nextcloud /
server
@@ -47,232 +47,232 @@ |
||
| 47 | 47 | |
| 48 | 48 | class ChangePasswordController extends Controller { |
| 49 | 49 | |
| 50 | - /** @var string */ |
|
| 51 | - private $userId; |
|
| 50 | + /** @var string */ |
|
| 51 | + private $userId; |
|
| 52 | 52 | |
| 53 | - /** @var IUserManager */ |
|
| 54 | - private $userManager; |
|
| 53 | + /** @var IUserManager */ |
|
| 54 | + private $userManager; |
|
| 55 | 55 | |
| 56 | - /** @var IL10N */ |
|
| 57 | - private $l; |
|
| 56 | + /** @var IL10N */ |
|
| 57 | + private $l; |
|
| 58 | 58 | |
| 59 | - /** @var IGroupManager */ |
|
| 60 | - private $groupManager; |
|
| 59 | + /** @var IGroupManager */ |
|
| 60 | + private $groupManager; |
|
| 61 | 61 | |
| 62 | - /** @var Session */ |
|
| 63 | - private $userSession; |
|
| 62 | + /** @var Session */ |
|
| 63 | + private $userSession; |
|
| 64 | 64 | |
| 65 | - /** @var IAppManager */ |
|
| 66 | - private $appManager; |
|
| 65 | + /** @var IAppManager */ |
|
| 66 | + private $appManager; |
|
| 67 | 67 | |
| 68 | - public function __construct(string $appName, |
|
| 69 | - IRequest $request, |
|
| 70 | - string $userId, |
|
| 71 | - IUserManager $userManager, |
|
| 72 | - IUserSession $userSession, |
|
| 73 | - IGroupManager $groupManager, |
|
| 74 | - IAppManager $appManager, |
|
| 75 | - IL10N $l) { |
|
| 76 | - parent::__construct($appName, $request); |
|
| 68 | + public function __construct(string $appName, |
|
| 69 | + IRequest $request, |
|
| 70 | + string $userId, |
|
| 71 | + IUserManager $userManager, |
|
| 72 | + IUserSession $userSession, |
|
| 73 | + IGroupManager $groupManager, |
|
| 74 | + IAppManager $appManager, |
|
| 75 | + IL10N $l) { |
|
| 76 | + parent::__construct($appName, $request); |
|
| 77 | 77 | |
| 78 | - $this->userId = $userId; |
|
| 79 | - $this->userManager = $userManager; |
|
| 80 | - $this->userSession = $userSession; |
|
| 81 | - $this->groupManager = $groupManager; |
|
| 82 | - $this->appManager = $appManager; |
|
| 83 | - $this->l = $l; |
|
| 84 | - } |
|
| 78 | + $this->userId = $userId; |
|
| 79 | + $this->userManager = $userManager; |
|
| 80 | + $this->userSession = $userSession; |
|
| 81 | + $this->groupManager = $groupManager; |
|
| 82 | + $this->appManager = $appManager; |
|
| 83 | + $this->l = $l; |
|
| 84 | + } |
|
| 85 | 85 | |
| 86 | - /** |
|
| 87 | - * @NoAdminRequired |
|
| 88 | - * @NoSubadminRequired |
|
| 89 | - * @BruteForceProtection(action=changePersonalPassword) |
|
| 90 | - */ |
|
| 91 | - public function changePersonalPassword(string $oldpassword = '', string $newpassword = null): JSONResponse { |
|
| 92 | - $loginName = $this->userSession->getLoginName(); |
|
| 93 | - /** @var IUser $user */ |
|
| 94 | - $user = $this->userManager->checkPassword($loginName, $oldpassword); |
|
| 95 | - if ($user === false) { |
|
| 96 | - $response = new JSONResponse([ |
|
| 97 | - 'status' => 'error', |
|
| 98 | - 'data' => [ |
|
| 99 | - 'message' => $this->l->t('Wrong password'), |
|
| 100 | - ], |
|
| 101 | - ]); |
|
| 102 | - $response->throttle(); |
|
| 103 | - return $response; |
|
| 104 | - } |
|
| 86 | + /** |
|
| 87 | + * @NoAdminRequired |
|
| 88 | + * @NoSubadminRequired |
|
| 89 | + * @BruteForceProtection(action=changePersonalPassword) |
|
| 90 | + */ |
|
| 91 | + public function changePersonalPassword(string $oldpassword = '', string $newpassword = null): JSONResponse { |
|
