nextcloud / server

apps/workflowengine/lib/Check/UserGroupMembership.php

Indentation +82 added lines, -82 removed lines

@@ -31,86 +31,86 @@
 
 class UserGroupMembership implements ICheck {
 
-	/** @var string */
-	protected $cachedUser;
-
-	/** @var string[] */
-	protected $cachedGroupMemberships;
-
-	/** @var IUserSession */
-	protected $userSession;
-
-	/** @var IGroupManager */
-	protected $groupManager;
-
-	/** @var IL10N */
-	protected $l;
-
-	/**
-	 * @param IUserSession $userSession
-	 * @param IGroupManager $groupManager
-	 * @param IL10N $l
-	 */
-	public function __construct(IUserSession $userSession, IGroupManager $groupManager, IL10N $l) {
-		$this->userSession = $userSession;
-		$this->groupManager = $groupManager;
-		$this->l = $l;
-	}
-
-	/**
-	 * @param string $operator
-	 * @param string $value
-	 * @return bool
-	 */
-	public function executeCheck($operator, $value) {
-		$user = $this->userSession->getUser();
-
-		if ($user instanceof IUser) {
-			$groupIds = $this->getUserGroups($user);
-			return ($operator === 'is') === in_array($value, $groupIds);
-		} else {
-			return $operator !== 'is';
-		}
-	}
-
-
-	/**
-	 * @param string $operator
-	 * @param string $value
-	 * @throws \UnexpectedValueException
-	 */
-	public function validateCheck($operator, $value) {
-		if (!in_array($operator, ['is', '!is'])) {
-			throw new \UnexpectedValueException($this->l->t('The given operator is invalid'), 1);
-		}
-
-		if (!$this->groupManager->groupExists($value)) {
-			throw new \UnexpectedValueException($this->l->t('The given group does not exist'), 2);
-		}
-	}
-
-	/**
-	 * @param IUser $user
-	 * @return string[]
-	 */
-	protected function getUserGroups(IUser $user) {
-		$uid = $user->getUID();
-
-		if ($this->cachedUser !== $uid) {
-			$this->cachedUser = $uid;
-			$this->cachedGroupMemberships = $this->groupManager->getUserGroupIds($user);
-		}
-
-		return $this->cachedGroupMemberships;
-	}
-
-	public function supportedEntities(): array {
-		// universal by default
-		return [];
-	}
-
-	public function isAvailableForScope(int $scope): bool {
-		// admin only by default
-		return $scope === IManager::SCOPE_ADMIN;
-	}
+    /** @var string */
+    protected $cachedUser;
+
+    /** @var string[] */
+    protected $cachedGroupMemberships;
+
+    /** @var IUserSession */
+    protected $userSession;
+
+    /** @var IGroupManager */
+    protected $groupManager;
+
+    /** @var IL10N */
+    protected $l;
+
+    /**
+     * @param IUserSession $userSession
+     * @param IGroupManager $groupManager
+     * @param IL10N $l
+     */
+    public function __construct(IUserSession $userSession, IGroupManager $groupManager, IL10N $l) {
+        $this->userSession = $userSession;
+        $this->groupManager = $groupManager;
+        $this->l = $l;
+    }
+
+    /**
+     * @param string $operator
+     * @param string $value
+     * @return bool
+     */
+    public function executeCheck($operator, $value) {
+        $user = $this->userSession->getUser();
+
+        if ($user instanceof IUser) {
+            $groupIds = $this->getUserGroups($user);
+            return ($operator === 'is') === in_array($value, $groupIds);
+        } else {
+            return $operator !== 'is';
+        }
+    }
+
+
+    /**
+     * @param string $operator
+     * @param string $value
+     * @throws \UnexpectedValueException
+     */
+    public function validateCheck($operator, $value) {
+        if (!in_array($operator, ['is', '!is'])) {
+            throw new \UnexpectedValueException($this->l->t('The given operator is invalid'), 1);
+        }
+
+        if (!$this->groupManager->groupExists($value)) {
+            throw new \UnexpectedValueException($this->l->t('The given group does not exist'), 2);
+        }
+    }
+
+    /**
+     * @param IUser $user
+     * @return string[]
+     */
+    protected function getUserGroups(IUser $user) {
+        $uid = $user->getUID();
+
+        if ($this->cachedUser !== $uid) {
+            $this->cachedUser = $uid;
+            $this->cachedGroupMemberships = $this->groupManager->getUserGroupIds($user);
+        }
+
+        return $this->cachedGroupMemberships;
+    }
+
+    public function supportedEntities(): array {
+        // universal by default
+        return [];
+    }
+
+    public function isAvailableForScope(int $scope): bool {
+        // admin only by default
+        return $scope === IManager::SCOPE_ADMIN;
+    }
 }

