nextcloud / server

apps/files_external/lib/Lib/Storage/Google.php

Indentation +675 added lines, -675 removed lines

@@ -41,684 +41,684 @@
 use Icewind\Streams\RetryWrapper;
 
 set_include_path(get_include_path().PATH_SEPARATOR.
-	\OC_App::getAppPath('files_external').'/3rdparty/google-api-php-client/src');
+    \OC_App::getAppPath('files_external').'/3rdparty/google-api-php-client/src');
 require_once 'Google/autoload.php';
 
 class Google extends \OC\Files\Storage\Common {
 
-	private $client;
-	private $id;
-	private $service;
-	private $driveFiles;
-
-	// Google Doc mimetypes
-	const FOLDER = 'application/vnd.google-apps.folder';
-	const DOCUMENT = 'application/vnd.google-apps.document';
-	const SPREADSHEET = 'application/vnd.google-apps.spreadsheet';
-	const DRAWING = 'application/vnd.google-apps.drawing';
-	const PRESENTATION = 'application/vnd.google-apps.presentation';
-	const MAP = 'application/vnd.google-apps.map';
-
-	public function __construct($params) {
-		if (isset($params['configured']) && $params['configured'] === 'true'
-			&& isset($params['client_id']) && isset($params['client_secret'])
-			&& isset($params['token'])
-		) {
-			$this->client = new \Google_Client();
-			$this->client->setClientId($params['client_id']);
-			$this->client->setClientSecret($params['client_secret']);
-			$this->client->setScopes(array('https://www.googleapis.com/auth/drive'));
-			$this->client->setAccessToken($params['token']);
-			// if curl isn't available we're likely to run into
-			// https://github.com/google/google-api-php-client/issues/59
-			// - disable gzip to avoid it.
-			if (!function_exists('curl_version') || !function_exists('curl_exec')) {
-				$this->client->setClassConfig("Google_Http_Request", "disable_gzip", true);
-			}
-			// note: API connection is lazy
-			$this->service = new \Google_Service_Drive($this->client);
-			$token = json_decode($params['token'], true);
-			$this->id = 'google::'.substr($params['client_id'], 0, 30).$token['created'];
-		} else {
-			throw new \Exception('Creating Google storage failed');
-		}
-	}
-
-	public function getId() {
-		return $this->id;
-	}
-
-	/**
-	 * Get the Google_Service_Drive_DriveFile object for the specified path.
-	 * Returns false on failure.
-	 * @param string $path
-	 * @return \Google_Service_Drive_DriveFile|false
-	 */
-	private function getDriveFile($path) {
-		// Remove leading and trailing slashes
-		$path = trim($path, '/');
-		if ($path === '.') {
-			$path = '';
-		}
-		if (isset($this->driveFiles[$path])) {
-			return $this->driveFiles[$path];
-		} else if ($path === '') {
-			$root = $this->service->files->get('root');
-			$this->driveFiles[$path] = $root;
-			return $root;
-		} else {
-			// Google Drive SDK does not have methods for retrieving files by path
-			// Instead we must find the id of the parent folder of the file
-			$parentId = $this->getDriveFile('')->getId();
-			$folderNames = explode('/', $path);
-			$path = '';
-			// Loop through each folder of this path to get to the file
-			foreach ($folderNames as $name) {
-				// Reconstruct path from beginning
-				if ($path === '') {
-					$path .= $name;
-				} else {
-					$path .= '/'.$name;
-				}
-				if (isset($this->driveFiles[$path])) {
-					$parentId = $this->driveFiles[$path]->getId();
-				} else {
-					$q = "title='" . str_replace("'","\\'", $name) . "' and '" . str_replace("'","\\'", $parentId) . "' in parents and trashed = false";
-					$result = $this->service->files->listFiles(array('q' => $q))->getItems();
-					if (!empty($result)) {
-						// Google Drive allows files with the same name, Nextcloud doesn't
-						if (count($result) > 1) {
-							$this->onDuplicateFileDetected($path);
-							return false;
-						} else {
-							$file = current($result);
-							$this->driveFiles[$path] = $file;
-							$parentId = $file->getId();
-						}
-					} else {
