - * |
|
| 167 | - * @param string $user if no user is given we check the current logged-in user |
|
| 168 | - * |
|
| 169 | - * @return bool |
|
| 170 | - */ |
|
| 171 | - public function isRecoveryEnabledForUser($user = '') { |
|
| 172 | - $uid = empty($user) ? $this->user->getUID() : $user; |
|
| 173 | - $recoveryMode = $this->config->getUserValue($uid, |
|
| 174 | - 'encryption', |
|
| 175 | - 'recoveryEnabled', |
|
| 176 | - 0); |
|
| 177 | - |
|
| 178 | - return ($recoveryMode === '1'); |
|
| 179 | - } |
|
| 180 | - |
|
| 181 | - /** |
|
| 182 | - * check if recovery is key is enabled by the administrator |
|
| 183 | - * |
|
| 184 | - * @return bool |
|
| 185 | - */ |
|
| 186 | - public function isRecoveryKeyEnabled() { |
|
| 187 | - $enabled = $this->config->getAppValue('encryption', 'recoveryAdminEnabled', 0); |
|
| 188 | - |
|
| 189 | - return ($enabled === '1'); |
|
| 190 | - } |
|
| 191 | - |
|
| 192 | - /** |
|
| 193 | - * @param string $value |
|
| 194 | - * @return bool |
|
| 195 | - */ |
|
| 196 | - public function setRecoveryForUser($value) { |
|
| 197 | - |
|
| 198 | - try { |
|
| 199 | - $this->config->setUserValue($this->user->getUID(), |
|
| 200 | - 'encryption', |
|
| 201 | - 'recoveryEnabled', |
|
| 202 | - $value); |
|
| 203 | - |
|
| 204 | - if ($value === '1') { |
|
| 205 | - $this->addRecoveryKeys('/' . $this->user->getUID() . '/files/'); |
|
| 206 | - } else { |
|
| 207 | - $this->removeRecoveryKeys('/' . $this->user->getUID() . '/files/'); |
|
| 208 | - } |
|
| 209 | - |
|
| 210 | - return true; |
|
| 211 | - } catch (PreConditionNotMetException $e) { |
|
| 212 | - return false; |
|
| 213 | - } |
|
| 214 | - } |
|
| 215 | - |
|
| 216 | - /** |
|
| 217 | - * add recovery key to all encrypted files |
|
| 218 | - * @param string $path |
|
| 219 | - */ |
|
| 220 | - private function addRecoveryKeys($path) { |
|
| 221 | - $dirContent = $this->view->getDirectoryContent($path); |
|
| 222 | - foreach ($dirContent as $item) { |
|
| 223 | - $filePath = $item->getPath(); |
|
| 224 | - if ($item['type'] === 'dir') { |
|
| 225 | - $this->addRecoveryKeys($filePath . '/'); |
|
| 226 | - } else { |
|
| 227 | - $fileKey = $this->keyManager->getFileKey($filePath, $this->user->getUID()); |
|
| 228 | - if (!empty($fileKey)) { |
|
| 229 | - $accessList = $this->file->getAccessList($filePath); |
|
| 230 | - $publicKeys = array(); |
|
| 231 | - foreach ($accessList['users'] as $uid) { |
|
| 232 | - $publicKeys[$uid] = $this->keyManager->getPublicKey($uid); |
|
| 233 | - } |
|
| 234 | - |
|
| 235 | - $publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $this->user->getUID()); |
|
| 236 | - |
|
| 237 | - $encryptedKeyfiles = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys); |
|
| 238 | - $this->keyManager->setAllFileKeys($filePath, $encryptedKeyfiles); |
|
| 239 | - } |
|
| 240 | - } |
|
| 241 | - } |
|
| 242 | - } |
|
| 243 | - |
|
| 244 | - /** |
|
| 245 | - * remove recovery key to all encrypted files |
|
| 246 | - * @param string $path |
|
| 247 | - */ |
|
| 248 | - private function removeRecoveryKeys($path) { |
|
| 249 | - $dirContent = $this->view->getDirectoryContent($path); |
|
| 250 | - foreach ($dirContent as $item) { |
|
| 251 | - $filePath = $item->getPath(); |
|
| 252 | - if ($item['type'] === 'dir') { |
|
| 253 | - $this->removeRecoveryKeys($filePath . '/'); |
|
| 254 | - } else { |
|
| 255 | - $this->keyManager->deleteShareKey($filePath, $this->keyManager->getRecoveryKeyId()); |
|
| 256 | - } |
|
| 257 | - } |
|
| 258 | - } |
|
| 259 | - |
|
| 260 | - /** |
|
| 261 | - * recover users files with the recovery key |
|
| 262 | - * |
|
| 263 | - * @param string $recoveryPassword |
|
| 264 | - * @param string $user |
|
| 265 | - */ |
|
| 266 | - public function recoverUsersFiles($recoveryPassword, $user) { |
|
| 267 | - $encryptedKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId()); |
|
| 268 | - |
|
| 269 | - $privateKey = $this->crypt->decryptPrivateKey($encryptedKey, $recoveryPassword); |
|
| 270 | - if($privateKey !== false) { |
|
| 271 | - $this->recoverAllFiles('/' . $user . '/files/', $privateKey, $user); |
|
| 272 | - } |
|
| 273 | - } |
|
| 274 | - |
|
| 275 | - /** |
|
| 276 | - * recover users files |
|
| 277 | - * |
|
| 278 | - * @param string $path |
|
| 279 | - * @param string $privateKey |
|
| 280 | - * @param string $uid |
|
| 281 | - */ |
|
| 282 | - private function recoverAllFiles($path, $privateKey, $uid) { |
|
| 283 | - $dirContent = $this->view->getDirectoryContent($path); |
|
| 284 | - |
|
| 285 | - foreach ($dirContent as $item) { |
|
| 286 | - // Get relative path from encryption/keyfiles |
|
| 287 | - $filePath = $item->getPath(); |
|
| 288 | - if ($this->view->is_dir($filePath)) { |
|
| 289 | - $this->recoverAllFiles($filePath . '/', $privateKey, $uid); |
|
| 290 | - } else { |
|
| 291 | - $this->recoverFile($filePath, $privateKey, $uid); |
|
| 292 | - } |
|
| 293 | - } |
|
| 294 | - |
|
| 295 | - } |
|
| 296 | - |
|
| 297 | - /** |
|
| 298 | - * recover file |
|
| 299 | - * |
|
| 300 | - * @param string $path |
|
| 301 | - * @param string $privateKey |
|
| 302 | - * @param string $uid |
|
| 303 | - */ |
|
| 304 | - private function recoverFile($path, $privateKey, $uid) { |
|
| 305 | - $encryptedFileKey = $this->keyManager->getEncryptedFileKey($path); |
|
| 306 | - $shareKey = $this->keyManager->getShareKey($path, $this->keyManager->getRecoveryKeyId()); |
|
| 307 | - |
|
| 308 | - if ($encryptedFileKey && $shareKey && $privateKey) { |
|
| 309 | - $fileKey = $this->crypt->multiKeyDecrypt($encryptedFileKey, |
|
| 310 | - $shareKey, |
|
| 311 | - $privateKey); |
|
| 312 | - } |
|
| 313 | - |
|
| 314 | - if (!empty($fileKey)) { |
|
| 315 | - $accessList = $this->file->getAccessList($path); |
|
| 316 | - $publicKeys = array(); |
|
| 317 | - foreach ($accessList['users'] as $user) { |
|
| 318 | - $publicKeys[$user] = $this->keyManager->getPublicKey($user); |
|
| 319 | - } |
|
| 320 | - |
|
| 321 | - $publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $uid); |
|
| 322 | - |
|
| 323 | - $encryptedKeyfiles = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys); |
|
| 324 | - $this->keyManager->setAllFileKeys($path, $encryptedKeyfiles); |
|
| 325 | - } |
|
| 326 | - |
|
| 327 | - } |
|
| 41 | + /** |
|
| 42 | + * @var null|IUser |
|
| 43 | + */ |
|
| 44 | + protected $user; |
|
| 45 | + /** |
|
| 46 | + * @var Crypt |
|
| 47 | + */ |
|
| 48 | + protected $crypt; |
|
| 49 | + /** |
|
| 50 | + * @var ISecureRandom |
|
| 51 | + */ |
|
| 52 | + private $random; |
|
| 53 | + /** |
|
| 54 | + * @var KeyManager |
|
| 55 | + */ |
|
| 56 | + private $keyManager; |
|
| 57 | + /** |
|
| 58 | + * @var IConfig |
|
| 59 | + */ |
|
| 60 | + private $config; |
|
| 61 | + /** |
|
| 62 | + * @var IStorage |
|
| 63 | + */ |
|
| 64 | + private $keyStorage; |
|
| 65 | + /** |
|
| 66 | + * @var View |
|
| 67 | + */ |
|
| 68 | + private $view; |
|
| 69 | + /** |
|
| 70 | + * @var IFile |
|
| 71 | + */ |
|
| 72 | + private $file; |
|
| 73 | + |
|
| 74 | + /** |
|
| 75 | + * @param IUserSession $user |
|
| 76 | + * @param Crypt $crypt |
|
| 77 | + * @param ISecureRandom $random |
|
| 78 | + * @param KeyManager $keyManager |
|
| 79 | + * @param IConfig $config |
|
| 80 | + * @param IStorage $keyStorage |
|
| 81 | + * @param IFile $file |
|
| 82 | + * @param View $view |
|
| 83 | + */ |
|
| 84 | + public function __construct(IUserSession $user, |
|
| 85 | + Crypt $crypt, |
|
| 86 | + ISecureRandom $random, |
|
| 87 | + KeyManager $keyManager, |
|
| 88 | + IConfig $config, |
|
| 89 | + IStorage $keyStorage, |
|
| 90 | + IFile $file, |
|
| 91 | + View $view) { |
|
| 92 | + $this->user = ($user && $user->isLoggedIn()) ? $user->getUser() : false; |
|
| 93 | + $this->crypt = $crypt; |
|
| 94 | + $this->random = $random; |
|
| 95 | + $this->keyManager = $keyManager; |
|
| 96 | + $this->config = $config; |
|
| 97 | + $this->keyStorage = $keyStorage; |
|
| 98 | + $this->view = $view; |
|
| 99 | + $this->file = $file; |
|
| 100 | + } |
|
| 101 | + |
|
| 102 | + /** |
|
| 103 | + * @param string $password |
|
| 104 | + * @return bool |
|
| 105 | + */ |
|
| 106 | + public function enableAdminRecovery($password) { |
|
| 107 | + $appConfig = $this->config; |
|
| 108 | + $keyManager = $this->keyManager; |
|
| 109 | + |
|
| 110 | + if (!$keyManager->recoveryKeyExists()) { |
|
| 111 | + $keyPair = $this->crypt->createKeyPair(); |
|
| 112 | + if(!is_array($keyPair)) { |
|
| 113 | + return false; |
|
| 114 | + } |
|
| 115 | + |
|
| 116 | + $this->keyManager->setRecoveryKey($password, $keyPair); |
|
| 117 | + } |
|
| 118 | + |
|
| 119 | + if ($keyManager->checkRecoveryPassword($password)) { |
|
| 120 | + $appConfig->setAppValue('encryption', 'recoveryAdminEnabled', 1); |
|
| 121 | + return true; |
|
| 122 | + } |
|
| 123 | + |
|
| 124 | + return false; |
|
| 125 | + } |
|
| 126 | + |
|
| 127 | + /** |
|
| 128 | + * change recovery key id |
|
| 129 | + * |
|
| 130 | + * @param string $newPassword |
|
| 131 | + * @param string $oldPassword |
|
| 132 | + * @return bool |
|
| 133 | + */ |
|
| 134 | + public function changeRecoveryKeyPassword($newPassword, $oldPassword) { |
|
| 135 | + $recoveryKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId()); |
|
| 136 | + $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $oldPassword); |
|
| 137 | + if($decryptedRecoveryKey === false) { |
|
| 138 | + return false; |
|
| 139 | + } |
|
| 140 | + $encryptedRecoveryKey = $this->crypt->encryptPrivateKey($decryptedRecoveryKey, $newPassword); |
|
| 141 | + $header = $this->crypt->generateHeader(); |
|
| 142 | + if ($encryptedRecoveryKey) { |
|
| 143 | + $this->keyManager->setSystemPrivateKey($this->keyManager->getRecoveryKeyId(), $header . $encryptedRecoveryKey); |
|
| 144 | + return true; |
|
| 145 | + } |
|
| 146 | + return false; |
|
| 147 | + } |
|
| 148 | + |
|
| 149 | + /** |
|
| 150 | + * @param string $recoveryPassword |
|
| 151 | + * @return bool |
|
| 152 | + */ |
|
| 153 | + public function disableAdminRecovery($recoveryPassword) { |
|
| 154 | + $keyManager = $this->keyManager; |
|
| 155 | + |
|
| 156 | + if ($keyManager->checkRecoveryPassword($recoveryPassword)) { |
|
| 157 | + // Set recoveryAdmin as disabled |
|
| 158 | + $this->config->setAppValue('encryption', 'recoveryAdminEnabled', 0); |
|
| 159 | + return true; |
|
| 160 | + } |
|
| 161 | + return false; |
|
| 162 | + } |
|
| 163 | + |
|
| 164 | + /** |
|
| 165 | + * check if recovery is enabled for user |
|
| 166 | + * |
|
| 167 | + * @param string $user if no user is given we check the current logged-in user |
|
| 168 | + * |
|
| 169 | + * @return bool |
|
| 170 | + */ |
|
| 171 | + public function isRecoveryEnabledForUser($user = '') { |
|
| 172 | + $uid = empty($user) ? $this->user->getUID() : $user; |
|
| 173 | + $recoveryMode = $this->config->getUserValue($uid, |
|
| 174 | + 'encryption', |
|
| 175 | + 'recoveryEnabled', |
|
| 176 | + 0); |
|
| 177 | + |
|
| 178 | + return ($recoveryMode === '1'); |
|
| 179 | + } |
|
| 180 | + |
|
| 181 | + /** |
|
| 182 | + * check if recovery is key is enabled by the administrator |
|
| 183 | + * |
|
| 184 | + * @return bool |
|
| 185 | + */ |
|
| 186 | + public function isRecoveryKeyEnabled() { |
|
| 187 | + $enabled = $this->config->getAppValue('encryption', 'recoveryAdminEnabled', 0); |
|
| 188 | + |
|
| 189 | + return ($enabled === '1'); |
|
| 190 | + } |
|
| 191 | + |
|
| 192 | + /** |
|
| 193 | + * @param string $value |
|
| 194 | + * @return bool |
|
| 195 | + */ |
|
| 196 | + public function setRecoveryForUser($value) { |
|
| 197 | + |
|
| 198 | + try { |
|
| 199 | + $this->config->setUserValue($this->user->getUID(), |
|
| 200 | + 'encryption', |
|
| 201 | + 'recoveryEnabled', |
|
| 202 | + $value); |
|
| 203 | + |
|
| 204 | + if ($value === '1') { |
|
| 205 | + $this->addRecoveryKeys('/' . $this->user->getUID() . '/files/'); |
|
| 206 | + } else { |
|
| 207 | + $this->removeRecoveryKeys('/' . $this->user->getUID() . '/files/'); |
|
| 208 | + } |
|
| 209 | + |
|
| 210 | + return true; |
|
| 211 | + } catch (PreConditionNotMetException $e) { |
|
| 212 | + return false; |
|
| 213 | + } |
|
| 214 | + } |
|
| 215 | + |
|
| 216 | + /** |
|
| 217 | + * add recovery key to all encrypted files |
|
| 218 | + * @param string $path |
|
| 219 | + */ |
|
| 220 | + private function addRecoveryKeys($path) { |
|
| 221 | + $dirContent = $this->view->getDirectoryContent($path); |
|
| 222 | + foreach ($dirContent as $item) { |
|
| 223 | + $filePath = $item->getPath(); |
|
| 224 | + if ($item['type'] === 'dir') { |
|
| 225 | + $this->addRecoveryKeys($filePath . '/'); |
|
| 226 | + } else { |
|
| 227 | + $fileKey = $this->keyManager->getFileKey($filePath, $this->user->getUID()); |
|
| 228 | + if (!empty($fileKey)) { |
|
| 229 | + $accessList = $this->file->getAccessList($filePath); |
|
| 230 | + $publicKeys = array(); |
|
| 231 | + foreach ($accessList['users'] as $uid) { |
|