lib/public/WorkflowEngine/IEntityCheck.php

Indentation +16 added lines, -16 removed lines

@@ -34,21 +34,21 @@
  * @since 18.0.0
  */
 interface IEntityCheck {
-	/**
-	 * Equips the check with a subject fitting the Entity. For instance, an
-	 * entity of File will receive an instance of OCP\Files\Node, or a comment
-	 * entity might get an IComment.
-	 *
-	 * The implementing check must be aware of the incoming type.
-	 *
-	 * If an unsupported subject is passed the implementation MAY throw an
-	 * \UnexpectedValueException.
-	 *
-	 * @param IEntity $entity
-	 * @param mixed $subject
-	 * @throws \UnexpectedValueException
-	 * @since 18.0.0
-	 */
-	public function setEntitySubject(IEntity $entity, $subject): void;
+    /**
+     * Equips the check with a subject fitting the Entity. For instance, an
+     * entity of File will receive an instance of OCP\Files\Node, or a comment
+     * entity might get an IComment.
+     *
+     * The implementing check must be aware of the incoming type.
+     *
+     * If an unsupported subject is passed the implementation MAY throw an
+     * \UnexpectedValueException.
+     *
+     * @param IEntity $entity
+     * @param mixed $subject
+     * @throws \UnexpectedValueException
+     * @since 18.0.0
+     */
+    public function setEntitySubject(IEntity $entity, $subject): void;
 
 }

lib/public/WorkflowEngine/ICheck.php

Indentation +36 added lines, -36 removed lines

@@ -31,43 +31,43 @@
  * @since 9.1
  */
 interface ICheck {
-	/**
-	 * @param string $operator
-	 * @param string $value
-	 * @return bool
-	 * @since 9.1
-	 */
-	public function executeCheck($operator, $value);
+    /**
+     * @param string $operator
+     * @param string $value
+     * @return bool
+     * @since 9.1
+     */
+    public function executeCheck($operator, $value);
 
-	/**
-	 * @param string $operator
-	 * @param string $value
-	 * @throws \UnexpectedValueException
-	 * @since 9.1
-	 */
-	public function validateCheck($operator, $value);
+    /**
+     * @param string $operator
+     * @param string $value
+     * @throws \UnexpectedValueException
+     * @since 9.1
+     */
+    public function validateCheck($operator, $value);
 
-	/**
-	 * returns a list of Entities the checker supports. The values must match
-	 * the class name of the entity.
-	 *
-	 * An empty result means the check is universally available.
-	 *
-	 * @since 18.0.0
-	 */
-	public function supportedEntities(): array;
+    /**
+     * returns a list of Entities the checker supports. The values must match
+     * the class name of the entity.
+     *
+     * An empty result means the check is universally available.
+     *
+     * @since 18.0.0
+     */
+    public function supportedEntities(): array;
 
-	/**
-	 * returns whether the operation can be used in the requested scope.
-	 *
-	 * Scope IDs are defined as constants in OCP\WorkflowEngine\IManager. At
-	 * time of writing these are SCOPE_ADMIN and SCOPE_USER.
-	 *
-	 * For possibly unknown future scopes the recommended behaviour is: if
-	 * user scope is permitted, the default behaviour should return `true`,
-	 * otherwise `false`.
-	 *
-	 * @since 18.0.0
-	 */
-	public function isAvailableForScope(int $scope): bool;
+    /**
+     * returns whether the operation can be used in the requested scope.
+     *
+     * Scope IDs are defined as constants in OCP\WorkflowEngine\IManager. At
+     * time of writing these are SCOPE_ADMIN and SCOPE_USER.
+     *
+     * For possibly unknown future scopes the recommended behaviour is: if
+     * user scope is permitted, the default behaviour should return `true`,
+     * otherwise `false`.
+     *
+     * @since 18.0.0
+     */
+    public function isAvailableForScope(int $scope): bool;
 }

lib/public/WorkflowEngine/IEntityEvent.php

Indentation +16 added lines, -16 removed lines

@@ -34,21 +34,21 @@
  * @since 18.0.0
  */
 interface IEntityEvent {
-	/**
-	 * returns a translated name to be presented in the web interface.
-	 *
-	 * Example: "created" (en), "kreita" (eo)
-	 *
-	 * @since 18.0.0
-	 */
-	public function getDisplayName(): string;
+    /**
+     * returns a translated name to be presented in the web interface.
+     *
+     * Example: "created" (en), "kreita" (eo)
+     *
+     * @since 18.0.0
+     */
+    public function getDisplayName(): string;
 