-						// Google Docs have no extension in their title, so try without extension
-						$pos = strrpos($path, '.');
-						if ($pos !== false) {
-							$pathWithoutExt = substr($path, 0, $pos);
-							$file = $this->getDriveFile($pathWithoutExt);
-							if ($file && $this->isGoogleDocFile($file)) {
-								// Switch cached Google_Service_Drive_DriveFile to the correct index
-								unset($this->driveFiles[$pathWithoutExt]);
-								$this->driveFiles[$path] = $file;
-								$parentId = $file->getId();
-							} else {
-								return false;
-							}
-						} else {
-							return false;
-						}
-					}
-				}
-			}
-			return $this->driveFiles[$path];
-		}
-	}
-
-	/**
-	 * Set the Google_Service_Drive_DriveFile object in the cache
-	 * @param string $path
-	 * @param \Google_Service_Drive_DriveFile|false $file
-	 */
-	private function setDriveFile($path, $file) {
-		$path = trim($path, '/');
-		$this->driveFiles[$path] = $file;
-		if ($file === false) {
-			// Remove all children
-			$len = strlen($path);
-			foreach ($this->driveFiles as $key => $file) {
-				if (substr($key, 0, $len) === $path) {
-					unset($this->driveFiles[$key]);
-				}
-			}
-		}
-	}
-
-	/**
-	 * Write a log message to inform about duplicate file names
-	 * @param string $path
-	 */
-	private function onDuplicateFileDetected($path) {
-		$about = $this->service->about->get();
-		$user = $about->getName();
-		\OCP\Util::writeLog('files_external',
-			'Ignoring duplicate file name: '.$path.' on Google Drive for Google user: '.$user,
-			\OCP\Util::INFO
-		);
-	}
-
-	/**
-	 * Generate file extension for a Google Doc, choosing Open Document formats for download
-	 * @param string $mimetype
-	 * @return string
-	 */
-	private function getGoogleDocExtension($mimetype) {
-		if ($mimetype === self::DOCUMENT) {
-			return 'odt';
-		} else if ($mimetype === self::SPREADSHEET) {
-			return 'ods';
-		} else if ($mimetype === self::DRAWING) {
-			return 'jpg';
-		} else if ($mimetype === self::PRESENTATION) {
-			// Download as .odp is not available
-			return 'pdf';
-		} else {
-			return '';
-		}
-	}
-
-	/**
-	 * Returns whether the given drive file is a Google Doc file
-	 *
-	 * @param \Google_Service_Drive_DriveFile
-	 *
-	 * @return true if the file is a Google Doc file, false otherwise
-	 */
-	private function isGoogleDocFile($file) {
-		return $this->getGoogleDocExtension($file->getMimeType()) !== '';
-	}
-
-	public function mkdir($path) {
-		if (!$this->is_dir($path)) {
-			$parentFolder = $this->getDriveFile(dirname($path));
-			if ($parentFolder) {
-				$folder = new \Google_Service_Drive_DriveFile();
-				$folder->setTitle(basename($path));
-				$folder->setMimeType(self::FOLDER);
-				$parent = new \Google_Service_Drive_ParentReference();
-				$parent->setId($parentFolder->getId());
-				$folder->setParents(array($parent));
-				$result = $this->service->files->insert($folder);
-				if ($result) {
-					$this->setDriveFile($path, $result);
-				}
-				return (bool)$result;
-			}
-		}
-		return false;
-	}
-
-	public function rmdir($path) {
-		if (!$this->isDeletable($path)) {
-			return false;
-		}
-		if (trim($path, '/') === '') {
-			$dir = $this->opendir($path);
-			if(is_resource($dir)) {
-				while (($file = readdir($dir)) !== false) {
-					if (!\OC\Files\Filesystem::isIgnoredDir($file)) {
-						if (!$this->unlink($path.'/'.$file)) {
-							return false;
-						}
-					}
-				}
-				closedir($dir);
-			}
-			$this->driveFiles = array();
-			return true;
-		} else {
-			return $this->unlink($path);
-		}
-	}
-
-	public function opendir($path) {
-		$folder = $this->getDriveFile($path);
-		if ($folder) {
-			$files = array();
-			$duplicates = array();
-			$pageToken = true;
-			while ($pageToken) {
-				$params = array();
-				if ($pageToken !== true) {
-					$params['pageToken'] = $pageToken;
-				}
-				$params['q'] = "'" . str_replace("'","\\'", $folder->getId()) . "' in parents and trashed = false";