| 232 | + $publicKeys[$uid] = $this->keyManager->getPublicKey($uid); |
|
| 233 | + } |
|
| 234 | + |
|
| 235 | + $publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $this->user->getUID()); |
|
| 236 | + |
|
| 237 | + $encryptedKeyfiles = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys); |
|
| 238 | + $this->keyManager->setAllFileKeys($filePath, $encryptedKeyfiles); |
|
| 239 | + } |
|
| 240 | + } |
|
| 241 | + } |
|
| 242 | + } |
|
| 243 | + |
|
| 244 | + /** |
|
| 245 | + * remove recovery key to all encrypted files |
|
| 246 | + * @param string $path |
|
| 247 | + */ |
|
| 248 | + private function removeRecoveryKeys($path) { |
|
| 249 | + $dirContent = $this->view->getDirectoryContent($path); |
|
| 250 | + foreach ($dirContent as $item) { |
|
| 251 | + $filePath = $item->getPath(); |
|
| 252 | + if ($item['type'] === 'dir') { |
|
| 253 | + $this->removeRecoveryKeys($filePath . '/'); |
|
| 254 | + } else { |
|
| 255 | + $this->keyManager->deleteShareKey($filePath, $this->keyManager->getRecoveryKeyId()); |
|
| 256 | + } |
|
| 257 | + } |
|
| 258 | + } |
|
| 259 | + |
|
| 260 | + /** |
|
| 261 | + * recover users files with the recovery key |
|
| 262 | + * |
|
| 263 | + * @param string $recoveryPassword |
|
| 264 | + * @param string $user |
|
| 265 | + */ |
|
| 266 | + public function recoverUsersFiles($recoveryPassword, $user) { |
|
| 267 | + $encryptedKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId()); |
|
| 268 | + |
|
| 269 | + $privateKey = $this->crypt->decryptPrivateKey($encryptedKey, $recoveryPassword); |
|
| 270 | + if($privateKey !== false) { |
|
| 271 | + $this->recoverAllFiles('/' . $user . '/files/', $privateKey, $user); |
|
| 272 | + } |
|
| 273 | + } |
|
| 274 | + |
|
| 275 | + /** |
|
| 276 | + * recover users files |
|
| 277 | + * |
|
| 278 | + * @param string $path |
|
| 279 | + * @param string $privateKey |
|
| 280 | + * @param string $uid |
|
| 281 | + */ |
|
| 282 | + private function recoverAllFiles($path, $privateKey, $uid) { |
|
| 283 | + $dirContent = $this->view->getDirectoryContent($path); |
|
| 284 | + |
|
| 285 | + foreach ($dirContent as $item) { |
|
| 286 | + // Get relative path from encryption/keyfiles |
|
| 287 | + $filePath = $item->getPath(); |
|
| 288 | + if ($this->view->is_dir($filePath)) { |
|
| 289 | + $this->recoverAllFiles($filePath . '/', $privateKey, $uid); |
|
| 290 | + } else { |
|
| 291 | + $this->recoverFile($filePath, $privateKey, $uid); |
|
| 292 | + } |
|
| 293 | + } |
|
| 294 | + |
|
| 295 | + } |
|
| 296 | + |
|
| 297 | + /** |
|
| 298 | + * recover file |
|
| 299 | + * |
|
| 300 | + * @param string $path |
|
| 301 | + * @param string $privateKey |
|
| 302 | + * @param string $uid |
|
| 303 | + */ |
|
| 304 | + private function recoverFile($path, $privateKey, $uid) { |
|
| 305 | + $encryptedFileKey = $this->keyManager->getEncryptedFileKey($path); |
|
| 306 | + $shareKey = $this->keyManager->getShareKey($path, $this->keyManager->getRecoveryKeyId()); |
|
| 307 | + |
|
| 308 | + if ($encryptedFileKey && $shareKey && $privateKey) { |
|
| 309 | + $fileKey = $this->crypt->multiKeyDecrypt($encryptedFileKey, |
|
| 310 | + $shareKey, |
|
| 311 | + $privateKey); |
|
| 312 | + } |
|
| 313 | + |
|
| 314 | + if (!empty($fileKey)) { |
|
| 315 | + $accessList = $this->file->getAccessList($path); |
|
| 316 | + $publicKeys = array(); |
|
| 317 | + foreach ($accessList['users'] as $user) { |
|
| 318 | + $publicKeys[$user] = $this->keyManager->getPublicKey($user); |
|
| 319 | + } |
|
| 320 | + |
|
| 321 | + $publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $uid); |
|
| 322 | + |
|
| 323 | + $encryptedKeyfiles = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys); |
|
| 324 | + $this->keyManager->setAllFileKeys($path, $encryptedKeyfiles); |
|
| 325 | + } |
|
| 326 | + |
|
| 327 | + } |
|
| 328 | 328 | |
| 329 | 329 | |
| 330 | 330 | } |
@@ -109,7 +109,7 @@ discard block |
||
| 109 | 109 | |
| 110 | 110 | if (!$keyManager->recoveryKeyExists()) { |
| 111 | 111 | $keyPair = $this->crypt->createKeyPair(); |
| 112 | - if(!is_array($keyPair)) { |
|
| 112 | + if (!is_array($keyPair)) { |
|
| 113 | 113 | return false; |
| 114 | 114 | } |
| 115 | 115 | |
@@ -134,13 +134,13 @@ discard block |
||
| 134 | 134 | public function changeRecoveryKeyPassword($newPassword, $oldPassword) { |
| 135 | 135 | $recoveryKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId()); |
| 136 | 136 | $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $oldPassword); |
| 137 | - if($decryptedRecoveryKey === false) { |
|
| 137 | + if ($decryptedRecoveryKey === false) { |
|
| 138 | 138 | return false; |
| 139 | 139 | } |
| 140 | 140 | $encryptedRecoveryKey = $this->crypt->encryptPrivateKey($decryptedRecoveryKey, $newPassword); |
| 141 | 141 | $header = $this->crypt->generateHeader(); |
| 142 | 142 | if ($encryptedRecoveryKey) { |
| 143 | - $this->keyManager->setSystemPrivateKey($this->keyManager->getRecoveryKeyId(), $header . $encryptedRecoveryKey); |
|
| 143 | + $this->keyManager->setSystemPrivateKey($this->keyManager->getRecoveryKeyId(), $header.$encryptedRecoveryKey); |
|
| 144 | 144 | return true; |
| 145 | 145 | } |
| 146 | 146 | return false; |
@@ -202,9 +202,9 @@ discard block |
||
| 202 | 202 | $value); |
| 203 | 203 | |
| 204 | 204 | if ($value === '1') { |
| 205 | - $this->addRecoveryKeys('/' . $this->user->getUID() . '/files/'); |
|
| 205 | + $this->addRecoveryKeys('/'.$this->user->getUID().'/files/'); |
|
| 206 | 206 | } else { |
| 207 | - $this->removeRecoveryKeys('/' . $this->user->getUID() . '/files/'); |
|
| 207 | + $this->removeRecoveryKeys('/'.$this->user->getUID().'/files/'); |
|
| 208 | 208 | } |
| 209 | 209 | |
| 210 | 210 | return true; |
@@ -222,7 +222,7 @@ discard block |
||
| 222 | 222 | foreach ($dirContent as $item) { |
| 223 | 223 | $filePath = $item->getPath(); |
| 224 | 224 | if ($item['type'] === 'dir') { |
| 225 | - $this->addRecoveryKeys($filePath . '/'); |
|
| 225 | + $this->addRecoveryKeys($filePath.'/'); |
|
| 226 | 226 | } else { |
| 227 | 227 | $fileKey = $this->keyManager->getFileKey($filePath, $this->user->getUID()); |
| 228 | 228 | if (!empty($fileKey)) { |
@@ -250,7 +250,7 @@ discard block |
||
| 250 | 250 | foreach ($dirContent as $item) { |
| 251 | 251 | $filePath = $item->getPath(); |
| 252 | 252 | if ($item['type'] === 'dir') { |
| 253 | - $this->removeRecoveryKeys($filePath . '/'); |
|
| 253 | + $this->removeRecoveryKeys($filePath.'/'); |
|
| 254 | 254 | } else { |
| 255 | 255 | $this->keyManager->deleteShareKey($filePath, $this->keyManager->getRecoveryKeyId()); |
| 256 | 256 | } |
@@ -267,8 +267,8 @@ discard block |
||
| 267 | 267 | $encryptedKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId()); |
| 268 | 268 | |
| 269 | 269 | $privateKey = $this->crypt->decryptPrivateKey($encryptedKey, $recoveryPassword); |
| 270 | - if($privateKey !== false) { |
|
| 271 | - $this->recoverAllFiles('/' . $user . '/files/', $privateKey, $user); |
|
| 270 | + if ($privateKey !== false) { |
|
| 271 | + $this->recoverAllFiles('/'.$user.'/files/', $privateKey, $user); |
|
| 272 | 272 | } |
| 273 | 273 | } |
| 274 | 274 | |
@@ -286,7 +286,7 @@ discard block |
||
| 286 | 286 | // Get relative path from encryption/keyfiles |
| 287 | 287 | $filePath = $item->getPath(); |
| 288 | 288 | if ($this->view->is_dir($filePath)) { |
| 289 | - $this->recoverAllFiles($filePath . '/', $privateKey, $uid); |
|
| 289 | + $this->recoverAllFiles($filePath.'/', $privateKey, $uid); |
|
| 290 | 290 | } else { |
| 291 | 291 | $this->recoverFile($filePath, $privateKey, $uid); |
| 292 | 292 | } |
@@ -34,54 +34,54 @@ |
||
| 34 | 34 | |
| 35 | 35 | class EnableMasterKey extends Command { |
| 36 | 36 | |
| 37 | - /** @var Util */ |
|
| 38 | - protected $util; |
|
| 39 | - |
|
| 40 | - /** @var IConfig */ |
|
| 41 | - protected $config; |
|
| 42 | - |
|
| 43 | - /** @var QuestionHelper */ |
|
| 44 | - protected $questionHelper; |
|
| 45 | - |
|
| 46 | - /** |
|
| 47 | - * @param Util $util |
|
| 48 | - * @param IConfig $config |
|
| 49 | - * @param QuestionHelper $questionHelper |
|
| 50 | - */ |
|
| 51 | - public function __construct(Util $util, |
|
| 52 | - IConfig $config, |
|
| 53 | - QuestionHelper $questionHelper) { |
|
| 54 | - |
|
| 55 | - $this->util = $util; |
|
| 56 | - $this->config = $config; |
|
| 57 | - $this->questionHelper = $questionHelper; |
|
| 58 | - parent::__construct(); |
|
| 59 | - } |
|
| 60 | - |
|
| 61 | - protected function configure() { |
|
| 62 | - $this |
|
| 63 | - ->setName('encryption:enable-master-key') |
|
| 64 | - ->setDescription('Enable the master key. Only available for fresh installations with no existing encrypted data! There is also no way to disable it again.'); |
|
| 65 | - } |
|
| 66 | - |
|
| 67 | - protected function execute(InputInterface $input, OutputInterface $output) { |
|
| 68 | - |
|
| 69 | - $isAlreadyEnabled = $this->util->isMasterKeyEnabled(); |
|
| 70 | - |
|
| 71 | - if($isAlreadyEnabled) { |
|
| 72 | - $output->writeln('Master key already enabled'); |
|
| 73 | - } else { |
|
| 74 | - $question = new ConfirmationQuestion( |
|
| 75 | - 'Warning: Only available for fresh installations with no existing encrypted data! ' |
|
| 76 | - . 'There is also no way to disable it again. Do you want to continue? (y/n) ', false); |
|
| 77 | - if ($this->questionHelper->ask($input, $output, $question)) { |
|
| 78 | - $this->config->setAppValue('encryption', 'useMasterKey', '1'); |
|
| 79 | - $output->writeln('Master key successfully enabled.'); |
|
| 80 | - } else { |
|
| 81 | - $output->writeln('aborted.'); |
|
| 82 | - } |
|
| 83 | - } |
|
| 84 | - |
|
| 85 | - } |
|
| 37 | + /** @var Util */ |
|
| 38 | + protected $util; |
|
| 39 | + |
|
| 40 | + /** @var IConfig */ |
|
| 41 | + protected $config; |
|
| 42 | + |
|
| 43 | + /** @var QuestionHelper */ |
|
| 44 | + protected $questionHelper; |
|
| 45 | + |
|
| 46 | + /** |
|
| 47 | + * @param Util $util |
|
| 48 | + * @param IConfig $config |
|
| 49 | + * @param QuestionHelper $questionHelper |
|
| 50 | + */ |
|
| 51 | + public function __construct(Util $util, |
|
| 52 | + IConfig $config, |
|
| 53 | + QuestionHelper $questionHelper) { |
|
| 54 | + |
|
| 55 | + $this->util = $util; |
|
| 56 | + $this->config = $config; |
|
| 57 | + $this->questionHelper = $questionHelper; |
|
| 58 | + parent::__construct(); |
|
| 59 | + } |
|
| 60 | + |
|
| 61 | + protected function configure() { |
|
| 62 | + $this |
|
| 63 | + ->setName('encryption:enable-master-key') |
|
| 64 | + ->setDescription('Enable the master key. Only available for fresh installations with no existing encrypted data! There is also no way to disable it again.'); |
|
| 65 | + } |
|
| 66 | + |
|
| 67 | + protected function execute(InputInterface $input, OutputInterface $output) { |
|
| 68 | + |
|
| 69 | + $isAlreadyEnabled = $this->util->isMasterKeyEnabled(); |
|
| 70 | + |
|
| 71 | + if($isAlreadyEnabled) { |
|
| 72 | + $output->writeln('Master key already enabled'); |
|
| 73 | + } else { |
|
| 74 | + $question = new ConfirmationQuestion( |
|
| 75 | + 'Warning: Only available for fresh installations with no existing encrypted data! ' |
|
| 76 | + . 'There is also no way to disable it again. Do you want to continue? (y/n) ', false); |
|
| 77 | + if ($this->questionHelper->ask($input, $output, $question)) { |
|
| 78 | + $this->config->setAppValue('encryption', 'useMasterKey', '1'); |
|
| 79 | + $output->writeln('Master key successfully enabled.'); |
|
| 80 | + } else { |
|
| 81 | + $output->writeln('aborted.'); |
|
| 82 | + } |
|
| 83 | + } |
|
| 84 | + |
|
| 85 | + } |
|
| 86 | 86 | |
| 87 | 87 | } |
@@ -68,7 +68,7 @@ |
||
| 68 | 68 | |
| 69 | 69 | $isAlreadyEnabled = $this->util->isMasterKeyEnabled(); |
| 70 | 70 | |
| 71 | - if($isAlreadyEnabled) { |
|
| 71 | + if ($isAlreadyEnabled) { |
|
| 72 | 72 | $output->writeln('Master key already enabled'); |
| 73 | 73 | } else { |
| 74 | 74 | $question = new ConfirmationQuestion( |
@@ -276,7 +276,7 @@ discard block |
||
| 276 | 276 | // Save private key |
| 277 | 277 | if ($encryptedPrivateKey) { |
| 278 | 278 | $this->keyManager->setPrivateKey($this->user->getUser()->getUID(), |
| 279 | - $this->crypt->generateHeader() . $encryptedPrivateKey); |
|
| 279 | + $this->crypt->generateHeader().$encryptedPrivateKey); |
|
| 280 | 280 | } else { |
| 281 | 281 | $this->logger->error('Encryption could not update users encryption password'); |
| 282 | 282 | } |
@@ -313,7 +313,7 @@ discard block |
||
| 313 | 313 | $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $user); |
| 314 | 314 | |
| 315 | 315 | if ($encryptedKey) { |
| 316 | - $this->keyManager->setPrivateKey($user, $this->crypt->generateHeader() . $encryptedKey); |
|
| 316 | + $this->keyManager->setPrivateKey($user, $this->crypt->generateHeader().$encryptedKey); |
|
| 317 | 317 | |
| 318 | 318 | if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files |
| 319 | 319 | $this->recovery->recoverUsersFiles($recoveryPassword, $user); |
@@ -43,306 +43,306 @@ |