-	/**
-	 * returns the event name that is emitted by the EventDispatcher, e.g.:
-	 *
-	 * Example: "OCA\MyApp\Factory\Cats::postCreated"
-	 *
-	 * @since 18.0.0
-	 */
-	public function getEventName(): string;
+    /**
+     * returns the event name that is emitted by the EventDispatcher, e.g.:
+     *
+     * Example: "OCA\MyApp\Factory\Cats::postCreated"
+     *
+     * @since 18.0.0
+     */
+    public function getEventName(): string;
 }

apps/twofactor_backupcodes/appinfo/routes.php

Indentation +7 added lines, -7 removed lines

@@ -21,12 +21,12 @@
  */
 // @codeCoverageIgnoreStart
 return [
-	'routes' => [
-		[
-			'name' => 'settings#createCodes',
-			'url' => '/settings/create',
-			'verb' => 'POST'
-		],
-	]
+    'routes' => [
+        [
+            'name' => 'settings#createCodes',
+            'url' => '/settings/create',
+            'verb' => 'POST'
+        ],
+    ]
 ];
 // @codeCoverageIgnoreEnd

apps/workflowengine/lib/Check/FileName.php

Spacing +1 added lines, -1 removed lines

@@ -155,7 +155,7 @@
 	}
 
 	public function supportedEntities(): array {
-		return [ File::class ];
+		return [File::class];
 	}
 
 	public function isAvailableForScope(int $scope): bool {

Indentation +53 added lines, -53 removed lines

@@ -31,63 +31,63 @@
 use OCP\WorkflowEngine\IFileCheck;
 
 class FileName extends AbstractStringCheck implements IFileCheck {
-	use TFileCheck;
+    use TFileCheck;
 
-	/** @var IRequest */
-	protected $request;
-	/** @var IMountManager */
-	private $mountManager;
+    /** @var IRequest */
+    protected $request;
+    /** @var IMountManager */
+    private $mountManager;
 
-	/**
-	 * @param IL10N $l
-	 * @param IRequest $request
-	 */
-	public function __construct(IL10N $l, IRequest $request, IMountManager $mountManager) {
-		parent::__construct($l);
-		$this->request = $request;
-		$this->mountManager = $mountManager;
-	}
+    /**
+     * @param IL10N $l
+     * @param IRequest $request
+     */
+    public function __construct(IL10N $l, IRequest $request, IMountManager $mountManager) {
+        parent::__construct($l);
+        $this->request = $request;
+        $this->mountManager = $mountManager;
+    }
 
-	/**
-	 * @return string
-	 */
-	protected function getActualValue(): string {
-		$fileName = $this->path === null ? '' : basename($this->path);
-		if ($fileName === '' && (!$this->storage->isLocal() || $this->storage->instanceOfStorage(Local::class))) {
-			// Return the mountpoint name of external storage that are not mounted as user home
-			$mountPoints = $this->mountManager->findByStorageId($this->storage->getId());
-			if (empty($mountPoints) || $mountPoints[0]->getMountType() !== 'external') {
-				return $fileName;
-			}
-			$mountPointPath = rtrim($mountPoints[0]->getMountPoint(), '/');
-			$mountPointPieces = explode('/', $mountPointPath);
-			$mountPointName = array_pop($mountPointPieces);
-			if (!empty($mountPointName) && $mountPointName !== 'files' && count($mountPointPieces) !== 2) {
-				return $mountPointName;
-			}
-		}
-		return $fileName;
-	}
+    /**
+     * @return string
+     */
+    protected function getActualValue(): string {
+        $fileName = $this->path === null ? '' : basename($this->path);
+        if ($fileName === '' && (!$this->storage->isLocal() || $this->storage->instanceOfStorage(Local::class))) {
+            // Return the mountpoint name of external storage that are not mounted as user home
+            $mountPoints = $this->mountManager->findByStorageId($this->storage->getId());
+            if (empty($mountPoints) || $mountPoints[0]->getMountType() !== 'external') {
+                return $fileName;
+            }
+            $mountPointPath = rtrim($mountPoints[0]->getMountPoint(), '/');
+            $mountPointPieces = explode('/', $mountPointPath);
+            $mountPointName = array_pop($mountPointPieces);
+            if (!empty($mountPointName) && $mountPointName !== 'files' && count($mountPointPieces) !== 2) {
+                return $mountPointName;
+            }
+        }
+        return $fileName;
+    }
 
-	/**
-	 * @param string $operator
-	 * @param string $checkValue
-	 * @param string $actualValue
-	 * @return bool
-	 */
-	protected function executeStringCheck($operator, $checkValue, $actualValue): bool {
-		if ($operator === 'is' || $operator === '!is') {
-			$checkValue = mb_strtolower($checkValue);
-			$actualValue = mb_strtolower($actualValue);
-		}
-		return parent::executeStringCheck($operator, $checkValue, $actualValue);
-	}
+    /**
+     * @param string $operator
+     * @param string $checkValue
+     * @param string $actualValue
+     * @return bool
+     */
+    protected function executeStringCheck($operator, $checkValue, $actualValue): bool {
+        if ($operator === 'is' || $operator === '!is') {
+            $checkValue = mb_strtolower($checkValue);
+            $actualValue = mb_strtolower($actualValue);
+        }
+        return parent::executeStringCheck($operator, $checkValue, $actualValue);
+    }
 
-	public function supportedEntities(): array {
-		return [ File::class ];
-	}
+    public function supportedEntities(): array {
+        return [ File::class ];
+    }
 