| 92 | + $loginName = $this->userSession->getLoginName(); |
|
| 93 | + /** @var IUser $user */ |
|
| 94 | + $user = $this->userManager->checkPassword($loginName, $oldpassword); |
|
| 95 | + if ($user === false) { |
|
| 96 | + $response = new JSONResponse([ |
|
| 97 | + 'status' => 'error', |
|
| 98 | + 'data' => [ |
|
| 99 | + 'message' => $this->l->t('Wrong password'), |
|
| 100 | + ], |
|
| 101 | + ]); |
|
| 102 | + $response->throttle(); |
|
| 103 | + return $response; |
|
| 104 | + } |
|
| 105 | 105 | |
| 106 | - try { |
|
| 107 | - if ($newpassword === null || $user->setPassword($newpassword) === false) { |
|
| 108 | - return new JSONResponse([ |
|
| 109 | - 'status' => 'error' |
|
| 110 | - ]); |
|
| 111 | - } |
|
| 112 | - // password policy app throws exception |
|
| 113 | - } catch (HintException $e) { |
|
| 114 | - return new JSONResponse([ |
|
| 115 | - 'status' => 'error', |
|
| 116 | - 'data' => [ |
|
| 117 | - 'message' => $e->getHint(), |
|
| 118 | - ], |
|
| 119 | - ]); |
|
| 120 | - } |
|
| 106 | + try { |
|
| 107 | + if ($newpassword === null || $user->setPassword($newpassword) === false) { |
|
| 108 | + return new JSONResponse([ |
|
| 109 | + 'status' => 'error' |
|
| 110 | + ]); |
|
| 111 | + } |
|
| 112 | + // password policy app throws exception |
|
| 113 | + } catch (HintException $e) { |
|
| 114 | + return new JSONResponse([ |
|
| 115 | + 'status' => 'error', |
|
| 116 | + 'data' => [ |
|
| 117 | + 'message' => $e->getHint(), |
|
| 118 | + ], |
|
| 119 | + ]); |
|
| 120 | + } |
|
| 121 | 121 | |
| 122 | - $this->userSession->updateSessionTokenPassword($newpassword); |
|
| 122 | + $this->userSession->updateSessionTokenPassword($newpassword); |
|
| 123 | 123 | |
| 124 | - return new JSONResponse([ |
|
| 125 | - 'status' => 'success', |
|
| 126 | - 'data' => [ |
|
| 127 | - 'message' => $this->l->t('Saved'), |
|
| 128 | - ], |
|
| 129 | - ]); |
|
| 130 | - } |
|
| 124 | + return new JSONResponse([ |
|
| 125 | + 'status' => 'success', |
|
| 126 | + 'data' => [ |
|
| 127 | + 'message' => $this->l->t('Saved'), |
|
| 128 | + ], |
|
| 129 | + ]); |
|
| 130 | + } |
|
| 131 | 131 | |
| 132 | - /** |
|
| 133 | - * @NoAdminRequired |
|
| 134 | - * @PasswordConfirmationRequired |
|
| 135 | - */ |
|
| 136 | - public function changeUserPassword(string $username = null, string $password = null, string $recoveryPassword = null): JSONResponse { |
|
| 137 | - if ($username === null) { |
|
| 138 | - return new JSONResponse([ |
|
| 139 | - 'status' => 'error', |
|
| 140 | - 'data' => [ |
|
| 141 | - 'message' => $this->l->t('No user supplied'), |
|
| 142 | - ], |
|
| 143 | - ]); |
|
| 144 | - } |
|
| 132 | + /** |
|
| 133 | + * @NoAdminRequired |
|
| 134 | + * @PasswordConfirmationRequired |
|
| 135 | + */ |
|
| 136 | + public function changeUserPassword(string $username = null, string $password = null, string $recoveryPassword = null): JSONResponse { |
|
| 137 | + if ($username === null) { |
|
| 138 | + return new JSONResponse([ |
|
| 139 | + 'status' => 'error', |
|
| 140 | + 'data' => [ |
|
| 141 | + 'message' => $this->l->t('No user supplied'), |
|
| 142 | + ], |
|
| 143 | + ]); |
|
| 144 | + } |
|
| 145 | 145 | |
| 146 | - if ($password === null) { |
|
| 147 | - return new JSONResponse([ |
|
| 148 | - 'status' => 'error', |
|
| 149 | - 'data' => [ |
|
| 150 | - 'message' => $this->l->t('Unable to change password'), |
|
| 151 | - ], |
|
| 152 | - ]); |
|