||
| 43 | 43 | |
| 44 | 44 | class UserHooks implements IHook { |
| 45 | 45 | |
| 46 | - /** |
|
| 47 | - * list of user for which we perform a password reset |
|
| 48 | - * @var array |
|
| 49 | - */ |
|
| 50 | - protected static $passwordResetUsers = []; |
|
| 51 | - |
|
| 52 | - /** |
|
| 53 | - * @var KeyManager |
|
| 54 | - */ |
|
| 55 | - private $keyManager; |
|
| 56 | - /** |
|
| 57 | - * @var IUserManager |
|
| 58 | - */ |
|
| 59 | - private $userManager; |
|
| 60 | - /** |
|
| 61 | - * @var ILogger |
|
| 62 | - */ |
|
| 63 | - private $logger; |
|
| 64 | - /** |
|
| 65 | - * @var Setup |
|
| 66 | - */ |
|
| 67 | - private $userSetup; |
|
| 68 | - /** |
|
| 69 | - * @var IUserSession |
|
| 70 | - */ |
|
| 71 | - private $user; |
|
| 72 | - /** |
|
| 73 | - * @var Util |
|
| 74 | - */ |
|
| 75 | - private $util; |
|
| 76 | - /** |
|
| 77 | - * @var Session |
|
| 78 | - */ |
|
| 79 | - private $session; |
|
| 80 | - /** |
|
| 81 | - * @var Recovery |
|
| 82 | - */ |
|
| 83 | - private $recovery; |
|
| 84 | - /** |
|
| 85 | - * @var Crypt |
|
| 86 | - */ |
|
| 87 | - private $crypt; |
|
| 88 | - |
|
| 89 | - /** |
|
| 90 | - * UserHooks constructor. |
|
| 91 | - * |
|
| 92 | - * @param KeyManager $keyManager |
|
| 93 | - * @param IUserManager $userManager |
|
| 94 | - * @param ILogger $logger |
|
| 95 | - * @param Setup $userSetup |
|
| 96 | - * @param IUserSession $user |
|
| 97 | - * @param Util $util |
|
| 98 | - * @param Session $session |
|
| 99 | - * @param Crypt $crypt |
|
| 100 | - * @param Recovery $recovery |
|
| 101 | - */ |
|
| 102 | - public function __construct(KeyManager $keyManager, |
|
| 103 | - IUserManager $userManager, |
|
| 104 | - ILogger $logger, |
|
| 105 | - Setup $userSetup, |
|
| 106 | - IUserSession $user, |
|
| 107 | - Util $util, |
|
| 108 | - Session $session, |
|
| 109 | - Crypt $crypt, |
|
| 110 | - Recovery $recovery) { |
|
| 111 | - |
|
| 112 | - $this->keyManager = $keyManager; |
|
| 113 | - $this->userManager = $userManager; |
|
| 114 | - $this->logger = $logger; |
|
| 115 | - $this->userSetup = $userSetup; |
|
| 116 | - $this->user = $user; |
|
| 117 | - $this->util = $util; |
|
| 118 | - $this->session = $session; |
|
| 119 | - $this->recovery = $recovery; |
|
| 120 | - $this->crypt = $crypt; |
|
| 121 | - } |
|
| 122 | - |
|
| 123 | - /** |
|
| 124 | - * Connects Hooks |
|
| 125 | - * |
|
| 126 | - * @return null |
|
| 127 | - */ |
|
| 128 | - public function addHooks() { |
|
| 129 | - OCUtil::connectHook('OC_User', 'post_login', $this, 'login'); |
|
| 130 | - OCUtil::connectHook('OC_User', 'logout', $this, 'logout'); |
|
| 131 | - |
|
| 132 | - // this hooks only make sense if no master key is used |
|
| 133 | - if ($this->util->isMasterKeyEnabled() === false) { |
|
| 134 | - OCUtil::connectHook('OC_User', |
|
| 135 | - 'post_setPassword', |
|
| 136 | - $this, |
|
| 137 | - 'setPassphrase'); |
|
| 138 | - |
|
| 139 | - OCUtil::connectHook('OC_User', |
|
| 140 | - 'pre_setPassword', |
|
| 141 | - $this, |
|
| 142 | - 'preSetPassphrase'); |
|
| 143 | - |
|
| 144 | - OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController', |
|
| 145 | - 'post_passwordReset', |
|
| 146 | - $this, |
|
| 147 | - 'postPasswordReset'); |
|
| 148 | - |
|
| 149 | - OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController', |
|
| 150 | - 'pre_passwordReset', |
|
| 151 | - $this, |
|
| 152 | - 'prePasswordReset'); |
|
| 153 | - |
|
| 154 | - OCUtil::connectHook('OC_User', |
|
| 155 | - 'post_createUser', |
|
| 156 | - $this, |
|
| 157 | - 'postCreateUser'); |
|
| 158 | - |
|
| 159 | - OCUtil::connectHook('OC_User', |
|
| 160 | - 'post_deleteUser', |
|
| 161 | - $this, |
|
| 162 | - 'postDeleteUser'); |
|
| 163 | - } |
|
| 164 | - } |
|
| 165 | - |
|
| 166 | - |
|
| 167 | - /** |
|
| 168 | - * Startup encryption backend upon user login |
|
| 169 | - * |
|
| 170 | - * @note This method should never be called for users using client side encryption |
|
| 171 | - * @param array $params |
|
| 172 | - * @return boolean|null |
|
| 173 | - */ |
|
| 174 | - public function login($params) { |
|
| 175 | - // ensure filesystem is loaded |
|
| 176 | - if (!\OC\Files\Filesystem::$loaded) { |
|
| 177 | - $this->setupFS($params['uid']); |
|
| 178 | - } |
|
| 179 | - if ($this->util->isMasterKeyEnabled() === false) { |
|
| 180 | - $this->userSetup->setupUser($params['uid'], $params['password']); |
|
| 181 | - } |
|
| 182 | - |
|
| 183 | - $this->keyManager->init($params['uid'], $params['password']); |
|
| 184 | - } |
|
| 185 | - |
|
| 186 | - /** |
|
| 187 | - * remove keys from session during logout |
|
| 188 | - */ |
|
| 189 | - public function logout() { |
|
| 190 | - $this->session->clear(); |
|
| 191 | - } |
|
| 192 | - |
|
| 193 | - /** |
|
| 194 | - * setup encryption backend upon user created |
|
| 195 | - * |
|
| 196 | - * @note This method should never be called for users using client side encryption |
|
| 197 | - * @param array $params |
|
| 198 | - */ |
|
| 199 | - public function postCreateUser($params) { |
|
| 200 | - $this->userSetup->setupUser($params['uid'], $params['password']); |
|
| 201 | - } |
|
| 202 | - |
|
| 203 | - /** |
|
| 204 | - * cleanup encryption backend upon user deleted |
|
| 205 | - * |
|
| 206 | - * @param array $params : uid, password |
|
| 207 | - * @note This method should never be called for users using client side encryption |
|
| 208 | - */ |
|
| 209 | - public function postDeleteUser($params) { |
|
| 210 | - $this->keyManager->deletePublicKey($params['uid']); |
|
| 211 | - } |
|
| 212 | - |
|
| 213 | - public function prePasswordReset($params) { |
|
| 214 | - $user = $params['uid']; |
|
| 215 | - self::$passwordResetUsers[$user] = true; |
|
| 216 | - } |
|
| 217 | - |
|
| 218 | - public function postPasswordReset($params) { |
|
| 219 | - $uid = $params['uid']; |
|
| 220 | - $password = $params['password']; |
|
| 221 | - $this->keyManager->backupUserKeys('passwordReset', $uid); |
|
| 222 | - $this->keyManager->deleteUserKeys($uid); |
|
| 223 | - $this->userSetup->setupUser($uid, $password); |
|
| 224 | - unset(self::$passwordResetUsers[$uid]); |
|
| 225 | - } |
|
| 226 | - |
|
| 227 | - /** |
|
| 228 | - * If the password can't be changed within Nextcloud, than update the key password in advance. |
|
| 229 | - * |
|
| 230 | - * @param array $params : uid, password |
|
| 231 | - * @return boolean|null |
|
| 232 | - */ |
|
| 233 | - public function preSetPassphrase($params) { |
|
| 234 | - $user = $this->userManager->get($params['uid']); |
|
| 235 | - |
|
| 236 | - if ($user && !$user->canChangePassword()) { |
|
| 237 | - $this->setPassphrase($params); |
|
| 238 | - } |
|
| 239 | - } |
|
| 240 | - |
|
| 241 | - /** |
|
| 242 | - * Change a user's encryption passphrase |
|
| 243 | - * |
|
| 244 | - * @param array $params keys: uid, password |
|
| 245 | - * @return boolean|null |
|
| 246 | - */ |
|
| 247 | - public function setPassphrase($params) { |
|
| 248 | - |
|
| 249 | - // if we are in the process to resetting a user password, we have nothing |
|
| 250 | - // to do here |
|
| 251 | - if (isset(self::$passwordResetUsers[$params['uid']])) { |
|
| 252 | - return true; |
|
| 253 | - } |
|
| 254 | - |
|
| 255 | - // Get existing decrypted private key |
|
| 256 | - $user = $this->user->getUser(); |
|
| 257 | - |
|
| 258 | - // current logged in user changes his own password |
|
| 259 | - if ($user && $params['uid'] === $user->getUID()) { |
|
| 260 | - |
|
| 261 | - $privateKey = $this->session->getPrivateKey(); |
|
| 262 | - |
|
| 263 | - // Encrypt private key with new user pwd as passphrase |
|
| 264 | - $encryptedPrivateKey = $this->crypt->encryptPrivateKey($privateKey, $params['password'], $params['uid']); |
|
| 265 | - |
|
| 266 | - // Save private key |
|
| 267 | - if ($encryptedPrivateKey) { |
|
| 268 | - $this->keyManager->setPrivateKey($this->user->getUser()->getUID(), |
|
| 269 | - $this->crypt->generateHeader() . $encryptedPrivateKey); |
|
| 270 | - } else { |
|
| 271 | - $this->logger->error('Encryption could not update users encryption password'); |
|
| 272 | - } |
|
| 273 | - |
|
| 274 | - // NOTE: Session does not need to be updated as the |
|
| 275 | - // private key has not changed, only the passphrase |
|
| 276 | - // used to decrypt it has changed |
|
| 277 | - } else { // admin changed the password for a different user, create new keys and re-encrypt file keys |
|
| 278 | - $user = $params['uid']; |
|
| 279 | - $this->initMountPoints($user); |
|
| 280 | - $recoveryPassword = isset($params['recoveryPassword']) ? $params['recoveryPassword'] : null; |
|
| 281 | - |
|
| 282 | - $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
|
| 283 | - $recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId); |
|
| 284 | - try { |
|
| 285 | - $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $recoveryPassword); |
|
| 286 | - } catch (\Exception $e) { |
|
| 287 | - $decryptedRecoveryKey = false; |
|
| 288 | - } |
|
| 289 | - if ($decryptedRecoveryKey === false) { |
|
| 290 | - $message = 'Can not decrypt the recovery key. Maybe you provided the wrong password. Try again.'; |
|
| 291 | - throw new GenericEncryptionException($message, $message); |
|
| 292 | - } |
|
| 293 | - |
|
| 294 | - // we generate new keys if... |
|
| 295 | - // ...we have a recovery password and the user enabled the recovery key |
|
| 296 | - // ...encryption was activated for the first time (no keys exists) |
|
| 297 | - // ...the user doesn't have any files |
|
| 298 | - if ( |
|
| 299 | - ($this->recovery->isRecoveryEnabledForUser($user) && $recoveryPassword) |
|
| 300 | - || !$this->keyManager->userHasKeys($user) |
|
| 301 | - || !$this->util->userHasFiles($user) |
|
| 302 | - ) { |
|
| 303 | - |
|
| 304 | - // backup old keys |
|
| 305 | - //$this->backupAllKeys('recovery'); |
|
| 306 | - |
|
| 307 | - $newUserPassword = $params['password']; |
|
| 308 | - |
|
| 309 | - $keyPair = $this->crypt->createKeyPair(); |
|
| 310 | - |
|
| 311 | - // Save public key |
|
| 312 | - $this->keyManager->setPublicKey($user, $keyPair['publicKey']); |
|
| 313 | - |
|
| 314 | - // Encrypt private key with new password |
|
| 315 | - $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $user); |
|
| 316 | - |
|
| 317 | - if ($encryptedKey) { |
|
| 318 | - $this->keyManager->setPrivateKey($user, $this->crypt->generateHeader() . $encryptedKey); |
|
| 319 | - |
|
| 320 | - if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files |
|
| 321 | - $this->recovery->recoverUsersFiles($recoveryPassword, $user); |
|
| 322 | - } |
|
| 323 | - } else { |
|
| 324 | - $this->logger->error('Encryption Could not update users encryption password'); |
|
| 325 | - } |
|
| 326 | - } |
|
| 327 | - } |
|
| 328 | - } |
|
| 329 | - |
|
| 330 | - /** |
|
| 331 | - * init mount points for given user |
|
| 332 | - * |
|
| 333 | - * @param string $user |
|
| 334 | - * @throws \OC\User\NoUserException |
|
| 335 | - */ |
|
| 336 | - protected function initMountPoints($user) { |
|
| 337 | - Filesystem::initMountPoints($user); |
|
| 338 | - } |
|
| 339 | - |
|
| 340 | - /** |
|
| 341 | - * setup file system for user |
|
| 342 | - * |
|
| 343 | - * @param string $uid user id |
|
| 344 | - */ |
|
| 345 | - protected function setupFS($uid) { |
|
| 346 | - \OC_Util::setupFS($uid); |
|
| 347 | - } |
|
| 46 | + /** |
|
| 47 | + * list of user for which we perform a password reset |
|
| 48 | + * @var array |
|
| 49 | + */ |
|
| 50 | + protected static $passwordResetUsers = []; |
|
| 51 | + |
|
| 52 | + /** |
|
| 53 | + * @var KeyManager |
|
| 54 | + */ |
|
| 55 | + private $keyManager; |
|
| 56 | + /** |
|
| 57 | + * @var IUserManager |
|
| 58 | + */ |
|
| 59 | + private $userManager; |
|
| 60 | + /** |
|
| 61 | + * @var ILogger |
|
| 62 | + */ |
|
| 63 | + private $logger; |
|
| 64 | + /** |
|
| 65 | + * @var Setup |
|
| 66 | + */ |
|
| 67 | + private $userSetup; |
|
| 68 | + /** |
|
| 69 | + * @var IUserSession |
|
| 70 | + */ |
|
| 71 | + private $user; |
|
| 72 | + /** |
|
| 73 | + * @var Util |
|
| 74 | + */ |
|
| 75 | + private $util; |
|
| 76 | + /** |
|
| 77 | + * @var Session |
|
| 78 | + */ |
|
| 79 | + private $session; |
|
| 80 | + /** |
|
| 81 | + * @var Recovery |
|
| 82 | + */ |
|
| 83 | + private $recovery; |
|
| 84 | + /** |
|
| 85 | + * @var Crypt |
|
| 86 | + */ |
|
| 87 | + private $crypt; |
|
| 88 | + |
|
| 89 | + /** |
|
| 90 | + * UserHooks constructor. |
|
| 91 | + * |
|
| 92 | + * @param KeyManager $keyManager |
|
| 93 | + * @param IUserManager $userManager |
|
| 94 | + * @param ILogger $logger |
|
| 95 | + * @param Setup $userSetup |
|
| 96 | + * @param IUserSession $user |
|
| 97 | + * @param Util $util |
|
| 98 | + * @param Session $session |
|
| 99 | + * @param Crypt $crypt |
|
| 100 | + * @param Recovery $recovery |
|
| 101 | + */ |
|
| 102 | + public function __construct(KeyManager $keyManager, |
|
| 103 | + IUserManager $userManager, |
|
| 104 | + ILogger $logger, |
|