-	public function isAvailableForScope(int $scope): bool {
-		return true;
-	}
+    public function isAvailableForScope(int $scope): bool {
+        return true;
+    }
 }

apps/encryption/lib/Hooks/UserHooks.php

Spacing +2 added lines, -2 removed lines

@@ -266,7 +266,7 @@ 
 			// Save private key
 			if ($encryptedPrivateKey) {
 				$this->keyManager->setPrivateKey($user->getUID(),
-					$this->crypt->generateHeader() . $encryptedPrivateKey);
+					$this->crypt->generateHeader().$encryptedPrivateKey);
 			} else {
 				$this->logger->error('Encryption could not update users encryption password');
 			}
@@ -315,7 +315,7 @@ 
 				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $userId);
 
 				if ($encryptedKey) {
-					$this->keyManager->setPrivateKey($userId, $this->crypt->generateHeader() . $encryptedKey);
+					$this->keyManager->setPrivateKey($userId, $this->crypt->generateHeader().$encryptedKey);
 
 					if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files
 						$this->recovery->recoverUsersFiles($recoveryPassword, $userId);

Indentation +300 added lines, -300 removed lines

@@ -44,304 +44,304 @@
 
 class UserHooks implements IHook {
 
-	/**
-	 * list of user for which we perform a password reset
-	 * @var array
-	 */
-	protected static $passwordResetUsers = [];
-
-	/**
-	 * @var KeyManager
-	 */
-	private $keyManager;
-	/**
-	 * @var IUserManager
-	 */
-	private $userManager;
-	/**
-	 * @var ILogger
-	 */
-	private $logger;
-	/**
-	 * @var Setup
-	 */
-	private $userSetup;
-	/**
-	 * @var IUserSession
-	 */
-	private $userSession;
-	/**
-	 * @var Util
-	 */
-	private $util;
-	/**
-	 * @var Session
-	 */
-	private $session;
-	/**
-	 * @var Recovery
-	 */
-	private $recovery;
-	/**
-	 * @var Crypt
-	 */
-	private $crypt;
-
-	/**
-	 * UserHooks constructor.
-	 *
-	 * @param KeyManager $keyManager
-	 * @param IUserManager $userManager
-	 * @param ILogger $logger
-	 * @param Setup $userSetup
-	 * @param IUserSession $userSession
-	 * @param Util $util
-	 * @param Session $session
-	 * @param Crypt $crypt
-	 * @param Recovery $recovery
-	 */
-	public function __construct(KeyManager $keyManager,
-								IUserManager $userManager,
-								ILogger $logger,
-								Setup $userSetup,
-								IUserSession $userSession,
-								Util $util,
-								Session $session,
-								Crypt $crypt,
-								Recovery $recovery) {
-		$this->keyManager = $keyManager;
-		$this->userManager = $userManager;
-		$this->logger = $logger;
-		$this->userSetup = $userSetup;
-		$this->userSession = $userSession;
-		$this->util = $util;
-		$this->session = $session;
-		$this->recovery = $recovery;
-		$this->crypt = $crypt;
-	}
-
-	/**
-	 * Connects Hooks
-	 *
-	 * @return null
-	 */
-	public function addHooks() {
-		OCUtil::connectHook('OC_User', 'post_login', $this, 'login');
-		OCUtil::connectHook('OC_User', 'logout', $this, 'logout');
-
-		// this hooks only make sense if no master key is used
-		if ($this->util->isMasterKeyEnabled() === false) {
-			OCUtil::connectHook('OC_User',
-				'post_setPassword',
-				$this,
-				'setPassphrase');
-
-			OCUtil::connectHook('OC_User',
-				'pre_setPassword',
-				$this,
-				'preSetPassphrase');
-
-			OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
-				'post_passwordReset',
-				$this,
-				'postPasswordReset');
-
-			OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
-				'pre_passwordReset',
-				$this,
-				'prePasswordReset');
-
-			OCUtil::connectHook('OC_User',
-				'post_createUser',
-				$this,
-				'postCreateUser');
-
-			OCUtil::connectHook('OC_User',
-				'post_deleteUser',
-				$this,
-				'postDeleteUser');
-		}
-	}
-
-
-	/**
-	 * Startup encryption backend upon user login
-	 *
-	 * @note This method should never be called for users using client side encryption
-	 * @param array $params
-	 * @return boolean|null
-	 */
-	public function login($params) {
-		// ensure filesystem is loaded
-		if (!\OC\Files\Filesystem::$loaded) {
-			$this->setupFS($params['uid']);
-		}
-		if ($this->util->isMasterKeyEnabled() === false) {
-			$this->userSetup->setupUser($params['uid'], $params['password']);
-		}
-
-		$this->keyManager->init($params['uid'], $params['password']);
-	}
-
-	/**
-	 * remove keys from session during logout
-	 */
-	public function logout() {
-		$this->session->clear();
-	}
-
-	/**
-	 * setup encryption backend upon user created
-	 *
-	 * @note This method should never be called for users using client side encryption
-	 * @param array $params
-	 */
-	public function postCreateUser($params) {
-		$this->userSetup->setupUser($params['uid'], $params['password']);
-	}
-
-	/**
-	 * cleanup encryption backend upon user deleted
-	 *
-	 * @param array $params : uid, password
-	 * @note This method should never be called for users using client side encryption
-	 */
-	public function postDeleteUser($params) {
-		$this->keyManager->deletePublicKey($params['uid']);
-	}
-
-	public function prePasswordReset($params) {
-		$user = $params['uid'];
-		self::$passwordResetUsers[$user] = true;
-	}
-
-	public function postPasswordReset($params) {
-		$uid = $params['uid'];
-		$password = $params['password'];
-		$this->keyManager->backupUserKeys('passwordReset', $uid);
-		$this->keyManager->deleteUserKeys($uid);
-		$this->userSetup->setupUser($uid, $password);
-		unset(self::$passwordResetUsers[$uid]);
-	}
-
-	/**
-	 * If the password can't be changed within Nextcloud, than update the key password in advance.
-	 *
-	 * @param array $params : uid, password
-	 * @return boolean|null
-	 */
-	public function preSetPassphrase($params) {
-		$user = $this->userManager->get($params['uid']);
-
-		if ($user && !$user->canChangePassword()) {
-			$this->setPassphrase($params);
-		}
-	}
-
-	/**
-	 * Change a user's encryption passphrase
-	 *
-	 * @param array $params keys: uid, password
-	 * @return boolean|null
-	 */
-	public function setPassphrase($params) {
-
-		// if we are in the process to resetting a user password, we have nothing
-		// to do here
-		if (isset(self::$passwordResetUsers[$params['uid']])) {
-			return true;
-		}
-
-		// Get existing decrypted private key
-		$user = $this->userSession->getUser();
-
-		// current logged in user changes his own password
-		if ($user && $params['uid'] === $user->getUID()) {
-			$privateKey = $this->session->getPrivateKey();
-