| 153 | - } |
|
| 146 | + if ($password === null) { |
|
| 147 | + return new JSONResponse([ |
|
| 148 | + 'status' => 'error', |
|
| 149 | + 'data' => [ |
|
| 150 | + 'message' => $this->l->t('Unable to change password'), |
|
| 151 | + ], |
|
| 152 | + ]); |
|
| 153 | + } |
|
| 154 | 154 | |
| 155 | - $currentUser = $this->userSession->getUser(); |
|
| 156 | - $targetUser = $this->userManager->get($username); |
|
| 157 | - if ($currentUser === null || $targetUser === null || |
|
| 158 | - !($this->groupManager->isAdmin($this->userId) || |
|
| 159 | - $this->groupManager->getSubAdmin()->isUserAccessible($currentUser, $targetUser)) |
|
| 160 | - ) { |
|
| 161 | - return new JSONResponse([ |
|
| 162 | - 'status' => 'error', |
|
| 163 | - 'data' => [ |
|
| 164 | - 'message' => $this->l->t('Authentication error'), |
|
| 165 | - ], |
|
| 166 | - ]); |
|
| 167 | - } |
|
| 155 | + $currentUser = $this->userSession->getUser(); |
|
| 156 | + $targetUser = $this->userManager->get($username); |
|
| 157 | + if ($currentUser === null || $targetUser === null || |
|
| 158 | + !($this->groupManager->isAdmin($this->userId) || |
|
| 159 | + $this->groupManager->getSubAdmin()->isUserAccessible($currentUser, $targetUser)) |
|
| 160 | + ) { |
|
| 161 | + return new JSONResponse([ |
|
| 162 | + 'status' => 'error', |
|
| 163 | + 'data' => [ |
|
| 164 | + 'message' => $this->l->t('Authentication error'), |
|
| 165 | + ], |
|
| 166 | + ]); |
|
| 167 | + } |
|
| 168 | 168 | |
| 169 | - if ($this->appManager->isEnabledForUser('encryption')) { |
|
| 170 | - //handle the recovery case |
|
| 171 | - $crypt = new \OCA\Encryption\Crypto\Crypt( |
|
| 172 | - \OC::$server->getLogger(), |
|
| 173 | - \OC::$server->getUserSession(), |
|
| 174 | - \OC::$server->getConfig(), |
|
| 175 | - \OC::$server->getL10N('encryption')); |
|
| 176 | - $keyStorage = \OC::$server->getEncryptionKeyStorage(); |
|
| 177 | - $util = new \OCA\Encryption\Util( |
|
| 178 | - new \OC\Files\View(), |
|
| 179 | - $crypt, |
|
| 180 | - \OC::$server->getLogger(), |
|
| 181 | - \OC::$server->getUserSession(), |
|
| 182 | - \OC::$server->getConfig(), |
|
| 183 | - \OC::$server->getUserManager()); |
|
| 184 | - $keyManager = new \OCA\Encryption\KeyManager( |
|
| 185 | - $keyStorage, |
|
| 186 | - $crypt, |
|
| 187 | - \OC::$server->getConfig(), |
|
| 188 | - \OC::$server->getUserSession(), |
|
| 189 | - new \OCA\Encryption\Session(\OC::$server->getSession()), |
|
| 190 | - \OC::$server->getLogger(), |
|
| 191 | - $util); |
|
| 192 | - $recovery = new \OCA\Encryption\Recovery( |
|
| 193 | - \OC::$server->getUserSession(), |
|
| 194 | - $crypt, |
|
| 195 | - $keyManager, |
|
| 196 | - \OC::$server->getConfig(), |
|
| 197 | - \OC::$server->getEncryptionFilesHelper(), |
|
| 198 | - new \OC\Files\View()); |
|
| 199 | - $recoveryAdminEnabled = $recovery->isRecoveryKeyEnabled(); |
|
| 169 | + if ($this->appManager->isEnabledForUser('encryption')) { |
|
| 170 | + //handle the recovery case |
|
| 171 | + $crypt = new \OCA\Encryption\Crypto\Crypt( |
|
| 172 | + \OC::$server->getLogger(), |
|
| 173 | + \OC::$server->getUserSession(), |
|
| 174 | + \OC::$server->getConfig(), |
|
| 175 | + \OC::$server->getL10N('encryption')); |
|
| 176 | + $keyStorage = \OC::$server->getEncryptionKeyStorage(); |
|
| 177 | + $util = new \OCA\Encryption\Util( |
|
| 178 | + new \OC\Files\View(), |
|
| 179 | + $crypt, |
|
| 180 | + \OC::$server->getLogger(), |