| 105 | + Setup $userSetup, |
|
| 106 | + IUserSession $user, |
|
| 107 | + Util $util, |
|
| 108 | + Session $session, |
|
| 109 | + Crypt $crypt, |
|
| 110 | + Recovery $recovery) { |
|
| 111 | + |
|
| 112 | + $this->keyManager = $keyManager; |
|
| 113 | + $this->userManager = $userManager; |
|
| 114 | + $this->logger = $logger; |
|
| 115 | + $this->userSetup = $userSetup; |
|
| 116 | + $this->user = $user; |
|
| 117 | + $this->util = $util; |
|
| 118 | + $this->session = $session; |
|
| 119 | + $this->recovery = $recovery; |
|
| 120 | + $this->crypt = $crypt; |
|
| 121 | + } |
|
| 122 | + |
|
| 123 | + /** |
|
| 124 | + * Connects Hooks |
|
| 125 | + * |
|
| 126 | + * @return null |
|
| 127 | + */ |
|
| 128 | + public function addHooks() { |
|
| 129 | + OCUtil::connectHook('OC_User', 'post_login', $this, 'login'); |
|
| 130 | + OCUtil::connectHook('OC_User', 'logout', $this, 'logout'); |
|
| 131 | + |
|
| 132 | + // this hooks only make sense if no master key is used |
|
| 133 | + if ($this->util->isMasterKeyEnabled() === false) { |
|
| 134 | + OCUtil::connectHook('OC_User', |
|
| 135 | + 'post_setPassword', |
|
| 136 | + $this, |
|
| 137 | + 'setPassphrase'); |
|
| 138 | + |
|
| 139 | + OCUtil::connectHook('OC_User', |
|
| 140 | + 'pre_setPassword', |
|
| 141 | + $this, |
|
| 142 | + 'preSetPassphrase'); |
|
| 143 | + |
|
| 144 | + OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController', |
|
| 145 | + 'post_passwordReset', |
|
| 146 | + $this, |
|
| 147 | + 'postPasswordReset'); |
|
| 148 | + |
|
| 149 | + OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController', |
|
| 150 | + 'pre_passwordReset', |
|
| 151 | + $this, |
|
| 152 | + 'prePasswordReset'); |
|
| 153 | + |
|
| 154 | + OCUtil::connectHook('OC_User', |
|
| 155 | + 'post_createUser', |
|
| 156 | + $this, |
|
| 157 | + 'postCreateUser'); |
|
| 158 | + |
|
| 159 | + OCUtil::connectHook('OC_User', |
|
| 160 | + 'post_deleteUser', |
|
| 161 | + $this, |
|
| 162 | + 'postDeleteUser'); |
|
| 163 | + } |
|
| 164 | + } |
|
| 165 | + |
|
| 166 | + |
|
| 167 | + /** |
|
| 168 | + * Startup encryption backend upon user login |
|
| 169 | + * |
|
| 170 | + * @note This method should never be called for users using client side encryption |
|
| 171 | + * @param array $params |
|
| 172 | + * @return boolean|null |
|
| 173 | + */ |
|
| 174 | + public function login($params) { |
|
| 175 | + // ensure filesystem is loaded |
|
| 176 | + if (!\OC\Files\Filesystem::$loaded) { |
|
| 177 | + $this->setupFS($params['uid']); |
|
| 178 | + } |
|
| 179 | + if ($this->util->isMasterKeyEnabled() === false) { |
|
| 180 | + $this->userSetup->setupUser($params['uid'], $params['password']); |
|
| 181 | + } |
|
| 182 | + |
|
| 183 | + $this->keyManager->init($params['uid'], $params['password']); |
|
| 184 | + } |
|
| 185 | + |
|
| 186 | + /** |
|
| 187 | + * remove keys from session during logout |
|
| 188 | + */ |
|
| 189 | + public function logout() { |
|
| 190 | + $this->session->clear(); |
|
| 191 | + } |
|
| 192 | + |
|
| 193 | + /** |
|
| 194 | + * setup encryption backend upon user created |
|
| 195 | + * |
|
| 196 | + * @note This method should never be called for users using client side encryption |
|
| 197 | + * @param array $params |
|
| 198 | + */ |
|
| 199 | + public function postCreateUser($params) { |
|
| 200 | + $this->userSetup->setupUser($params['uid'], $params['password']); |
|
| 201 | + } |
|
| 202 | + |
|
| 203 | + /** |
|
| 204 | + * cleanup encryption backend upon user deleted |
|
| 205 | + * |
|
| 206 | + * @param array $params : uid, password |
|
| 207 | + * @note This method should never be called for users using client side encryption |
|
| 208 | + */ |
|
| 209 | + public function postDeleteUser($params) { |
|
| 210 | + $this->keyManager->deletePublicKey($params['uid']); |
|
| 211 | + } |
|
| 212 | + |
|
| 213 | + public function prePasswordReset($params) { |
|
| 214 | + $user = $params['uid']; |
|
| 215 | + self::$passwordResetUsers[$user] = true; |
|
| 216 | + } |
|
| 217 | + |
|
| 218 | + public function postPasswordReset($params) { |
|
| 219 | + $uid = $params['uid']; |
|
| 220 | + $password = $params['password']; |
|
| 221 | + $this->keyManager->backupUserKeys('passwordReset', $uid); |
|
| 222 | + $this->keyManager->deleteUserKeys($uid); |
|
| 223 | + $this->userSetup->setupUser($uid, $password); |
|
| 224 | + unset(self::$passwordResetUsers[$uid]); |
|
| 225 | + } |
|
| 226 | + |
|
| 227 | + /** |
|
| 228 | + * If the password can't be changed within Nextcloud, than update the key password in advance. |
|
| 229 | + * |
|
| 230 | + * @param array $params : uid, password |
|
| 231 | + * @return boolean|null |
|
| 232 | + */ |
|
| 233 | + public function preSetPassphrase($params) { |
|
| 234 | + $user = $this->userManager->get($params['uid']); |
|
| 235 | + |
|
| 236 | + if ($user && !$user->canChangePassword()) { |
|
| 237 | + $this->setPassphrase($params); |
|
| 238 | + } |
|
| 239 | + } |
|
| 240 | + |
|
| 241 | + /** |
|
| 242 | + * Change a user's encryption passphrase |
|
| 243 | + * |
|
| 244 | + * @param array $params keys: uid, password |
|
| 245 | + * @return boolean|null |
|
| 246 | + */ |
|
| 247 | + public function setPassphrase($params) { |
|
| 248 | + |
|
| 249 | + // if we are in the process to resetting a user password, we have nothing |
|
| 250 | + // to do here |
|
| 251 | + if (isset(self::$passwordResetUsers[$params['uid']])) { |
|
| 252 | + return true; |
|
| 253 | + } |
|
| 254 | + |
|
| 255 | + // Get existing decrypted private key |
|
| 256 | + $user = $this->user->getUser(); |
|
| 257 | + |
|
| 258 | + // current logged in user changes his own password |
|
| 259 | + if ($user && $params['uid'] === $user->getUID()) { |
|
| 260 | + |
|
| 261 | + $privateKey = $this->session->getPrivateKey(); |
|
| 262 | + |
|
| 263 | + // Encrypt private key with new user pwd as passphrase |
|
| 264 | + $encryptedPrivateKey = $this->crypt->encryptPrivateKey($privateKey, $params['password'], $params['uid']); |
|
| 265 | + |
|
| 266 | + // Save private key |
|
| 267 | + if ($encryptedPrivateKey) { |
|
| 268 | + $this->keyManager->setPrivateKey($this->user->getUser()->getUID(), |
|
| 269 | + $this->crypt->generateHeader() . $encryptedPrivateKey); |
|
| 270 | + } else { |
|
| 271 | + $this->logger->error('Encryption could not update users encryption password'); |
|
| 272 | + } |
|
| 273 | + |
|
| 274 | + // NOTE: Session does not need to be updated as the |
|
| 275 | + // private key has not changed, only the passphrase |
|
| 276 | + // used to decrypt it has changed |
|
| 277 | + } else { // admin changed the password for a different user, create new keys and re-encrypt file keys |
|
| 278 | + $user = $params['uid']; |
|
| 279 | + $this->initMountPoints($user); |
|
| 280 | + $recoveryPassword = isset($params['recoveryPassword']) ? $params['recoveryPassword'] : null; |
|
| 281 | + |
|
| 282 | + $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
|
| 283 | + $recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId); |
|
| 284 | + try { |
|
| 285 | + $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $recoveryPassword); |
|
| 286 | + } catch (\Exception $e) { |
|
| 287 | + $decryptedRecoveryKey = false; |
|
| 288 | + } |
|
| 289 | + if ($decryptedRecoveryKey === false) { |
|
| 290 | + $message = 'Can not decrypt the recovery key. Maybe you provided the wrong password. Try again.'; |
|
| 291 | + throw new GenericEncryptionException($message, $message); |
|
| 292 | + } |
|
| 293 | + |
|
| 294 | + // we generate new keys if... |
|
| 295 | + // ...we have a recovery password and the user enabled the recovery key |
|
| 296 | + // ...encryption was activated for the first time (no keys exists) |
|
| 297 | + // ...the user doesn't have any files |
|
| 298 | + if ( |
|
| 299 | + ($this->recovery->isRecoveryEnabledForUser($user) && $recoveryPassword) |
|
| 300 | + || !$this->keyManager->userHasKeys($user) |
|
| 301 | + || !$this->util->userHasFiles($user) |
|
| 302 | + ) { |
|
| 303 | + |
|
| 304 | + // backup old keys |
|
| 305 | + //$this->backupAllKeys('recovery'); |
|
| 306 | + |
|
| 307 | + $newUserPassword = $params['password']; |
|
| 308 | + |
|
| 309 | + $keyPair = $this->crypt->createKeyPair(); |
|
| 310 | + |
|
| 311 | + // Save public key |
|
| 312 | + $this->keyManager->setPublicKey($user, $keyPair['publicKey']); |
|
| 313 | + |
|
| 314 | + // Encrypt private key with new password |
|
| 315 | + $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $user); |
|
| 316 | + |
|
| 317 | + if ($encryptedKey) { |
|
| 318 | + $this->keyManager->setPrivateKey($user, $this->crypt->generateHeader() . $encryptedKey); |
|
| 319 | + |
|
| 320 | + if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files |
|
| 321 | + $this->recovery->recoverUsersFiles($recoveryPassword, $user); |
|
| 322 | + } |
|
| 323 | + } else { |
|
| 324 | + $this->logger->error('Encryption Could not update users encryption password'); |
|
| 325 | + } |
|
| 326 | + } |
|
| 327 | + } |
|
| 328 | + } |
|
| 329 | + |
|
| 330 | + /** |
|
| 331 | + * init mount points for given user |
|
| 332 | + * |
|
| 333 | + * @param string $user |
|
| 334 | + * @throws \OC\User\NoUserException |
|
| 335 | + */ |
|
| 336 | + protected function initMountPoints($user) { |
|
| 337 | + Filesystem::initMountPoints($user); |
|
| 338 | + } |
|
| 339 | + |
|
| 340 | + /** |
|
| 341 | + * setup file system for user |
|
| 342 | + * |
|
| 343 | + * @param string $uid user id |
|
| 344 | + */ |
|
| 345 | + protected function setupFS($uid) { |
|
| 346 | + \OC_Util::setupFS($uid); |
|
| 347 | + } |
|
| 348 | 348 | } |
@@ -24,10 +24,10 @@ |
||
| 24 | 24 | |
| 25 | 25 | |
| 26 | 26 | interface IHook { |
| 27 | - /** |
|
| 28 | - * Connects Hooks |
|
| 29 | - * |
|
| 30 | - * @return null |
|
| 31 | - */ |
|
| 32 | - public function addHooks(); |
|
| 27 | + /** |
|
| 28 | + * Connects Hooks |
|
| 29 | + * |
|
| 30 | + * @return null |
|
| 31 | + */ |
|
| 32 | + public function addHooks(); |
|
| 33 | 33 | } |
@@ -133,7 +133,7 @@ discard block |
||
| 133 | 133 | $this->input = $input; |
| 134 | 134 | $this->output = $output; |
| 135 | 135 | |
| 136 | - $headline = 'Encrypt all files with the ' . Encryption::DISPLAY_NAME; |
|
| 136 | + $headline = 'Encrypt all files with the '.Encryption::DISPLAY_NAME; |
|
| 137 | 137 | $this->output->writeln("\n"); |
| 138 | 138 | $this->output->writeln($headline); |
| 139 | 139 | $this->output->writeln(str_pad('', strlen($headline), '=')); |
@@ -179,14 +179,14 @@ discard block |
||
| 179 | 179 | $progress->setFormat(" %message% \n [%bar%]"); |
| 180 | 180 | $progress->start(); |
| 181 | 181 | |
| 182 | - foreach($this->userManager->getBackends() as $backend) { |
|
| 182 | + foreach ($this->userManager->getBackends() as $backend) { |
|
| 183 | 183 | $limit = 500; |
| 184 | 184 | $offset = 0; |
| 185 | 185 | do { |
| 186 | 186 | $users = $backend->getUsers('', $limit, $offset); |
| 187 | 187 | foreach ($users as $user) { |
| 188 | 188 | if ($this->keyManager->userHasKeys($user) === false) { |
| 189 | - $progress->setMessage('Create key-pair for ' . $user); |
|
| 189 | + $progress->setMessage('Create key-pair for '.$user); |
|
| 190 | 190 | $progress->advance(); |
| 191 | 191 | $this->setupUserFS($user); |
| 192 | 192 | $password = $this->generateOneTimePassword($user); |
@@ -198,7 +198,7 @@ discard block |
||
| 198 | 198 | } |
| 199 | 199 | } |
| 200 | 200 | $offset += $limit; |
| 201 | - } while(count($users) >= $limit); |
|
| 201 | + } while (count($users) >= $limit); |
|
| 202 | 202 | } |
| 203 | 203 | |
| 204 | 204 | $progress->setMessage('Key-pair created for all users'); |
@@ -236,7 +236,7 @@ discard block |
||
| 236 | 236 | */ |
| 237 | 237 | protected function encryptAllUserFilesWithMasterKey(ProgressBar $progress) { |
| 238 | 238 | $userNo = 1; |
| 239 | - foreach($this->userManager->getBackends() as $backend) { |
|
| 239 | + foreach ($this->userManager->getBackends() as $backend) { |
|
| 240 | 240 | $limit = 500; |
| 241 | 241 | $offset = 0; |
| 242 | 242 | do { |
@@ -247,7 +247,7 @@ discard block |
||
| 247 | 247 | $userNo++; |
| 248 | 248 | } |
| 249 | 249 | $offset += $limit; |
| 250 | - } while(count($users) >= $limit); |
|
| 250 | + } while (count($users) >= $limit); |
|
| 251 | 251 | } |
| 252 | 252 | } |
| 253 | 253 | |
@@ -262,19 +262,19 @@ discard block |
||
| 262 | 262 | |
| 263 | 263 | $this->setupUserFS($uid); |
| 264 | 264 | $directories = array(); |
| 265 | - $directories[] = '/' . $uid . '/files'; |
|
| 265 | + $directories[] = '/'.$uid.'/files'; |
|
| 266 | 266 | |
| 267 | - while($root = array_pop($directories)) { |
|
| 267 | + while ($root = array_pop($directories)) { |
|
| 268 | 268 | $content = $this->rootView->getDirectoryContent($root); |
| 269 | 269 | foreach ($content as $file) { |
| 270 | - $path = $root . '/' . $file['name']; |
|
| 270 | + $path = $root.'/'.$file['name']; |
|
| 271 | 271 | if ($this->rootView->is_dir($path)) { |