-				$children = $this->service->files->listFiles($params);
-				foreach ($children->getItems() as $child) {
-					$name = $child->getTitle();
-					// Check if this is a Google Doc i.e. no extension in name
-					$extension = $child->getFileExtension();
-					if (empty($extension)) {
-						if ($child->getMimeType() === self::MAP) {
-							continue; // No method known to transfer map files, ignore it
-						} else if ($child->getMimeType() !== self::FOLDER) {
-							$name .= '.'.$this->getGoogleDocExtension($child->getMimeType());
-						}
-					}
-					if ($path === '') {
-						$filepath = $name;
-					} else {
-						$filepath = $path.'/'.$name;
-					}
-					// Google Drive allows files with the same name, Nextcloud doesn't
-					// Prevent opendir() from returning any duplicate files
-					$key = array_search($name, $files);
-					if ($key !== false || isset($duplicates[$filepath])) {
-						if (!isset($duplicates[$filepath])) {
-							$duplicates[$filepath] = true;
-							$this->setDriveFile($filepath, false);
-							unset($files[$key]);
-							$this->onDuplicateFileDetected($filepath);
-						}
-					} else {
-						// Cache the Google_Service_Drive_DriveFile for future use
-						$this->setDriveFile($filepath, $child);
-						$files[] = $name;
-					}
-				}
-				$pageToken = $children->getNextPageToken();
-			}
-			return IteratorDirectory::wrap($files);
-		} else {
-			return false;
-		}
-	}
-
-	public function stat($path) {
-		$file = $this->getDriveFile($path);
-		if ($file) {
-			$stat = array();
-			if ($this->filetype($path) === 'dir') {
-				$stat['size'] = 0;
-			} else {
-				// Check if this is a Google Doc
-				if ($this->isGoogleDocFile($file)) {
-					// Return unknown file size
-					$stat['size'] = \OCP\Files\FileInfo::SPACE_UNKNOWN;
-				} else {
-					$stat['size'] = $file->getFileSize();
-				}
-			}
-			$stat['atime'] = strtotime($file->getLastViewedByMeDate());
-			$stat['mtime'] = strtotime($file->getModifiedDate());
-			$stat['ctime'] = strtotime($file->getCreatedDate());
-			return $stat;
-		} else {
-			return false;
-		}
-	}
-
-	public function filetype($path) {
-		if ($path === '') {
-			return 'dir';
-		} else {
-			$file = $this->getDriveFile($path);
-			if ($file) {
-				if ($file->getMimeType() === self::FOLDER) {
-					return 'dir';
-				} else {
-					return 'file';
-				}
-			} else {
-				return false;
-			}
-		}
-	}
-
-	public function isUpdatable($path) {
-		$file = $this->getDriveFile($path);
-		if ($file) {
-			return $file->getEditable();
-		} else {
-			return false;
-		}
-	}
-
-	public function file_exists($path) {
-		return (bool)$this->getDriveFile($path);
-	}
-
-	public function unlink($path) {
-		$file = $this->getDriveFile($path);
-		if ($file) {
-			$result = $this->service->files->trash($file->getId());
-			if ($result) {
-				$this->setDriveFile($path, false);
-			}
-			return (bool)$result;
-		} else {
-			return false;
-		}
-	}
-
-	public function rename($path1, $path2) {
-		$file = $this->getDriveFile($path1);
-		if ($file) {
-			$newFile = $this->getDriveFile($path2);
-			if (dirname($path1) === dirname($path2)) {
-				if ($newFile) {
-					// rename to the name of the target file, could be an office file without extension
-					$file->setTitle($newFile->getTitle());
-				} else {
-					$file->setTitle(basename(($path2)));
-				}
-			} else {
-				// Change file parent
-				$parentFolder2 = $this->getDriveFile(dirname($path2));
-				if ($parentFolder2) {
-					$parent = new \Google_Service_Drive_ParentReference();
-					$parent->setId($parentFolder2->getId());
-					$file->setParents(array($parent));
-				} else {
-					return false;
-				}
-			}
-			// We need to get the object for the existing file with the same
-			// name (if there is one) before we do the patch. If oldfile
-			// exists and is a directory we have to delete it before we
-			// do the rename too.