|
| 181 | + \OC::$server->getUserSession(), |
|
| 182 | + \OC::$server->getConfig(), |
|
| 183 | + \OC::$server->getUserManager()); |
|
| 184 | + $keyManager = new \OCA\Encryption\KeyManager( |
|
| 185 | + $keyStorage, |
|
| 186 | + $crypt, |
|
| 187 | + \OC::$server->getConfig(), |
|
| 188 | + \OC::$server->getUserSession(), |
|
| 189 | + new \OCA\Encryption\Session(\OC::$server->getSession()), |
|
| 190 | + \OC::$server->getLogger(), |
|
| 191 | + $util); |
|
| 192 | + $recovery = new \OCA\Encryption\Recovery( |
|
| 193 | + \OC::$server->getUserSession(), |
|
| 194 | + $crypt, |
|
| 195 | + $keyManager, |
|
| 196 | + \OC::$server->getConfig(), |
|
| 197 | + \OC::$server->getEncryptionFilesHelper(), |
|
| 198 | + new \OC\Files\View()); |
|
| 199 | + $recoveryAdminEnabled = $recovery->isRecoveryKeyEnabled(); |
|
| 200 | 200 | |
| 201 | - $validRecoveryPassword = false; |
|
| 202 | - $recoveryEnabledForUser = false; |
|
| 203 | - if ($recoveryAdminEnabled) { |
|
| 204 | - $validRecoveryPassword = $keyManager->checkRecoveryPassword($recoveryPassword); |
|
| 205 | - $recoveryEnabledForUser = $recovery->isRecoveryEnabledForUser($username); |
|
| 206 | - } |
|
| 201 | + $validRecoveryPassword = false; |
|
| 202 | + $recoveryEnabledForUser = false; |
|
| 203 | + if ($recoveryAdminEnabled) { |
|
| 204 | + $validRecoveryPassword = $keyManager->checkRecoveryPassword($recoveryPassword); |
|
| 205 | + $recoveryEnabledForUser = $recovery->isRecoveryEnabledForUser($username); |
|
| 206 | + } |
|
| 207 | 207 | |
| 208 | - if ($recoveryEnabledForUser && $recoveryPassword === '') { |
|
| 209 | - return new JSONResponse([ |
|
| 210 | - 'status' => 'error', |
|
| 211 | - 'data' => [ |
|
| 212 | - 'message' => $this->l->t('Please provide an admin recovery password; otherwise, all user data will be lost.'), |
|
| 213 | - ] |
|
| 214 | - ]); |
|
| 215 | - } elseif ($recoveryEnabledForUser && ! $validRecoveryPassword) { |
|
| 216 | - return new JSONResponse([ |
|
| 217 | - 'status' => 'error', |
|
| 218 | - 'data' => [ |
|
| 219 | - 'message' => $this->l->t('Wrong admin recovery password. Please check the password and try again.'), |
|
| 220 | - ] |
|
| 221 | - ]); |
|
| 222 | - } else { // now we know that everything is fine regarding the recovery password, let's try to change the password |
|
| 223 | - try { |
|
| 224 | - $result = $targetUser->setPassword($password, $recoveryPassword); |
|
| 225 | - // password policy app throws exception |
|
| 226 | - } catch (HintException $e) { |
|
| 227 | - return new JSONResponse([ |
|
| 228 | - 'status' => 'error', |
|
| 229 | - 'data' => [ |
|
| 230 | - 'message' => $e->getHint(), |
|
| 231 | - ], |
|
| 232 | - ]); |
|
| 233 | - } |
|
| 234 | - if (!$result && $recoveryEnabledForUser) { |
|
| 235 | - return new JSONResponse([ |
|
| 236 | - 'status' => 'error', |
|
| 237 | - 'data' => [ |
|
| 238 | - 'message' => $this->l->t('Backend doesn\'t support password change, but the user\'s encryption key was updated.'), |
|
| 239 | - ] |
|
| 240 | - ]); |
|
| 241 | - } elseif (!$result && !$recoveryEnabledForUser) { |
|
| 242 | - return new JSONResponse([ |
|
| 243 | - 'status' => 'error', |
|
| 244 | - 'data' => [ |
|
| 245 | - 'message' => $this->l->t('Unable to change password'), |
|
| 246 | - ] |
|
| 247 | - ]); |
|
| 248 | - } |
|
| 249 | - } |
|
| 250 | - } else { |
|
| 251 | - try { |
|
| 252 | - if ($targetUser->setPassword($password) === false) { |