-			// Encrypt private key with new user pwd as passphrase
-			$encryptedPrivateKey = $this->crypt->encryptPrivateKey($privateKey, $params['password'], $params['uid']);
-
-			// Save private key
-			if ($encryptedPrivateKey) {
-				$this->keyManager->setPrivateKey($user->getUID(),
-					$this->crypt->generateHeader() . $encryptedPrivateKey);
-			} else {
-				$this->logger->error('Encryption could not update users encryption password');
-			}
-
-			// NOTE: Session does not need to be updated as the
-			// private key has not changed, only the passphrase
-			// used to decrypt it has changed
-		} else { // admin changed the password for a different user, create new keys and re-encrypt file keys
-			$userId = $params['uid'];
-			$this->initMountPoints($userId);
-			$recoveryPassword = isset($params['recoveryPassword']) ? $params['recoveryPassword'] : null;
-
-			$recoveryKeyId = $this->keyManager->getRecoveryKeyId();
-			$recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId);
-			try {
-				$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $recoveryPassword);
-			} catch (\Exception $e) {
-				$decryptedRecoveryKey = false;
-			}
-			if ($decryptedRecoveryKey === false) {
-				$message = 'Can not decrypt the recovery key. Maybe you provided the wrong password. Try again.';
-				throw new GenericEncryptionException($message, $message);
-			}
-
-			// we generate new keys if...
-			// ...we have a recovery password and the user enabled the recovery key
-			// ...encryption was activated for the first time (no keys exists)
-			// ...the user doesn't have any files
-			if (
-				($this->recovery->isRecoveryEnabledForUser($userId) && $recoveryPassword)
-				|| !$this->keyManager->userHasKeys($userId)
-				|| !$this->util->userHasFiles($userId)
-			) {
-
-				// backup old keys
-				//$this->backupAllKeys('recovery');
-
-				$newUserPassword = $params['password'];
-
-				$keyPair = $this->crypt->createKeyPair();
-
-				// Save public key
-				$this->keyManager->setPublicKey($userId, $keyPair['publicKey']);
-
-				// Encrypt private key with new password
-				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $userId);
-
-				if ($encryptedKey) {
-					$this->keyManager->setPrivateKey($userId, $this->crypt->generateHeader() . $encryptedKey);
-
-					if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files
-						$this->recovery->recoverUsersFiles($recoveryPassword, $userId);
-					}
-				} else {
-					$this->logger->error('Encryption Could not update users encryption password');
-				}
-			}
-		}
-	}
-
-	/**
-	 * init mount points for given user
-	 *
-	 * @param string $user
-	 * @throws \OC\User\NoUserException
-	 */
-	protected function initMountPoints($user) {
-		Filesystem::initMountPoints($user);
-	}
-
-	/**
-	 * setup file system for user
-	 *
-	 * @param string $uid user id
-	 */
-	protected function setupFS($uid) {
-		\OC_Util::setupFS($uid);
-	}
+    /**
+     * list of user for which we perform a password reset
+     * @var array
+     */
+    protected static $passwordResetUsers = [];
+
+    /**
+     * @var KeyManager
+     */
+    private $keyManager;
+    /**
+     * @var IUserManager
+     */
+    private $userManager;
+    /**
+     * @var ILogger
+     */
+    private $logger;
+    /**
+     * @var Setup
+     */
+    private $userSetup;
+    /**
+     * @var IUserSession
+     */
+    private $userSession;
+    /**
+     * @var Util
+     */
+    private $util;
+    /**
+     * @var Session
+     */
+    private $session;
+    /**
+     * @var Recovery
+     */
+    private $recovery;
+    /**
+     * @var Crypt
+     */
+    private $crypt;
+
+    /**
+     * UserHooks constructor.
+     *
+     * @param KeyManager $keyManager
+     * @param IUserManager $userManager
+     * @param ILogger $logger
+     * @param Setup $userSetup
+     * @param IUserSession $userSession
+     * @param Util $util
+     * @param Session $session
+     * @param Crypt $crypt
+     * @param Recovery $recovery
+     */
+    public function __construct(KeyManager $keyManager,
+                                IUserManager $userManager,
+                                ILogger $logger,
+                                Setup $userSetup,
+                                IUserSession $userSession,
+                                Util $util,
+                                Session $session,
+                                Crypt $crypt,
+                                Recovery $recovery) {
+        $this->keyManager = $keyManager;
+        $this->userManager = $userManager;
+        $this->logger = $logger;
+        $this->userSetup = $userSetup;
+        $this->userSession = $userSession;
+        $this->util = $util;
+        $this->session = $session;
+        $this->recovery = $recovery;
+        $this->crypt = $crypt;
+    }
+
+    /**
+     * Connects Hooks
+     *
+     * @return null
+     */
+    public function addHooks() {
+        OCUtil::connectHook('OC_User', 'post_login', $this, 'login');
+        OCUtil::connectHook('OC_User', 'logout', $this, 'logout');
+
+        // this hooks only make sense if no master key is used
+        if ($this->util->isMasterKeyEnabled() === false) {
+            OCUtil::connectHook('OC_User',
+                'post_setPassword',
+                $this,
+                'setPassphrase');
+
+            OCUtil::connectHook('OC_User',
+                'pre_setPassword',
+                $this,
+                'preSetPassphrase');
+
+            OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
+                'post_passwordReset',
+                $this,
+                'postPasswordReset');
+
+            OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
+                'pre_passwordReset',
+                $this,
+                'prePasswordReset');
+
+            OCUtil::connectHook('OC_User',
+                'post_createUser',
+                $this,
+                'postCreateUser');
+
+            OCUtil::connectHook('OC_User',
+                'post_deleteUser',
+                $this,
+                'postDeleteUser');
+        }
+    }
+
+
+    /**
+     * Startup encryption backend upon user login
+     *
+     * @note This method should never be called for users using client side encryption
+     * @param array $params
+     * @return boolean|null
+     */
+    public function login($params) {