| 272 | 272 | $directories[] = $path; |
| 273 | 273 | continue; |
| 274 | 274 | } else { |
| 275 | 275 | $progress->setMessage("encrypt files for user $userCount: $path"); |
| 276 | 276 | $progress->advance(); |
| 277 | - if($this->encryptFile($path) === false) { |
|
| 277 | + if ($this->encryptFile($path) === false) { |
|
| 278 | 278 | $progress->setMessage("encrypt files for user $userCount: $path (already encrypted)"); |
| 279 | 279 | $progress->advance(); |
| 280 | 280 | } |
@@ -292,7 +292,7 @@ discard block |
||
| 292 | 292 | protected function encryptFile($path) { |
| 293 | 293 | |
| 294 | 294 | $source = $path; |
| 295 | - $target = $path . '.encrypted.' . time(); |
|
| 295 | + $target = $path.'.encrypted.'.time(); |
|
| 296 | 296 | |
| 297 | 297 | try { |
| 298 | 298 | $this->rootView->copy($source, $target); |
@@ -414,7 +414,7 @@ discard block |
||
| 414 | 414 | continue; |
| 415 | 415 | } |
| 416 | 416 | |
| 417 | - $subject = (string)$this->l->t('one-time password for server-side-encryption'); |
|
| 417 | + $subject = (string) $this->l->t('one-time password for server-side-encryption'); |
|
| 418 | 418 | list($htmlBody, $textBody) = $this->createMailBody($password); |
| 419 | 419 | |
| 420 | 420 | // send it out now |
@@ -462,11 +462,11 @@ discard block |
||
| 462 | 462 | protected function createMailBody($password) { |
| 463 | 463 | |
| 464 | 464 | $html = new \OC_Template("encryption", "mail", ""); |
| 465 | - $html->assign ('password', $password); |
|
| 465 | + $html->assign('password', $password); |
|
| 466 | 466 | $htmlMail = $html->fetchPage(); |
| 467 | 467 | |
| 468 | 468 | $plainText = new \OC_Template("encryption", "altmail", ""); |
| 469 | - $plainText->assign ('password', $password); |
|
| 469 | + $plainText->assign('password', $password); |
|
| 470 | 470 | $plainTextMail = $plainText->fetchPage(); |
| 471 | 471 | |
| 472 | 472 | return [$htmlMail, $plainTextMail]; |
@@ -45,434 +45,434 @@ |
||
| 45 | 45 | |
| 46 | 46 | class EncryptAll { |
| 47 | 47 | |
| 48 | - /** @var Setup */ |
|
| 49 | - protected $userSetup; |
|
| 50 | - |
|
| 51 | - /** @var IUserManager */ |
|
| 52 | - protected $userManager; |
|
| 53 | - |
|
| 54 | - /** @var View */ |
|
| 55 | - protected $rootView; |
|
| 56 | - |
|
| 57 | - /** @var KeyManager */ |
|
| 58 | - protected $keyManager; |
|
| 59 | - |
|
| 60 | - /** @var Util */ |
|
| 61 | - protected $util; |
|
| 62 | - |
|
| 63 | - /** @var array */ |
|
| 64 | - protected $userPasswords; |
|
| 65 | - |
|
| 66 | - /** @var IConfig */ |
|
| 67 | - protected $config; |
|
| 68 | - |
|
| 69 | - /** @var IMailer */ |
|
| 70 | - protected $mailer; |
|
| 71 | - |
|
| 72 | - /** @var IL10N */ |
|
| 73 | - protected $l; |
|
| 74 | - |
|
| 75 | - /** @var QuestionHelper */ |
|
| 76 | - protected $questionHelper; |
|
| 77 | - |
|
| 78 | - /** @var OutputInterface */ |
|
| 79 | - protected $output; |
|
| 80 | - |
|
| 81 | - /** @var InputInterface */ |
|
| 82 | - protected $input; |
|
| 83 | - |
|
| 84 | - /** @var ISecureRandom */ |
|
| 85 | - protected $secureRandom; |
|
| 86 | - |
|
| 87 | - /** |
|
| 88 | - * @param Setup $userSetup |
|
| 89 | - * @param IUserManager $userManager |
|
| 90 | - * @param View $rootView |
|
| 91 | - * @param KeyManager $keyManager |
|
| 92 | - * @param Util $util |
|
| 93 | - * @param IConfig $config |
|
| 94 | - * @param IMailer $mailer |
|
| 95 | - * @param IL10N $l |
|
| 96 | - * @param QuestionHelper $questionHelper |
|
| 97 | - * @param ISecureRandom $secureRandom |
|
| 98 | - */ |
|
| 99 | - public function __construct( |
|
| 100 | - Setup $userSetup, |
|
| 101 | - IUserManager $userManager, |
|
| 102 | - View $rootView, |
|
| 103 | - KeyManager $keyManager, |
|
| 104 | - Util $util, |
|
| 105 | - IConfig $config, |
|
| 106 | - IMailer $mailer, |
|
| 107 | - IL10N $l, |
|
| 108 | - QuestionHelper $questionHelper, |
|
| 109 | - ISecureRandom $secureRandom |
|
| 110 | - ) { |
|
| 111 | - $this->userSetup = $userSetup; |
|
| 112 | - $this->userManager = $userManager; |
|
| 113 | - $this->rootView = $rootView; |
|
| 114 | - $this->keyManager = $keyManager; |
|
| 115 | - $this->util = $util; |
|
| 116 | - $this->config = $config; |
|
| 117 | - $this->mailer = $mailer; |
|
| 118 | - $this->l = $l; |
|
| 119 | - $this->questionHelper = $questionHelper; |
|
| 120 | - $this->secureRandom = $secureRandom; |
|
| 121 | - // store one time passwords for the users |
|
| 122 | - $this->userPasswords = array(); |
|
| 123 | - } |
|
| 124 | - |
|
| 125 | - /** |
|
| 126 | - * start to encrypt all files |
|
| 127 | - * |
|
| 128 | - * @param InputInterface $input |
|
| 129 | - * @param OutputInterface $output |
|
| 130 | - */ |
|
| 131 | - public function encryptAll(InputInterface $input, OutputInterface $output) { |
|
| 132 | - |
|
| 133 | - $this->input = $input; |
|
| 134 | - $this->output = $output; |
|
| 135 | - |
|
| 136 | - $headline = 'Encrypt all files with the ' . Encryption::DISPLAY_NAME; |
|
| 137 | - $this->output->writeln("\n"); |
|
| 138 | - $this->output->writeln($headline); |
|
| 139 | - $this->output->writeln(str_pad('', strlen($headline), '=')); |
|
| 140 | - $this->output->writeln("\n"); |
|
| 141 | - |
|
| 142 | - if ($this->util->isMasterKeyEnabled()) { |
|
| 143 | - $this->output->writeln('Use master key to encrypt all files.'); |
|
| 144 | - $this->keyManager->validateMasterKey(); |
|
| 145 | - } else { |
|
| 146 | - //create private/public keys for each user and store the private key password |
|
| 147 | - $this->output->writeln('Create key-pair for every user'); |
|
| 148 | - $this->output->writeln('------------------------------'); |
|
| 149 | - $this->output->writeln(''); |
|
| 150 | - $this->output->writeln('This module will encrypt all files in the users files folder initially.'); |
|
| 151 | - $this->output->writeln('Already existing versions and files in the trash bin will not be encrypted.'); |
|
| 152 | - $this->output->writeln(''); |
|
| 153 | - $this->createKeyPairs(); |
|
| 154 | - } |
|
| 155 | - |
|
| 156 | - |
|
| 157 | - // output generated encryption key passwords |
|
| 158 | - if ($this->util->isMasterKeyEnabled() === false) { |
|
| 159 | - //send-out or display password list and write it to a file |
|
| 160 | - $this->output->writeln("\n"); |
|
| 161 | - $this->output->writeln('Generated encryption key passwords'); |
|
| 162 | - $this->output->writeln('----------------------------------'); |
|
| 163 | - $this->output->writeln(''); |
|
| 164 | - $this->outputPasswords(); |
|
| 165 | - } |
|
| 166 | - |
|
| 167 | - //setup users file system and encrypt all files one by one (take should encrypt setting of storage into account) |
|
| 168 | - $this->output->writeln("\n"); |
|
| 169 | - $this->output->writeln('Start to encrypt users files'); |
|
| 170 | - $this->output->writeln('----------------------------'); |
|
| 171 | - $this->output->writeln(''); |
|
| 172 | - $this->encryptAllUsersFiles(); |
|
| 173 | - $this->output->writeln("\n"); |
|
| 174 | - } |
|
| 175 | - |
|
| 176 | - /** |
|
| 177 | - * create key-pair for every user |
|
| 178 | - */ |
|
| 179 | - protected function createKeyPairs() { |
|
| 180 | - $this->output->writeln("\n"); |
|
| 181 | - $progress = new ProgressBar($this->output); |
|
| 182 | - $progress->setFormat(" %message% \n [%bar%]"); |
|
| 183 | - $progress->start(); |
|
| 184 | - |
|
| 185 | - foreach($this->userManager->getBackends() as $backend) { |
|
| 186 | - $limit = 500; |
|
| 187 | - $offset = 0; |
|
| 188 | - do { |
|
| 189 | - $users = $backend->getUsers('', $limit, $offset); |
|
| 190 | - foreach ($users as $user) { |
|
| 191 | - if ($this->keyManager->userHasKeys($user) === false) { |
|
| 192 | - $progress->setMessage('Create key-pair for ' . $user); |
|
| 193 | - $progress->advance(); |
|
| 194 | - $this->setupUserFS($user); |
|
| 195 | - $password = $this->generateOneTimePassword($user); |
|
| 196 | - $this->userSetup->setupUser($user, $password); |
|
| 197 | - } else { |
|
| 198 | - // users which already have a key-pair will be stored with a |
|
| 199 | - // empty password and filtered out later |
|
| 200 | - $this->userPasswords[$user] = ''; |
|
| 201 | - } |
|
| 202 | - } |
|
| 203 | - $offset += $limit; |
|
| 204 | - } while(count($users) >= $limit); |
|
| 205 | - } |
|
| 206 | - |
|
| 207 | - $progress->setMessage('Key-pair created for all users'); |
|
| 208 | - $progress->finish(); |
|
| 209 | - } |
|
| 210 | - |
|
| 211 | - /** |
|
| 212 | - * iterate over all user and encrypt their files |
|
| 213 | - */ |
|
| 214 | - protected function encryptAllUsersFiles() { |
|
| 215 | - $this->output->writeln("\n"); |
|
| 216 | - $progress = new ProgressBar($this->output); |
|
| 217 | - $progress->setFormat(" %message% \n [%bar%]"); |
|
| 218 | - $progress->start(); |
|
| 219 | - $numberOfUsers = count($this->userPasswords); |
|
| 220 | - $userNo = 1; |
|
| 221 | - if ($this->util->isMasterKeyEnabled()) { |
|
| 222 | - $this->encryptAllUserFilesWithMasterKey($progress); |
|
| 223 | - } else { |
|
| 224 | - foreach ($this->userPasswords as $uid => $password) { |
|
| 225 | - $userCount = "$uid ($userNo of $numberOfUsers)"; |
|
| 226 | - $this->encryptUsersFiles($uid, $progress, $userCount); |
|
| 227 | - $userNo++; |
|
| 228 | - } |
|
| 229 | - } |
|
| 230 | - $progress->setMessage("all files encrypted"); |
|
| 231 | - $progress->finish(); |
|
| 232 | - |
|
| 233 | - } |
|
| 234 | - |
|
| 235 | - /** |
|
| 236 | - * encrypt all user files with the master key |
|
| 237 | - * |
|
| 238 | - * @param ProgressBar $progress |
|
| 239 | - */ |
|
| 240 | - protected function encryptAllUserFilesWithMasterKey(ProgressBar $progress) { |
|
| 241 | - $userNo = 1; |
|
| 242 | - foreach($this->userManager->getBackends() as $backend) { |
|
| 243 | - $limit = 500; |
|
| 244 | - $offset = 0; |
|
| 245 | - do { |
|
| 246 | - $users = $backend->getUsers('', $limit, $offset); |
|
| 247 | - foreach ($users as $user) { |
|
| 248 | - $userCount = "$user ($userNo)"; |
|
| 249 | - $this->encryptUsersFiles($user, $progress, $userCount); |
|
| 250 | - $userNo++; |
|
| 251 | - } |
|
| 252 | - $offset += $limit; |
|
| 253 | - } while(count($users) >= $limit); |
|
| 254 | - } |
|
| 255 | - } |
|
| 256 | - |
|
| 257 | - /** |
|
| 258 | - * encrypt files from the given user |
|
| 259 | - * |
|
| 260 | - * @param string $uid |
|
| 261 | - * @param ProgressBar $progress |
|
| 262 | - * @param string $userCount |
|
| 263 | - */ |
|
| 264 | - protected function encryptUsersFiles($uid, ProgressBar $progress, $userCount) { |
|
| 265 | - |
|
| 266 | - $this->setupUserFS($uid); |
|
| 267 | - $directories = array(); |
|
| 268 | - $directories[] = '/' . $uid . '/files'; |
|
| 269 | - |
|
| 270 | - while($root = array_pop($directories)) { |
|
| 271 | - $content = $this->rootView->getDirectoryContent($root); |
|
| 272 | - foreach ($content as $file) { |
|
| 273 | - $path = $root . '/' . $file['name']; |
|
| 274 | - if ($this->rootView->is_dir($path)) { |
|
| 275 | - $directories[] = $path; |
|
| 276 | - continue; |
|
| 277 | - } else { |
|
| 278 | - $progress->setMessage("encrypt files for user $userCount: $path"); |
|
| 279 | - $progress->advance(); |
|
| 280 | - if($this->encryptFile($path) === false) { |
|
| 281 | - $progress->setMessage("encrypt files for user $userCount: $path (already encrypted)"); |
|
| 282 | - $progress->advance(); |
|
| 283 | - } |
|
| 284 | - } |
|
| 285 | - } |
|
| 286 | - } |
|
| 287 | - } |
|
| 288 | - |
|
| 289 | - /** |
|
| 290 | - * encrypt file |
|
| 291 | - * |
|
| 292 | - * @param string $path |
|
| 293 | - * @return bool |
|
| 294 | - */ |
|
| 295 | - protected function encryptFile($path) { |
|
| 296 | - |
|
| 297 | - $source = $path; |
|
| 298 | - $target = $path . '.encrypted.' . time(); |
|
| 299 | - |
|
| 300 | - try { |
|
| 301 | - $this->rootView->copy($source, $target); |
|
| 302 | - $this->rootView->rename($target, $source); |
|
| 303 | - } catch (DecryptionFailedException $e) { |
|
| 304 | - if ($this->rootView->file_exists($target)) { |
|
| 305 | - $this->rootView->unlink($target); |
|
| 306 | - } |
|
| 307 | - return false; |
|
| 308 | - } |
|
| 309 | - |
|
| 310 | - return true; |
|
| 311 | - } |
|
| 312 | - |
|
| 313 | - /** |
|
| 314 | - * output one-time encryption passwords |
|
| 315 | - */ |
|
| 316 | - protected function outputPasswords() { |
|
| 317 | - $table = new Table($this->output); |
|
| 318 | - $table->setHeaders(array('Username', 'Private key password')); |
|
| 319 | - |
|
| 320 | - //create rows |
|
| 321 | - $newPasswords = array(); |
|
| 322 | - $unchangedPasswords = array(); |
|
| 323 | - foreach ($this->userPasswords as $uid => $password) { |
|
| 324 | - if (empty($password)) { |
|
| 325 | - $unchangedPasswords[] = $uid; |
|
| 326 | - } else { |
|
| 327 | - $newPasswords[] = [$uid, $password]; |
|
| 328 | - } |
|
| 329 | - } |
|
| 330 | - |
|
| 331 | - if (empty($newPasswords)) { |
|
| 332 | - $this->output->writeln("\nAll users already had a key-pair, no further action needed.\n"); |