-			$oldfile = $this->getDriveFile($path2);
-			if ($oldfile && $this->is_dir($path2)) {
-				$this->rmdir($path2);
-				$oldfile = false;
-			}
-			$result = $this->service->files->patch($file->getId(), $file);
-			if ($result) {
-				$this->setDriveFile($path1, false);
-				$this->setDriveFile($path2, $result);
-				if ($oldfile && $newFile) {
-					// only delete if they have a different id (same id can happen for part files)
-					if ($newFile->getId() !== $oldfile->getId()) {
-						$this->service->files->delete($oldfile->getId());
-					}
-				}
-			}
-			return (bool)$result;
-		} else {
-			return false;
-		}
-	}
-
-	public function fopen($path, $mode) {
-		$pos = strrpos($path, '.');
-		if ($pos !== false) {
-			$ext = substr($path, $pos);
-		} else {
-			$ext = '';
-		}
-		switch ($mode) {
-			case 'r':
-			case 'rb':
-				$file = $this->getDriveFile($path);
-				if ($file) {
-					$exportLinks = $file->getExportLinks();
-					$mimetype = $this->getMimeType($path);
-					$downloadUrl = null;
-					if ($exportLinks && isset($exportLinks[$mimetype])) {
-						$downloadUrl = $exportLinks[$mimetype];
-					} else {
-						$downloadUrl = $file->getDownloadUrl();
-					}
-					if (isset($downloadUrl)) {
-						$request = new \Google_Http_Request($downloadUrl, 'GET', null, null);
-						$httpRequest = $this->client->getAuth()->sign($request);
-						// the library's service doesn't support streaming, so we use Guzzle instead
-						$client = \OC::$server->getHTTPClientService()->newClient();
-						try {
-							$response = $client->get($downloadUrl, [
-								'headers' => $httpRequest->getRequestHeaders(),
-								'stream' => true,
-								'verify' => realpath(__DIR__ . '/../../../3rdparty/google-api-php-client/src/Google/IO/cacerts.pem'),
-							]);
-						} catch (RequestException $e) {
-							if(!is_null($e->getResponse())) {
-								if ($e->getResponse()->getStatusCode() === 404) {
-									return false;
-								} else {
-									throw $e;
-								}
-							} else {
-								throw $e;
-							}
-						}
-
-						$handle = $response->getBody();
-						return RetryWrapper::wrap($handle);
-					}
-				}
-				return false;
-			case 'w':
-			case 'wb':
-			case 'a':
-			case 'ab':
-			case 'r+':
-			case 'w+':
-			case 'wb+':
-			case 'a+':
-			case 'x':
-			case 'x+':
-			case 'c':
-			case 'c+':
-				$tmpFile = \OCP\Files::tmpFile($ext);
-				if ($this->file_exists($path)) {
-					$source = $this->fopen($path, 'rb');
-					file_put_contents($tmpFile, $source);
-				}
-				$handle = fopen($tmpFile, $mode);
-				return CallbackWrapper::wrap($handle, null, null, function () use ($path, $tmpFile) {
-					$this->writeBack($tmpFile, $path);
-				});
-		}
-	}
-
-	public function writeBack($tmpFile, $path) {
-		$parentFolder = $this->getDriveFile(dirname($path));
-		if ($parentFolder) {
-			$mimetype = \OC::$server->getMimeTypeDetector()->detect($tmpFile);
-			$params = array(
-				'mimeType' => $mimetype,
-				'uploadType' => 'media'
-			);
-			$result = false;
-
-			$chunkSizeBytes = 10 * 1024 * 1024;
-
-			$useChunking = false;