|
| 253 | - return new JSONResponse([ |
|
| 254 | - 'status' => 'error', |
|
| 255 | - 'data' => [ |
|
| 256 | - 'message' => $this->l->t('Unable to change password'), |
|
| 257 | - ], |
|
| 258 | - ]); |
|
| 259 | - } |
|
| 260 | - // password policy app throws exception |
|
| 261 | - } catch (HintException $e) { |
|
| 262 | - return new JSONResponse([ |
|
| 263 | - 'status' => 'error', |
|
| 264 | - 'data' => [ |
|
| 265 | - 'message' => $e->getHint(), |
|
| 266 | - ], |
|
| 267 | - ]); |
|
| 268 | - } |
|
| 269 | - } |
|
| 208 | + if ($recoveryEnabledForUser && $recoveryPassword === '') { |
|
| 209 | + return new JSONResponse([ |
|
| 210 | + 'status' => 'error', |
|
| 211 | + 'data' => [ |
|
| 212 | + 'message' => $this->l->t('Please provide an admin recovery password; otherwise, all user data will be lost.'), |
|
| 213 | + ] |
|
| 214 | + ]); |
|
| 215 | + } elseif ($recoveryEnabledForUser && ! $validRecoveryPassword) { |
|
| 216 | + return new JSONResponse([ |
|
| 217 | + 'status' => 'error', |
|
| 218 | + 'data' => [ |
|
| 219 | + 'message' => $this->l->t('Wrong admin recovery password. Please check the password and try again.'), |
|
| 220 | + ] |
|
| 221 | + ]); |
|
| 222 | + } else { // now we know that everything is fine regarding the recovery password, let's try to change the password |
|
| 223 | + try { |
|
| 224 | + $result = $targetUser->setPassword($password, $recoveryPassword); |
|
| 225 | + // password policy app throws exception |
|
| 226 | + } catch (HintException $e) { |
|
| 227 | + return new JSONResponse([ |
|
| 228 | + 'status' => 'error', |
|
| 229 | + 'data' => [ |
|
| 230 | + 'message' => $e->getHint(), |
|
| 231 | + ], |
|
| 232 | + ]); |
|
| 233 | + } |
|
| 234 | + if (!$result && $recoveryEnabledForUser) { |
|
| 235 | + return new JSONResponse([ |
|
| 236 | + 'status' => 'error', |
|
| 237 | + 'data' => [ |
|
| 238 | + 'message' => $this->l->t('Backend doesn\'t support password change, but the user\'s encryption key was updated.'), |
|
| 239 | + ] |
|
| 240 | + ]); |
|
| 241 | + } elseif (!$result && !$recoveryEnabledForUser) { |
|
| 242 | + return new JSONResponse([ |
|
| 243 | + 'status' => 'error', |
|
| 244 | + 'data' => [ |
|
| 245 | + 'message' => $this->l->t('Unable to change password'), |
|
| 246 | + ] |
|
| 247 | + ]); |
|
| 248 | + } |
|
| 249 | + } |
|
| 250 | + } else { |
|
| 251 | + try { |
|
| 252 | + if ($targetUser->setPassword($password) === false) { |
|
| 253 | + return new JSONResponse([ |
|
| 254 | + 'status' => 'error', |
|
| 255 | + 'data' => [ |
|
| 256 | + 'message' => $this->l->t('Unable to change password'), |
|
| 257 | + ], |
|
| 258 | + ]); |
|
| 259 | + } |
|
| 260 | + // password policy app throws exception |
|
| 261 | + } catch (HintException $e) { |
|
| 262 | + return new JSONResponse([ |
|
| 263 | + 'status' => 'error', |
|
| 264 | + 'data' => [ |
|
| 265 | + 'message' => $e->getHint(), |
|
| 266 | + ], |
|
| 267 | + ]); |
|
| 268 | + } |
|
| 269 | + } |
|
| 270 | 270 | |
| 271 | - return new JSONResponse([ |
|
| 272 | - 'status' => 'success', |
|
| 273 | - 'data' => [ |
|
| 274 | - 'username' => $username, |
|
| 275 | - ], |
|
| 276 | - ]); |
|
| 277 | - } |
|
| 271 | + return new JSONResponse([ |
|
| 272 | + 'status' => 'success', |
|
| 273 | + 'data' => [ |
|
| 274 | + 'username' => $username, |
|
| 275 | + ], |
|
| 276 | + ]); |
|
| 277 | + } |
|
| 278 | 278 | } |