|
| 333 | - return; |
|
| 334 | - } |
|
| 335 | - |
|
| 336 | - $table->setRows($newPasswords); |
|
| 337 | - $table->render(); |
|
| 338 | - |
|
| 339 | - if (!empty($unchangedPasswords)) { |
|
| 340 | - $this->output->writeln("\nThe following users already had a key-pair which was reused without setting a new password:\n"); |
|
| 341 | - foreach ($unchangedPasswords as $uid) { |
|
| 342 | - $this->output->writeln(" $uid"); |
|
| 343 | - } |
|
| 344 | - } |
|
| 345 | - |
|
| 346 | - $this->writePasswordsToFile($newPasswords); |
|
| 347 | - |
|
| 348 | - $this->output->writeln(''); |
|
| 349 | - $question = new ConfirmationQuestion('Do you want to send the passwords directly to the users by mail? (y/n) ', false); |
|
| 350 | - if ($this->questionHelper->ask($this->input, $this->output, $question)) { |
|
| 351 | - $this->sendPasswordsByMail(); |
|
| 352 | - } |
|
| 353 | - } |
|
| 354 | - |
|
| 355 | - /** |
|
| 356 | - * write one-time encryption passwords to a csv file |
|
| 357 | - * |
|
| 358 | - * @param array $passwords |
|
| 359 | - */ |
|
| 360 | - protected function writePasswordsToFile(array $passwords) { |
|
| 361 | - $fp = $this->rootView->fopen('oneTimeEncryptionPasswords.csv', 'w'); |
|
| 362 | - foreach ($passwords as $pwd) { |
|
| 363 | - fputcsv($fp, $pwd); |
|
| 364 | - } |
|
| 365 | - fclose($fp); |
|
| 366 | - $this->output->writeln("\n"); |
|
| 367 | - $this->output->writeln('A list of all newly created passwords was written to data/oneTimeEncryptionPasswords.csv'); |
|
| 368 | - $this->output->writeln(''); |
|
| 369 | - $this->output->writeln('Each of these users need to login to the web interface, go to the'); |
|
| 370 | - $this->output->writeln('personal settings section "basic encryption module" and'); |
|
| 371 | - $this->output->writeln('update the private key password to match the login password again by'); |
|
| 372 | - $this->output->writeln('entering the one-time password into the "old log-in password" field'); |
|
| 373 | - $this->output->writeln('and their current login password'); |
|
| 374 | - } |
|
| 375 | - |
|
| 376 | - /** |
|
| 377 | - * setup user file system |
|
| 378 | - * |
|
| 379 | - * @param string $uid |
|
| 380 | - */ |
|
| 381 | - protected function setupUserFS($uid) { |
|
| 382 | - \OC_Util::tearDownFS(); |
|
| 383 | - \OC_Util::setupFS($uid); |
|
| 384 | - } |
|
| 385 | - |
|
| 386 | - /** |
|
| 387 | - * generate one time password for the user and store it in a array |
|
| 388 | - * |
|
| 389 | - * @param string $uid |
|
| 390 | - * @return string password |
|
| 391 | - */ |
|
| 392 | - protected function generateOneTimePassword($uid) { |
|
| 393 | - $password = $this->secureRandom->generate(8); |
|
| 394 | - $this->userPasswords[$uid] = $password; |
|
| 395 | - return $password; |
|
| 396 | - } |
|
| 397 | - |
|
| 398 | - /** |
|
| 399 | - * send encryption key passwords to the users by mail |
|
| 400 | - */ |
|
| 401 | - protected function sendPasswordsByMail() { |
|
| 402 | - $noMail = []; |
|
| 403 | - |
|
| 404 | - $this->output->writeln(''); |
|
| 405 | - $progress = new ProgressBar($this->output, count($this->userPasswords)); |
|
| 406 | - $progress->start(); |
|
| 407 | - |
|
| 408 | - foreach ($this->userPasswords as $uid => $password) { |
|
| 409 | - $progress->advance(); |
|
| 410 | - if (!empty($password)) { |
|
| 411 | - $recipient = $this->userManager->get($uid); |
|
| 412 | - $recipientDisplayName = $recipient->getDisplayName(); |
|
| 413 | - $to = $recipient->getEMailAddress(); |
|
| 414 | - |
|
| 415 | - if ($to === '') { |
|
| 416 | - $noMail[] = $uid; |
|
| 417 | - continue; |
|
| 418 | - } |
|
| 419 | - |
|
| 420 | - $subject = (string)$this->l->t('one-time password for server-side-encryption'); |
|
| 421 | - list($htmlBody, $textBody) = $this->createMailBody($password); |
|
| 422 | - |
|
| 423 | - // send it out now |
|
| 424 | - try { |
|
| 425 | - $message = $this->mailer->createMessage(); |
|
| 426 | - $message->setSubject($subject); |
|
| 427 | - $message->setTo([$to => $recipientDisplayName]); |
|
| 428 | - $message->setHtmlBody($htmlBody); |
|
| 429 | - $message->setPlainBody($textBody); |
|
| 430 | - $message->setFrom([ |
|
| 431 | - \OCP\Util::getDefaultEmailAddress('admin-noreply') |
|
| 432 | - ]); |
|
| 433 | - |
|
| 434 | - $this->mailer->send($message); |
|
| 435 | - } catch (\Exception $e) { |
|
| 436 | - $noMail[] = $uid; |
|
| 437 | - } |
|
| 438 | - } |
|
| 439 | - } |
|
| 440 | - |
|
| 441 | - $progress->finish(); |
|
| 442 | - |
|
| 443 | - if (empty($noMail)) { |
|
| 444 | - $this->output->writeln("\n\nPassword successfully send to all users"); |
|
| 445 | - } else { |
|
| 446 | - $table = new Table($this->output); |
|
| 447 | - $table->setHeaders(array('Username', 'Private key password')); |
|
| 448 | - $this->output->writeln("\n\nCould not send password to following users:\n"); |
|
| 449 | - $rows = []; |
|
| 450 | - foreach ($noMail as $uid) { |
|
| 451 | - $rows[] = [$uid, $this->userPasswords[$uid]]; |
|
| 452 | - } |
|
| 453 | - $table->setRows($rows); |
|
| 454 | - $table->render(); |
|
| 455 | - } |
|
| 456 | - |
|
| 457 | - } |
|
| 458 | - |
|
| 459 | - /** |
|
| 460 | - * create mail body for plain text and html mail |
|
| 461 | - * |
|
| 462 | - * @param string $password one-time encryption password |
|
| 463 | - * @return array an array of the html mail body and the plain text mail body |
|
| 464 | - */ |
|
| 465 | - protected function createMailBody($password) { |
|
| 466 | - |
|
| 467 | - $html = new \OC_Template("encryption", "mail", ""); |
|
| 468 | - $html->assign ('password', $password); |
|
| 469 | - $htmlMail = $html->fetchPage(); |
|
| 470 | - |
|
| 471 | - $plainText = new \OC_Template("encryption", "altmail", ""); |
|
| 472 | - $plainText->assign ('password', $password); |
|
| 473 | - $plainTextMail = $plainText->fetchPage(); |
|
| 474 | - |
|
| 475 | - return [$htmlMail, $plainTextMail]; |
|
| 476 | - } |
|
| 48 | + /** @var Setup */ |
|
| 49 | + protected $userSetup; |
|
| 50 | + |
|
| 51 | + /** @var IUserManager */ |
|
| 52 | + protected $userManager; |
|
| 53 | + |
|
| 54 | + /** @var View */ |
|
| 55 | + protected $rootView; |
|
| 56 | + |
|
| 57 | + /** @var KeyManager */ |
|
| 58 | + protected $keyManager; |
|
| 59 | + |
|
| 60 | + /** @var Util */ |
|
| 61 | + protected $util; |
|
| 62 | + |
|
| 63 | + /** @var array */ |
|
| 64 | + protected $userPasswords; |
|
| 65 | + |
|
| 66 | + /** @var IConfig */ |
|
| 67 | + protected $config; |
|
| 68 | + |
|
| 69 | + /** @var IMailer */ |
|
| 70 | + protected $mailer; |
|
| 71 | + |
|
| 72 | + /** @var IL10N */ |
|
| 73 | + protected $l; |
|
| 74 | + |
|
| 75 | + /** @var QuestionHelper */ |
|
| 76 | + protected $questionHelper; |
|
| 77 | + |
|
| 78 | + /** @var OutputInterface */ |
|
| 79 | + protected $output; |
|
| 80 | + |
|
| 81 | + /** @var InputInterface */ |
|
| 82 | + protected $input; |
|
| 83 | + |
|
| 84 | + /** @var ISecureRandom */ |
|
| 85 | + protected $secureRandom; |
|
| 86 | + |
|
| 87 | + /** |
|
| 88 | + * @param Setup $userSetup |
|
| 89 | + * @param IUserManager $userManager |
|
| 90 | + * @param View $rootView |
|
| 91 | + * @param KeyManager $keyManager |
|
| 92 | + * @param Util $util |
|
| 93 | + * @param IConfig $config |
|
| 94 | + * @param IMailer $mailer |
|
| 95 | + * @param IL10N $l |
|
| 96 | + * @param QuestionHelper $questionHelper |
|
| 97 | + * @param ISecureRandom $secureRandom |
|
| 98 | + */ |
|
| 99 | + public function __construct( |
|
| 100 | + Setup $userSetup, |
|
| 101 | + IUserManager $userManager, |
|
| 102 | + View $rootView, |
|
| 103 | + KeyManager $keyManager, |
|
| 104 | + Util $util, |
|
| 105 | + IConfig $config, |
|
| 106 | + IMailer $mailer, |
|
| 107 | + IL10N $l, |
|
| 108 | + QuestionHelper $questionHelper, |
|
| 109 | + ISecureRandom $secureRandom |
|
| 110 | + ) { |
|
| 111 | + $this->userSetup = $userSetup; |
|
| 112 | + $this->userManager = $userManager; |
|
| 113 | + $this->rootView = $rootView; |
|
| 114 | + $this->keyManager = $keyManager; |
|
| 115 | + $this->util = $util; |
|
| 116 | + $this->config = $config; |
|
| 117 | + $this->mailer = $mailer; |
|
| 118 | + $this->l = $l; |
|
| 119 | + $this->questionHelper = $questionHelper; |
|
| 120 | + $this->secureRandom = $secureRandom; |
|
| 121 | + // store one time passwords for the users |
|
| 122 | + $this->userPasswords = array(); |
|
| 123 | + } |
|
| 124 | + |
|
| 125 | + /** |
|
| 126 | + * start to encrypt all files |
|
| 127 | + * |
|
| 128 | + * @param InputInterface $input |
|
| 129 | + * @param OutputInterface $output |
|
| 130 | + */ |
|
| 131 | + public function encryptAll(InputInterface $input, OutputInterface $output) { |
|
| 132 | + |
|
| 133 | + $this->input = $input; |
|
| 134 | + $this->output = $output; |
|
| 135 | + |
|
| 136 | + $headline = 'Encrypt all files with the ' . Encryption::DISPLAY_NAME; |
|
| 137 | + $this->output->writeln("\n"); |
|
| 138 | + $this->output->writeln($headline); |
|
| 139 | + $this->output->writeln(str_pad('', strlen($headline), '=')); |
|
| 140 | + $this->output->writeln("\n"); |
|
| 141 | + |
|
| 142 | + if ($this->util->isMasterKeyEnabled()) { |
|
| 143 | + $this->output->writeln('Use master key to encrypt all files.'); |
|
| 144 | + $this->keyManager->validateMasterKey(); |
|
| 145 | + } else { |
|
| 146 | + //create private/public keys for each user and store the private key password |
|
| 147 | + $this->output->writeln('Create key-pair for every user'); |
|
| 148 | + $this->output->writeln('------------------------------'); |
|
| 149 | + $this->output->writeln(''); |
|
| 150 | + $this->output->writeln('This module will encrypt all files in the users files folder initially.'); |
|
| 151 | + $this->output->writeln('Already existing versions and files in the trash bin will not be encrypted.'); |
|
| 152 | + $this->output->writeln(''); |
|
| 153 | + $this->createKeyPairs(); |
|
| 154 | + } |
|
| 155 | + |
|
| 156 | + |
|
| 157 | + // output generated encryption key passwords |
|
| 158 | + if ($this->util->isMasterKeyEnabled() === false) { |
|
| 159 | + //send-out or display password list and write it to a file |
|
| 160 | + $this->output->writeln("\n"); |
|
| 161 | + $this->output->writeln('Generated encryption key passwords'); |
|
| 162 | + $this->output->writeln('----------------------------------'); |
|
| 163 | + $this->output->writeln(''); |
|
| 164 | + $this->outputPasswords(); |
|
| 165 | + } |
|
| 166 | + |
|
| 167 | + //setup users file system and encrypt all files one by one (take should encrypt setting of storage into account) |
|
| 168 | + $this->output->writeln("\n"); |
|
| 169 | + $this->output->writeln('Start to encrypt users files'); |
|
| 170 | + $this->output->writeln('----------------------------'); |
|
| 171 | + $this->output->writeln(''); |
|
| 172 | + $this->encryptAllUsersFiles(); |
|
| 173 | + $this->output->writeln("\n"); |
|
| 174 | + } |
|
| 175 | + |
|
| 176 | + /** |
|
| 177 | + * create key-pair for every user |
|
| 178 | + */ |
|
| 179 | + protected function createKeyPairs() { |
|
| 180 | + $this->output->writeln("\n"); |
|
| 181 | + $progress = new ProgressBar($this->output); |
|
| 182 | + $progress->setFormat(" %message% \n [%bar%]"); |
|
| 183 | + $progress->start(); |
|
| 184 | + |
|
| 185 | + foreach($this->userManager->getBackends() as $backend) { |
|
| 186 | + $limit = 500; |
|
| 187 | + $offset = 0; |
|
| 188 | + do { |
|
| 189 | + $users = $backend->getUsers('', $limit, $offset); |
|
| 190 | + foreach ($users as $user) { |
|
| 191 | + if ($this->keyManager->userHasKeys($user) === false) { |
|
| 192 | + $progress->setMessage('Create key-pair for ' . $user); |
|
| 193 | + $progress->advance(); |
|
| 194 | + $this->setupUserFS($user); |
|
| 195 | + $password = $this->generateOneTimePassword($user); |
|
| 196 | + $this->userSetup->setupUser($user, $password); |
|
| 197 | + } else { |
|
| 198 | + // users which already have a key-pair will be stored with a |
|
| 199 | + // empty password and filtered out later |
|
| 200 | + $this->userPasswords[$user] = ''; |
|
| 201 | + } |
|
| 202 | + } |
|
| 203 | + $offset += $limit; |
|
| 204 | + } while(count($users) >= $limit); |
|
| 205 | + } |
|
| 206 | + |
|
| 207 | + $progress->setMessage('Key-pair created for all users'); |
|
| 208 | + $progress->finish(); |
|
| 209 | + } |
|
| 210 | + |
|
| 211 | + /** |
|
| 212 | + * iterate over all user and encrypt their files |
|
| 213 | + */ |
|
| 214 | + protected function encryptAllUsersFiles() { |
|
| 215 | + $this->output->writeln("\n"); |
|
| 216 | + $progress = new ProgressBar($this->output); |
|
| 217 | + $progress->setFormat(" %message% \n [%bar%]"); |
|
| 218 | + $progress->start(); |
|
| 219 | + $numberOfUsers = count($this->userPasswords); |
|
| 220 | + $userNo = 1; |
|
| 221 | + if ($this->util->isMasterKeyEnabled()) { |
|
| 222 | + $this->encryptAllUserFilesWithMasterKey($progress); |
|
| 223 | + } else { |