+        // ensure filesystem is loaded
+        if (!\OC\Files\Filesystem::$loaded) {
+            $this->setupFS($params['uid']);
+        }
+        if ($this->util->isMasterKeyEnabled() === false) {
+            $this->userSetup->setupUser($params['uid'], $params['password']);
+        }
+
+        $this->keyManager->init($params['uid'], $params['password']);
+    }
+
+    /**
+     * remove keys from session during logout
+     */
+    public function logout() {
+        $this->session->clear();
+    }
+
+    /**
+     * setup encryption backend upon user created
+     *
+     * @note This method should never be called for users using client side encryption
+     * @param array $params
+     */
+    public function postCreateUser($params) {
+        $this->userSetup->setupUser($params['uid'], $params['password']);
+    }
+
+    /**
+     * cleanup encryption backend upon user deleted
+     *
+     * @param array $params : uid, password
+     * @note This method should never be called for users using client side encryption
+     */
+    public function postDeleteUser($params) {
+        $this->keyManager->deletePublicKey($params['uid']);
+    }
+
+    public function prePasswordReset($params) {
+        $user = $params['uid'];
+        self::$passwordResetUsers[$user] = true;
+    }
+
+    public function postPasswordReset($params) {
+        $uid = $params['uid'];
+        $password = $params['password'];
+        $this->keyManager->backupUserKeys('passwordReset', $uid);
+        $this->keyManager->deleteUserKeys($uid);
+        $this->userSetup->setupUser($uid, $password);
+        unset(self::$passwordResetUsers[$uid]);
+    }
+
+    /**
+     * If the password can't be changed within Nextcloud, than update the key password in advance.
+     *
+     * @param array $params : uid, password
+     * @return boolean|null
+     */
+    public function preSetPassphrase($params) {
+        $user = $this->userManager->get($params['uid']);
+
+        if ($user && !$user->canChangePassword()) {
+            $this->setPassphrase($params);
+        }
+    }
+
+    /**
+     * Change a user's encryption passphrase
+     *
+     * @param array $params keys: uid, password
+     * @return boolean|null
+     */
+    public function setPassphrase($params) {
+
+        // if we are in the process to resetting a user password, we have nothing
+        // to do here
+        if (isset(self::$passwordResetUsers[$params['uid']])) {
+            return true;
+        }
+
+        // Get existing decrypted private key
+        $user = $this->userSession->getUser();
+
+        // current logged in user changes his own password
+        if ($user && $params['uid'] === $user->getUID()) {
+            $privateKey = $this->session->getPrivateKey();
+
+            // Encrypt private key with new user pwd as passphrase
+            $encryptedPrivateKey = $this->crypt->encryptPrivateKey($privateKey, $params['password'], $params['uid']);
+
+            // Save private key
+            if ($encryptedPrivateKey) {
+                $this->keyManager->setPrivateKey($user->getUID(),
+                    $this->crypt->generateHeader() . $encryptedPrivateKey);
+            } else {
+                $this->logger->error('Encryption could not update users encryption password');
+            }
+
+            // NOTE: Session does not need to be updated as the
+            // private key has not changed, only the passphrase
+            // used to decrypt it has changed
+        } else { // admin changed the password for a different user, create new keys and re-encrypt file keys
+            $userId = $params['uid'];
+            $this->initMountPoints($userId);
+            $recoveryPassword = isset($params['recoveryPassword']) ? $params['recoveryPassword'] : null;
+
+            $recoveryKeyId = $this->keyManager->getRecoveryKeyId();
+            $recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId);
+            try {
+                $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $recoveryPassword);
+            } catch (\Exception $e) {
+                $decryptedRecoveryKey = false;
+            }
+            if ($decryptedRecoveryKey === false) {
+                $message = 'Can not decrypt the recovery key. Maybe you provided the wrong password. Try again.';
+                throw new GenericEncryptionException($message, $message);
+            }
+
+            // we generate new keys if...
+            // ...we have a recovery password and the user enabled the recovery key
+            // ...encryption was activated for the first time (no keys exists)
+            // ...the user doesn't have any files
+            if (
+                ($this->recovery->isRecoveryEnabledForUser($userId) && $recoveryPassword)
+                || !$this->keyManager->userHasKeys($userId)
+                || !$this->util->userHasFiles($userId)
+            ) {
+
+                // backup old keys
+                //$this->backupAllKeys('recovery');
+
+                $newUserPassword = $params['password'];
+
+                $keyPair = $this->crypt->createKeyPair();
+
+                // Save public key
+                $this->keyManager->setPublicKey($userId, $keyPair['publicKey']);
+
+                // Encrypt private key with new password
+                $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $userId);
+
+                if ($encryptedKey) {
+                    $this->keyManager->setPrivateKey($userId, $this->crypt->generateHeader() . $encryptedKey);
+
+                    if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files
+                        $this->recovery->recoverUsersFiles($recoveryPassword, $userId);
+                    }
+                } else {
+                    $this->logger->error('Encryption Could not update users encryption password');
+                }
+            }
+        }
+    }
+
+    /**
+     * init mount points for given user
+     *
+     * @param string $user
+     * @throws \OC\User\NoUserException
+     */
+    protected function initMountPoints($user) {
+        Filesystem::initMountPoints($user);
+    }
+
+    /**
+     * setup file system for user
+     *
+     * @param string $uid user id
+     */
+    protected function setupFS($uid) {
+        \OC_Util::setupFS($uid);
+    }
 }