|
| 224 | + foreach ($this->userPasswords as $uid => $password) { |
|
| 225 | + $userCount = "$uid ($userNo of $numberOfUsers)"; |
|
| 226 | + $this->encryptUsersFiles($uid, $progress, $userCount); |
|
| 227 | + $userNo++; |
|
| 228 | + } |
|
| 229 | + } |
|
| 230 | + $progress->setMessage("all files encrypted"); |
|
| 231 | + $progress->finish(); |
|
| 232 | + |
|
| 233 | + } |
|
| 234 | + |
|
| 235 | + /** |
|
| 236 | + * encrypt all user files with the master key |
|
| 237 | + * |
|
| 238 | + * @param ProgressBar $progress |
|
| 239 | + */ |
|
| 240 | + protected function encryptAllUserFilesWithMasterKey(ProgressBar $progress) { |
|
| 241 | + $userNo = 1; |
|
| 242 | + foreach($this->userManager->getBackends() as $backend) { |
|
| 243 | + $limit = 500; |
|
| 244 | + $offset = 0; |
|
| 245 | + do { |
|
| 246 | + $users = $backend->getUsers('', $limit, $offset); |
|
| 247 | + foreach ($users as $user) { |
|
| 248 | + $userCount = "$user ($userNo)"; |
|
| 249 | + $this->encryptUsersFiles($user, $progress, $userCount); |
|
| 250 | + $userNo++; |
|
| 251 | + } |
|
| 252 | + $offset += $limit; |
|
| 253 | + } while(count($users) >= $limit); |
|
| 254 | + } |
|
| 255 | + } |
|
| 256 | + |
|
| 257 | + /** |
|
| 258 | + * encrypt files from the given user |
|
| 259 | + * |
|
| 260 | + * @param string $uid |
|
| 261 | + * @param ProgressBar $progress |
|
| 262 | + * @param string $userCount |
|
| 263 | + */ |
|
| 264 | + protected function encryptUsersFiles($uid, ProgressBar $progress, $userCount) { |
|
| 265 | + |
|
| 266 | + $this->setupUserFS($uid); |
|
| 267 | + $directories = array(); |
|
| 268 | + $directories[] = '/' . $uid . '/files'; |
|
| 269 | + |
|
| 270 | + while($root = array_pop($directories)) { |
|
| 271 | + $content = $this->rootView->getDirectoryContent($root); |
|
| 272 | + foreach ($content as $file) { |
|
| 273 | + $path = $root . '/' . $file['name']; |
|
| 274 | + if ($this->rootView->is_dir($path)) { |
|
| 275 | + $directories[] = $path; |
|
| 276 | + continue; |
|
| 277 | + } else { |
|
| 278 | + $progress->setMessage("encrypt files for user $userCount: $path"); |
|
| 279 | + $progress->advance(); |
|
| 280 | + if($this->encryptFile($path) === false) { |
|
| 281 | + $progress->setMessage("encrypt files for user $userCount: $path (already encrypted)"); |
|
| 282 | + $progress->advance(); |
|
| 283 | + } |
|
| 284 | + } |
|
| 285 | + } |
|
| 286 | + } |
|
| 287 | + } |
|
| 288 | + |
|
| 289 | + /** |
|
| 290 | + * encrypt file |
|
| 291 | + * |
|
| 292 | + * @param string $path |
|
| 293 | + * @return bool |
|
| 294 | + */ |
|
| 295 | + protected function encryptFile($path) { |
|
| 296 | + |
|
| 297 | + $source = $path; |
|
| 298 | + $target = $path . '.encrypted.' . time(); |
|
| 299 | + |
|
| 300 | + try { |
|
| 301 | + $this->rootView->copy($source, $target); |
|
| 302 | + $this->rootView->rename($target, $source); |
|
| 303 | + } catch (DecryptionFailedException $e) { |
|
| 304 | + if ($this->rootView->file_exists($target)) { |
|
| 305 | + $this->rootView->unlink($target); |
|
| 306 | + } |
|
| 307 | + return false; |
|
| 308 | + } |
|
| 309 | + |
|
| 310 | + return true; |
|
| 311 | + } |
|
| 312 | + |
|
| 313 | + /** |
|
| 314 | + * output one-time encryption passwords |
|
| 315 | + */ |
|
| 316 | + protected function outputPasswords() { |
|
| 317 | + $table = new Table($this->output); |
|
| 318 | + $table->setHeaders(array('Username', 'Private key password')); |
|
| 319 | + |
|
| 320 | + //create rows |
|
| 321 | + $newPasswords = array(); |
|
| 322 | + $unchangedPasswords = array(); |
|
| 323 | + foreach ($this->userPasswords as $uid => $password) { |
|
| 324 | + if (empty($password)) { |
|
| 325 | + $unchangedPasswords[] = $uid; |
|
| 326 | + } else { |
|
| 327 | + $newPasswords[] = [$uid, $password]; |
|
| 328 | + } |
|
| 329 | + } |
|
| 330 | + |
|
| 331 | + if (empty($newPasswords)) { |
|
| 332 | + $this->output->writeln("\nAll users already had a key-pair, no further action needed.\n"); |
|
| 333 | + return; |
|
| 334 | + } |
|
| 335 | + |
|
| 336 | + $table->setRows($newPasswords); |
|
| 337 | + $table->render(); |
|
| 338 | + |
|
| 339 | + if (!empty($unchangedPasswords)) { |
|
| 340 | + $this->output->writeln("\nThe following users already had a key-pair which was reused without setting a new password:\n"); |
|
| 341 | + foreach ($unchangedPasswords as $uid) { |
|
| 342 | + $this->output->writeln(" $uid"); |
|
| 343 | + } |
|
| 344 | + } |
|
| 345 | + |
|
| 346 | + $this->writePasswordsToFile($newPasswords); |
|
| 347 | + |
|
| 348 | + $this->output->writeln(''); |
|
| 349 | + $question = new ConfirmationQuestion('Do you want to send the passwords directly to the users by mail? (y/n) ', false); |
|
| 350 | + if ($this->questionHelper->ask($this->input, $this->output, $question)) { |
|
| 351 | + $this->sendPasswordsByMail(); |
|
| 352 | + } |
|
| 353 | + } |
|
| 354 | + |
|
| 355 | + /** |
|
| 356 | + * write one-time encryption passwords to a csv file |
|
| 357 | + * |
|
| 358 | + * @param array $passwords |
|
| 359 | + */ |
|
| 360 | + protected function writePasswordsToFile(array $passwords) { |
|
| 361 | + $fp = $this->rootView->fopen('oneTimeEncryptionPasswords.csv', 'w'); |
|
| 362 | + foreach ($passwords as $pwd) { |
|
| 363 | + fputcsv($fp, $pwd); |
|
| 364 | + } |
|
| 365 | + fclose($fp); |
|
| 366 | + $this->output->writeln("\n"); |
|
| 367 | + $this->output->writeln('A list of all newly created passwords was written to data/oneTimeEncryptionPasswords.csv'); |
|
| 368 | + $this->output->writeln(''); |
|
| 369 | + $this->output->writeln('Each of these users need to login to the web interface, go to the'); |
|
| 370 | + $this->output->writeln('personal settings section "basic encryption module" and'); |
|
| 371 | + $this->output->writeln('update the private key password to match the login password again by'); |
|
| 372 | + $this->output->writeln('entering the one-time password into the "old log-in password" field'); |
|
| 373 | + $this->output->writeln('and their current login password'); |
|
| 374 | + } |
|
| 375 | + |
|
| 376 | + /** |
|
| 377 | + * setup user file system |
|
| 378 | + * |
|
| 379 | + * @param string $uid |
|
| 380 | + */ |
|
| 381 | + protected function setupUserFS($uid) { |
|
| 382 | + \OC_Util::tearDownFS(); |
|
| 383 | + \OC_Util::setupFS($uid); |
|
| 384 | + } |
|
| 385 | + |
|
| 386 | + /** |
|
| 387 | + * generate one time password for the user and store it in a array |
|
| 388 | + * |
|
| 389 | + * @param string $uid |
|
| 390 | + * @return string password |
|
| 391 | + */ |
|
| 392 | + protected function generateOneTimePassword($uid) { |
|
| 393 | + $password = $this->secureRandom->generate(8); |
|
| 394 | + $this->userPasswords[$uid] = $password; |
|
| 395 | + return $password; |
|
| 396 | + } |
|
| 397 | + |
|
| 398 | + /** |
|
| 399 | + * send encryption key passwords to the users by mail |
|
| 400 | + */ |
|
| 401 | + protected function sendPasswordsByMail() { |
|
| 402 | + $noMail = []; |
|
| 403 | + |
|
| 404 | + $this->output->writeln(''); |
|
| 405 | + $progress = new ProgressBar($this->output, count($this->userPasswords)); |
|
| 406 | + $progress->start(); |
|
| 407 | + |
|
| 408 | + foreach ($this->userPasswords as $uid => $password) { |
|
| 409 | + $progress->advance(); |
|
| 410 | + if (!empty($password)) { |
|
| 411 | + $recipient = $this->userManager->get($uid); |
|
| 412 | + $recipientDisplayName = $recipient->getDisplayName(); |
|
| 413 | + $to = $recipient->getEMailAddress(); |
|
| 414 | + |
|
| 415 | + if ($to === '') { |
|
| 416 | + $noMail[] = $uid; |
|
| 417 | + continue; |
|
| 418 | + } |
|
| 419 | + |
|
| 420 | + $subject = (string)$this->l->t('one-time password for server-side-encryption'); |
|
| 421 | + list($htmlBody, $textBody) = $this->createMailBody($password); |
|
| 422 | + |
|
| 423 | + // send it out now |
|
| 424 | + try { |
|
| 425 | + $message = $this->mailer->createMessage(); |
|
| 426 | + $message->setSubject($subject); |
|
| 427 | + $message->setTo([$to => $recipientDisplayName]); |
|
| 428 | + $message->setHtmlBody($htmlBody); |
|
| 429 | + $message->setPlainBody($textBody); |
|
| 430 | + $message->setFrom([ |
|
| 431 | + \OCP\Util::getDefaultEmailAddress('admin-noreply') |
|
| 432 | + ]); |
|
| 433 | + |
|
| 434 | + $this->mailer->send($message); |
|
| 435 | + } catch (\Exception $e) { |
|
| 436 | + $noMail[] = $uid; |
|
| 437 | + } |
|
| 438 | + } |
|
| 439 | + } |
|
| 440 | + |
|
| 441 | + $progress->finish(); |
|
| 442 | + |
|
| 443 | + if (empty($noMail)) { |
|
| 444 | + $this->output->writeln("\n\nPassword successfully send to all users"); |
|
| 445 | + } else { |
|
| 446 | + $table = new Table($this->output); |
|
| 447 | + $table->setHeaders(array('Username', 'Private key password')); |
|
| 448 | + $this->output->writeln("\n\nCould not send password to following users:\n"); |
|
| 449 | + $rows = []; |
|
| 450 | + foreach ($noMail as $uid) { |
|
| 451 | + $rows[] = [$uid, $this->userPasswords[$uid]]; |
|
| 452 | + } |
|
| 453 | + $table->setRows($rows); |
|
| 454 | + $table->render(); |
|
| 455 | + } |
|
| 456 | + |
|
| 457 | + } |
|
| 458 | + |
|
| 459 | + /** |
|
| 460 | + * create mail body for plain text and html mail |
|
| 461 | + * |
|
| 462 | + * @param string $password one-time encryption password |
|
| 463 | + * @return array an array of the html mail body and the plain text mail body |
|
| 464 | + */ |
|
| 465 | + protected function createMailBody($password) { |
|
| 466 | + |
|
| 467 | + $html = new \OC_Template("encryption", "mail", ""); |
|
| 468 | + $html->assign ('password', $password); |
|
| 469 | + $htmlMail = $html->fetchPage(); |
|
| 470 | + |
|
| 471 | + $plainText = new \OC_Template("encryption", "altmail", ""); |
|
| 472 | + $plainText->assign ('password', $password); |
|
| 473 | + $plainTextMail = $plainText->fetchPage(); |
|
| 474 | + |
|
| 475 | + return [$htmlMail, $plainTextMail]; |
|
| 476 | + } |
|
| 477 | 477 | |
| 478 | 478 | } |
@@ -35,127 +35,127 @@ |
||
| 35 | 35 | |
| 36 | 36 | class DecryptAll { |
| 37 | 37 | |
| 38 | - /** @var Util */ |
|
| 39 | - protected $util; |
|
| 40 | - |
|
| 41 | - /** @var QuestionHelper */ |
|
| 42 | - protected $questionHelper; |
|
| 43 | - |
|
| 44 | - /** @var Crypt */ |
|
| 45 | - protected $crypt; |
|
| 46 | - |
|
| 47 | - /** @var KeyManager */ |
|
| 48 | - protected $keyManager; |
|
| 49 | - |
|
| 50 | - /** @var Session */ |
|
| 51 | - protected $session; |
|
| 52 | - |
|
| 53 | - /** |
|
| 54 | - * @param Util $util |
|
| 55 | - * @param KeyManager $keyManager |
|
| 56 | - * @param Crypt $crypt |
|
| 57 | - * @param Session $session |
|
| 58 | - * @param QuestionHelper $questionHelper |
|
| 59 | - */ |
|
| 60 | - public function __construct( |
|
| 61 | - Util $util, |
|
| 62 | - KeyManager $keyManager, |
|
| 63 | - Crypt $crypt, |
|
| 64 | - Session $session, |
|
| 65 | - QuestionHelper $questionHelper |
|
| 66 | - ) { |
|
| 67 | - $this->util = $util; |
|
| 68 | - $this->keyManager = $keyManager; |
|
| 69 | - $this->crypt = $crypt; |
|
| 70 | - $this->session = $session; |
|
| 71 | - $this->questionHelper = $questionHelper; |
|
| 72 | - } |
|
| 73 | - |
|
| 74 | - /** |
|
| 75 | - * prepare encryption module to decrypt all files |
|
| 76 | - * |
|
| 77 | - * @param InputInterface $input |
|
| 78 | - * @param OutputInterface $output |
|
| 79 | - * @param $user |
|
| 80 | - * @return bool |
|
| 81 | - */ |
|
| 82 | - public function prepare(InputInterface $input, OutputInterface $output, $user) { |
|
| 83 | - |
|
| 84 | - $question = new Question('Please enter the recovery key password: '); |
|
| 85 | - |
|
| 86 | - if($this->util->isMasterKeyEnabled()) { |
|
| 87 | - $output->writeln('Use master key to decrypt all files'); |
|
| 88 | - $user = $this->keyManager->getMasterKeyId(); |
|
| 89 | - $password =$this->keyManager->getMasterKeyPassword(); |
|
| 90 | - } else { |
|
| 91 | - $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
|
| 92 | - if (!empty($user)) { |
|
| 93 | - $output->writeln('You can only decrypt the users files if you know'); |
|
| 94 | - $output->writeln('the users password or if he activated the recovery key.'); |
|
| 95 | - $output->writeln(''); |
|
| 96 | - $questionUseLoginPassword = new ConfirmationQuestion( |
|
| 97 | - 'Do you want to use the users login password to decrypt all files? (y/n) ', |
|
| 98 | - false |
|
| 99 | - ); |
|
| 100 | - $useLoginPassword = $this->questionHelper->ask($input, $output, $questionUseLoginPassword); |
|
| 101 | - if ($useLoginPassword) { |
|
| 102 | - $question = new Question('Please enter the user\'s login password: '); |
|
| 103 | - } else if ($this->util->isRecoveryEnabledForUser($user) === false) { |
|
| 104 | - $output->writeln('No recovery key available for user ' . $user); |
|
| 105 | - return false; |
|
| 106 | - } else { |
|
| 107 | - $user = $recoveryKeyId; |
|
| 108 | - } |
|
| 109 | - } else { |
|
| 110 | - $output->writeln('You can only decrypt the files of all users if the'); |