apps/files/lib/Listener/LegacyLoadAdditionalScriptsAdapter.php

Indentation +20 added lines, -20 removed lines

@@ -32,25 +32,25 @@
 
 class LegacyLoadAdditionalScriptsAdapter implements IEventListener {
 
-	/** @var SymfonyAdapter */
-	private $dispatcher;
-
-	public function __construct(SymfonyAdapter $dispatcher) {
-		$this->dispatcher = $dispatcher;
-	}
-
-	public function handle(Event $event): void {
-		if (!($event instanceof LoadAdditionalScriptsEvent)) {
-			return;
-		}
-
-		$legacyEvent = new GenericEvent(null, ['hiddenFields' => []]);
-		$this->dispatcher->dispatch('OCA\Files::loadAdditionalScripts', $legacyEvent);
-
-		$hiddenFields = $legacyEvent->getArgument('hiddenFields');
-		foreach ($hiddenFields as $name => $value) {
-			$event->addHiddenField($name, $value);
-		}
-	}
+    /** @var SymfonyAdapter */
+    private $dispatcher;
+
+    public function __construct(SymfonyAdapter $dispatcher) {
+        $this->dispatcher = $dispatcher;
+    }
+
+    public function handle(Event $event): void {
+        if (!($event instanceof LoadAdditionalScriptsEvent)) {
+            return;
+        }
+
+        $legacyEvent = new GenericEvent(null, ['hiddenFields' => []]);
+        $this->dispatcher->dispatch('OCA\Files::loadAdditionalScripts', $legacyEvent);
+
+        $hiddenFields = $legacyEvent->getArgument('hiddenFields');
+        foreach ($hiddenFields as $name => $value) {
+            $event->addHiddenField($name, $value);
+        }
+    }
 
 }

apps/settings/lib/Settings/Personal/Security/Authtokens.php

Spacing +1 added lines, -1 removed lines

@@ -91,7 +91,7 @@
 			return [];
 		}
 
-		return array_map(function (IToken $token) use ($sessionToken) {
+		return array_map(function(IToken $token) use ($sessionToken) {
 			$data = $token->jsonSerialize();
 			$data['canDelete'] = true;
 			$data['canRename'] = $token instanceof INamedToken;

Indentation +75 added lines, -75 removed lines

@@ -40,79 +40,79 @@
 
 class Authtokens implements ISettings {
 
-	/** @var IAuthTokenProvider */
-	private $tokenProvider;
-
-	/** @var ISession */
-	private $session;
-
-	/** @var IInitialState */
-	private $initialState;
-
-	/** @var string|null */
-	private $uid;
-
-	/** @var IUserSession */
-	private $userSession;
-
-	public function __construct(IAuthTokenProvider $tokenProvider,
-								ISession $session,
-								IUserSession $userSession,
-								IInitialState $initialState,
-								?string $UserId) {
-		$this->tokenProvider = $tokenProvider;
-		$this->session = $session;
-		$this->initialState = $initialState;
-		$this->uid = $UserId;
-		$this->userSession = $userSession;
-	}
-
-	public function getForm(): TemplateResponse {
-		$this->initialState->provideInitialState(
-			'app_tokens',
-			$this->getAppTokens()
-		);
-
-		$this->initialState->provideInitialState(
-			'can_create_app_token',
-			$this->userSession->getImpersonatingUserID() === null
-		);
-
-		return new TemplateResponse('settings', 'settings/personal/security/authtokens');
-	}
-
-	public function getSection(): string {
-		return 'security';
-	}
-
-	public function getPriority(): int {
-		return 100;
-	}
-
-	private function getAppTokens(): array {
-		$tokens = $this->tokenProvider->getTokenByUser($this->uid);
-
-		try {
-			$sessionId = $this->session->getId();
-		} catch (SessionNotAvailableException $ex) {
-			return [];
-		}
-		try {
-			$sessionToken = $this->tokenProvider->getToken($sessionId);
-		} catch (InvalidTokenException $ex) {
-			return [];
-		}
-
-		return array_map(function (IToken $token) use ($sessionToken) {
-			$data = $token->jsonSerialize();
-			$data['canDelete'] = true;
-			$data['canRename'] = $token instanceof INamedToken;
-			if ($sessionToken->getId() === $token->getId()) {
-				$data['canDelete'] = false;
-				$data['canRename'] = false;
-				$data['current'] = true;
-			}
-			return $data;
-		}, $tokens);
-	}
+    /** @var IAuthTokenProvider */
+    private $tokenProvider;
+
+    /** @var ISession */
+    private $session;
+
+    /** @var IInitialState */
+    private $initialState;
+
+    /** @var string|null */
+    private $uid;
+
+    /** @var IUserSession */
+    private $userSession;
+
+    public function __construct(IAuthTokenProvider $tokenProvider,
+                                ISession $session,
+                                IUserSession $userSession,
+                                IInitialState $initialState,
+                                ?string $UserId) {
+        $this->tokenProvider = $tokenProvider;
+        $this->session = $session;
+        $this->initialState = $initialState;
+        $this->uid = $UserId;
+        $this->userSession = $userSession;
+    }
+
+    public function getForm(): TemplateResponse {
+        $this->initialState->provideInitialState(
+            'app_tokens',
+            $this->getAppTokens()
+        );
+
+        $this->initialState->provideInitialState(
+            'can_create_app_token',
+            $this->userSession->getImpersonatingUserID() === null
+        );
+
+        return new TemplateResponse('settings', 'settings/personal/security/authtokens');
+    }
+
+    public function getSection(): string {
+        return 'security';
+    }
+
+    public function getPriority(): int {
+        return 100;
+    }
+
+    private function getAppTokens(): array {
+        $tokens = $this->tokenProvider->getTokenByUser($this->uid);
+
+        try {
+            $sessionId = $this->session->getId();
+        } catch (SessionNotAvailableException $ex) {
+            return [];
+        }
+        try {
+            $sessionToken = $this->tokenProvider->getToken($sessionId);
+        } catch (InvalidTokenException $ex) {
+            return [];
+        }
+
+        return array_map(function (IToken $token) use ($sessionToken) {
+            $data = $token->jsonSerialize();
+            $data['canDelete'] = true;
+            $data['canRename'] = $token instanceof INamedToken;
+            if ($sessionToken->getId() === $token->getId()) {
+                $data['canDelete'] = false;
+                $data['canRename'] = false;
+                $data['current'] = true;
+            }
+            return $data;
+        }, $tokens);
+    }
 }