|
| 111 | - $output->writeln('recovery key is enabled by the admin and activated by the users.'); |
|
| 112 | - $output->writeln(''); |
|
| 113 | - $user = $recoveryKeyId; |
|
| 114 | - } |
|
| 115 | - |
|
| 116 | - $question->setHidden(true); |
|
| 117 | - $question->setHiddenFallback(false); |
|
| 118 | - $password = $this->questionHelper->ask($input, $output, $question); |
|
| 119 | - } |
|
| 120 | - |
|
| 121 | - $privateKey = $this->getPrivateKey($user, $password); |
|
| 122 | - if ($privateKey !== false) { |
|
| 123 | - $this->updateSession($user, $privateKey); |
|
| 124 | - return true; |
|
| 125 | - } else { |
|
| 126 | - $output->writeln('Could not decrypt private key, maybe you entered the wrong password?'); |
|
| 127 | - } |
|
| 128 | - |
|
| 129 | - |
|
| 130 | - return false; |
|
| 131 | - } |
|
| 132 | - |
|
| 133 | - /** |
|
| 134 | - * get the private key which will be used to decrypt all files |
|
| 135 | - * |
|
| 136 | - * @param string $user |
|
| 137 | - * @param string $password |
|
| 138 | - * @return bool|string |
|
| 139 | - * @throws \OCA\Encryption\Exceptions\PrivateKeyMissingException |
|
| 140 | - */ |
|
| 141 | - protected function getPrivateKey($user, $password) { |
|
| 142 | - $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
|
| 143 | - $masterKeyId = $this->keyManager->getMasterKeyId(); |
|
| 144 | - if ($user === $recoveryKeyId) { |
|
| 145 | - $recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId); |
|
| 146 | - $privateKey = $this->crypt->decryptPrivateKey($recoveryKey, $password); |
|
| 147 | - } elseif ($user === $masterKeyId) { |
|
| 148 | - $masterKey = $this->keyManager->getSystemPrivateKey($masterKeyId); |
|
| 149 | - $privateKey = $this->crypt->decryptPrivateKey($masterKey, $password, $masterKeyId); |
|
| 150 | - } else { |
|
| 151 | - $userKey = $this->keyManager->getPrivateKey($user); |
|
| 152 | - $privateKey = $this->crypt->decryptPrivateKey($userKey, $password, $user); |
|
| 153 | - } |
|
| 154 | - |
|
| 155 | - return $privateKey; |
|
| 156 | - } |
|
| 157 | - |
|
| 158 | - protected function updateSession($user, $privateKey) { |
|
| 159 | - $this->session->prepareDecryptAll($user, $privateKey); |
|
| 160 | - } |
|
| 38 | + /** @var Util */ |
|
| 39 | + protected $util; |
|
| 40 | + |
|
| 41 | + /** @var QuestionHelper */ |
|
| 42 | + protected $questionHelper; |
|
| 43 | + |
|
| 44 | + /** @var Crypt */ |
|
| 45 | + protected $crypt; |
|
| 46 | + |
|
| 47 | + /** @var KeyManager */ |
|
| 48 | + protected $keyManager; |
|
| 49 | + |
|
| 50 | + /** @var Session */ |
|
| 51 | + protected $session; |
|
| 52 | + |
|
| 53 | + /** |
|
| 54 | + * @param Util $util |
|
| 55 | + * @param KeyManager $keyManager |
|
| 56 | + * @param Crypt $crypt |
|
| 57 | + * @param Session $session |
|
| 58 | + * @param QuestionHelper $questionHelper |
|
| 59 | + */ |
|
| 60 | + public function __construct( |
|
| 61 | + Util $util, |
|
| 62 | + KeyManager $keyManager, |
|
| 63 | + Crypt $crypt, |
|
| 64 | + Session $session, |
|
| 65 | + QuestionHelper $questionHelper |
|
| 66 | + ) { |
|
| 67 | + $this->util = $util; |
|
| 68 | + $this->keyManager = $keyManager; |
|
| 69 | + $this->crypt = $crypt; |
|
| 70 | + $this->session = $session; |
|
| 71 | + $this->questionHelper = $questionHelper; |
|
| 72 | + } |
|
| 73 | + |
|
| 74 | + /** |
|
| 75 | + * prepare encryption module to decrypt all files |
|
| 76 | + * |
|
| 77 | + * @param InputInterface $input |
|
| 78 | + * @param OutputInterface $output |
|
| 79 | + * @param $user |
|
| 80 | + * @return bool |
|
| 81 | + */ |
|
| 82 | + public function prepare(InputInterface $input, OutputInterface $output, $user) { |
|
| 83 | + |
|
| 84 | + $question = new Question('Please enter the recovery key password: '); |
|
| 85 | + |
|
| 86 | + if($this->util->isMasterKeyEnabled()) { |
|
| 87 | + $output->writeln('Use master key to decrypt all files'); |
|
| 88 | + $user = $this->keyManager->getMasterKeyId(); |
|
| 89 | + $password =$this->keyManager->getMasterKeyPassword(); |
|
| 90 | + } else { |
|
| 91 | + $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
|
| 92 | + if (!empty($user)) { |
|
| 93 | + $output->writeln('You can only decrypt the users files if you know'); |
|
| 94 | + $output->writeln('the users password or if he activated the recovery key.'); |
|
| 95 | + $output->writeln(''); |
|
| 96 | + $questionUseLoginPassword = new ConfirmationQuestion( |
|
| 97 | + 'Do you want to use the users login password to decrypt all files? (y/n) ', |
|
| 98 | + false |
|
| 99 | + ); |
|
| 100 | + $useLoginPassword = $this->questionHelper->ask($input, $output, $questionUseLoginPassword); |
|
| 101 | + if ($useLoginPassword) { |
|
| 102 | + $question = new Question('Please enter the user\'s login password: '); |
|
| 103 | + } else if ($this->util->isRecoveryEnabledForUser($user) === false) { |
|
| 104 | + $output->writeln('No recovery key available for user ' . $user); |
|
| 105 | + return false; |
|
| 106 | + } else { |
|
| 107 | + $user = $recoveryKeyId; |
|
| 108 | + } |
|
| 109 | + } else { |
|
| 110 | + $output->writeln('You can only decrypt the files of all users if the'); |
|
| 111 | + $output->writeln('recovery key is enabled by the admin and activated by the users.'); |
|
| 112 | + $output->writeln(''); |
|
| 113 | + $user = $recoveryKeyId; |
|
| 114 | + } |
|
| 115 | + |
|
| 116 | + $question->setHidden(true); |
|
| 117 | + $question->setHiddenFallback(false); |
|
| 118 | + $password = $this->questionHelper->ask($input, $output, $question); |
|
| 119 | + } |
|
| 120 | + |
|
| 121 | + $privateKey = $this->getPrivateKey($user, $password); |
|
| 122 | + if ($privateKey !== false) { |
|
| 123 | + $this->updateSession($user, $privateKey); |
|
| 124 | + return true; |
|
| 125 | + } else { |
|
| 126 | + $output->writeln('Could not decrypt private key, maybe you entered the wrong password?'); |
|
| 127 | + } |
|
| 128 | + |
|
| 129 | + |
|
| 130 | + return false; |
|
| 131 | + } |
|
| 132 | + |
|
| 133 | + /** |
|
| 134 | + * get the private key which will be used to decrypt all files |
|
| 135 | + * |
|
| 136 | + * @param string $user |
|
| 137 | + * @param string $password |
|
| 138 | + * @return bool|string |
|
| 139 | + * @throws \OCA\Encryption\Exceptions\PrivateKeyMissingException |
|
| 140 | + */ |
|
| 141 | + protected function getPrivateKey($user, $password) { |
|
| 142 | + $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
|
| 143 | + $masterKeyId = $this->keyManager->getMasterKeyId(); |
|
| 144 | + if ($user === $recoveryKeyId) { |
|
| 145 | + $recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId); |
|
| 146 | + $privateKey = $this->crypt->decryptPrivateKey($recoveryKey, $password); |
|
| 147 | + } elseif ($user === $masterKeyId) { |
|
| 148 | + $masterKey = $this->keyManager->getSystemPrivateKey($masterKeyId); |
|
| 149 | + $privateKey = $this->crypt->decryptPrivateKey($masterKey, $password, $masterKeyId); |
|
| 150 | + } else { |
|
| 151 | + $userKey = $this->keyManager->getPrivateKey($user); |
|
| 152 | + $privateKey = $this->crypt->decryptPrivateKey($userKey, $password, $user); |
|
| 153 | + } |
|
| 154 | + |
|
| 155 | + return $privateKey; |
|
| 156 | + } |
|
| 157 | + |
|
| 158 | + protected function updateSession($user, $privateKey) { |
|
| 159 | + $this->session->prepareDecryptAll($user, $privateKey); |
|
| 160 | + } |
|
| 161 | 161 | } |
@@ -83,10 +83,10 @@ discard block |
||
| 83 | 83 | |
| 84 | 84 | $question = new Question('Please enter the recovery key password: '); |
| 85 | 85 | |
| 86 | - if($this->util->isMasterKeyEnabled()) { |
|
| 86 | + if ($this->util->isMasterKeyEnabled()) { |
|
| 87 | 87 | $output->writeln('Use master key to decrypt all files'); |
| 88 | 88 | $user = $this->keyManager->getMasterKeyId(); |
| 89 | - $password =$this->keyManager->getMasterKeyPassword(); |
|
| 89 | + $password = $this->keyManager->getMasterKeyPassword(); |
|
| 90 | 90 | } else { |
| 91 | 91 | $recoveryKeyId = $this->keyManager->getRecoveryKeyId(); |
| 92 | 92 | if (!empty($user)) { |
@@ -101,7 +101,7 @@ discard block |
||
| 101 | 101 | if ($useLoginPassword) { |
| 102 | 102 | $question = new Question('Please enter the user\'s login password: '); |
| 103 | 103 | } else if ($this->util->isRecoveryEnabledForUser($user) === false) { |
| 104 | - $output->writeln('No recovery key available for user ' . $user); |
|
| 104 | + $output->writeln('No recovery key available for user '.$user); |
|
| 105 | 105 | return false; |
| 106 | 106 | } else { |
| 107 | 107 | $user = $recoveryKeyId; |
@@ -28,38 +28,38 @@ |
||
| 28 | 28 | |
| 29 | 29 | class HookManager { |
| 30 | 30 | |
| 31 | - private $hookInstances = []; |
|
| 31 | + private $hookInstances = []; |
|
| 32 | 32 | |
| 33 | - /** |
|
| 34 | - * @param array|IHook $instances |
|
| 35 | - * - This accepts either a single instance of IHook or an array of instances of IHook |
|
| 36 | - * @return bool |
|
| 37 | - */ |
|
| 38 | - public function registerHook($instances) { |
|
| 39 | - if (is_array($instances)) { |
|
| 40 | - foreach ($instances as $instance) { |
|
| 41 | - if (!$instance instanceof IHook) { |
|
| 42 | - return false; |
|
| 43 | - } |
|
| 44 | - $this->hookInstances[] = $instance; |
|
| 45 | - } |
|
| 33 | + /** |
|
| 34 | + * @param array|IHook $instances |
|
| 35 | + * - This accepts either a single instance of IHook or an array of instances of IHook |
|
| 36 | + * @return bool |
|
| 37 | + */ |
|
| 38 | + public function registerHook($instances) { |
|
| 39 | + if (is_array($instances)) { |
|
| 40 | + foreach ($instances as $instance) { |
|
| 41 | + if (!$instance instanceof IHook) { |
|
| 42 | + return false; |
|
| 43 | + } |
|
| 44 | + $this->hookInstances[] = $instance; |
|
| 45 | + } |
|
| 46 | 46 | |
| 47 | - } elseif ($instances instanceof IHook) { |
|
| 48 | - $this->hookInstances[] = $instances; |
|
| 49 | - } |
|
| 50 | - return true; |
|
| 51 | - } |
|
| 47 | + } elseif ($instances instanceof IHook) { |
|
| 48 | + $this->hookInstances[] = $instances; |
|
| 49 | + } |
|
| 50 | + return true; |
|
| 51 | + } |
|
| 52 | 52 | |
| 53 | - public function fireHooks() { |
|
| 54 | - foreach ($this->hookInstances as $instance) { |
|
| 55 | - /** |
|
| 56 | - * Fire off the add hooks method of each instance stored in cache |
|
| 57 | - * |
|
| 58 | - * @var $instance IHook |
|
| 59 | - */ |
|
| 60 | - $instance->addHooks(); |
|
| 61 | - } |
|
| 53 | + public function fireHooks() { |
|
| 54 | + foreach ($this->hookInstances as $instance) { |
|
| 55 | + /** |
|
| 56 | + * Fire off the add hooks method of each instance stored in cache |
|
| 57 | + * |
|
| 58 | + * @var $instance IHook |
|
| 59 | + */ |
|
| 60 | + $instance->addHooks(); |
|
| 61 | + } |
|
| 62 | 62 | |
| 63 | - } |
|
| 63 | + } |
|
| 64 | 64 | |
| 65 | 65 | } |
@@ -26,36 +26,36 @@ |
||
| 26 | 26 | |
| 27 | 27 | (new Application())->registerRoutes($this, array('routes' => array( |
| 28 | 28 | |
| 29 | - [ |
|
| 30 | - 'name' => 'Recovery#adminRecovery', |
|
| 31 | - 'url' => '/ajax/adminRecovery', |
|
| 32 | - 'verb' => 'POST' |
|
| 33 | - ], |
|
| 34 | - [ |
|
| 35 | - 'name' => 'Settings#updatePrivateKeyPassword', |
|
| 36 | - 'url' => '/ajax/updatePrivateKeyPassword', |
|
| 37 | - 'verb' => 'POST' |
|
| 38 | - ], |
|
| 39 | - [ |
|
| 40 | - 'name' => 'Settings#setEncryptHomeStorage', |
|
| 41 | - 'url' => '/ajax/setEncryptHomeStorage', |
|
| 42 | - 'verb' => 'POST' |
|
| 43 | - ], |
|
| 44 | - [ |
|
| 45 | - 'name' => 'Recovery#changeRecoveryPassword', |
|
| 46 | - 'url' => '/ajax/changeRecoveryPassword', |
|
| 47 | - 'verb' => 'POST' |
|
| 48 | - ], |
|
| 49 | - [ |
|
| 50 | - 'name' => 'Recovery#userSetRecovery', |
|
| 51 | - 'url' => '/ajax/userSetRecovery', |
|
| 52 | - 'verb' => 'POST' |
|
| 53 | - ], |
|
| 54 | - [ |
|
| 55 | - 'name' => 'Status#getStatus', |
|
| 56 | - 'url' => '/ajax/getStatus', |
|
| 57 | - 'verb' => 'GET' |
|
| 58 | - ] |
|
| 29 | + [ |
|
| 30 | + 'name' => 'Recovery#adminRecovery', |
|
| 31 | + 'url' => '/ajax/adminRecovery', |
|
| 32 | + 'verb' => 'POST' |
|
| 33 | + ], |
|
| 34 | + [ |
|
| 35 | + 'name' => 'Settings#updatePrivateKeyPassword', |
|
| 36 | + 'url' => '/ajax/updatePrivateKeyPassword', |
|
| 37 | + 'verb' => 'POST' |
|
| 38 | + ], |
|
| 39 | + [ |
|
| 40 | + 'name' => 'Settings#setEncryptHomeStorage', |
|
| 41 | + 'url' => '/ajax/setEncryptHomeStorage', |
|
| 42 | + 'verb' => 'POST' |
|
| 43 | + ], |
|
| 44 | + [ |
|
| 45 | + 'name' => 'Recovery#changeRecoveryPassword', |
|
| 46 | + 'url' => '/ajax/changeRecoveryPassword', |
|
| 47 | + 'verb' => 'POST' |
|
| 48 | + ], |
|
| 49 | + [ |
|
| 50 | + 'name' => 'Recovery#userSetRecovery', |
|
| 51 | + 'url' => '/ajax/userSetRecovery', |
|
| 52 | + 'verb' => 'POST' |
|
| 53 | + ], |
|
| 54 | + [ |
|
| 55 | + 'name' => 'Status#getStatus', |
|
| 56 | + 'url' => '/ajax/getStatus', |
|
| 57 | + 'verb' => 'GET' |
|
| 58 | + ] |
|
| 59 | 59 | |
| 60 | 60 | |
| 61 | 61 | ))); |