-			$size = filesize($tmpFile);
-			if ($size > $chunkSizeBytes) {
-				$useChunking = true;
-			} else {
-				$params['data'] = file_get_contents($tmpFile);
-			}
-
-			if ($this->file_exists($path)) {
-				$file = $this->getDriveFile($path);
-				$this->client->setDefer($useChunking);
-				$request = $this->service->files->update($file->getId(), $file, $params);
-			} else {
-				$file = new \Google_Service_Drive_DriveFile();
-				$file->setTitle(basename($path));
-				$file->setMimeType($mimetype);
-				$parent = new \Google_Service_Drive_ParentReference();
-				$parent->setId($parentFolder->getId());
-				$file->setParents(array($parent));
-				$this->client->setDefer($useChunking);
-				$request = $this->service->files->insert($file, $params);
-			}
-
-			if ($useChunking) {
-				// Create a media file upload to represent our upload process.
-				$media = new \Google_Http_MediaFileUpload(
-					$this->client,
-					$request,
-					'text/plain',
-					null,
-					true,
-					$chunkSizeBytes
-				);
-				$media->setFileSize($size);
-
-				// Upload the various chunks. $status will be false until the process is
-				// complete.
-				$status = false;
-				$handle = fopen($tmpFile, 'rb');
-				while (!$status && !feof($handle)) {
-					$chunk = fread($handle, $chunkSizeBytes);
-					$status = $media->nextChunk($chunk);
-				}
-
-				// The final value of $status will be the data from the API for the object
-				// that has been uploaded.
-				$result = false;
-				if ($status !== false) {
-					$result = $status;
-				}
-
-				fclose($handle);
-			} else {
-				$result = $request;
-			}
-
-			// Reset to the client to execute requests immediately in the future.
-			$this->client->setDefer(false);
-
-			if ($result) {
-				$this->setDriveFile($path, $result);
-			}
-		}
-	}
-
-	public function getMimeType($path) {
-		$file = $this->getDriveFile($path);
-		if ($file) {
-			$mimetype = $file->getMimeType();
-			// Convert Google Doc mimetypes, choosing Open Document formats for download
-			if ($mimetype === self::FOLDER) {
-				return 'httpd/unix-directory';
-			} else if ($mimetype === self::DOCUMENT) {
-				return 'application/vnd.oasis.opendocument.text';
-			} else if ($mimetype === self::SPREADSHEET) {
-				return 'application/x-vnd.oasis.opendocument.spreadsheet';
-			} else if ($mimetype === self::DRAWING) {
-				return 'image/jpeg';
-			} else if ($mimetype === self::PRESENTATION) {
-				// Download as .odp is not available
-				return 'application/pdf';
-			} else {
-				// use extension-based detection, could be an encrypted file
-				return parent::getMimeType($path);
-			}
-		} else {
-			return false;
-		}
-	}
-
-	public function free_space($path) {
-		$about = $this->service->about->get();
-		return $about->getQuotaBytesTotal() - $about->getQuotaBytesUsed();
-	}
-
-	public function touch($path, $mtime = null) {
-		$file = $this->getDriveFile($path);
-		$result = false;
-		if ($file) {
-			if (isset($mtime)) {
-				// This is just RFC3339, but frustratingly, GDrive's API *requires*
-				// the fractions portion be present, while no handy PHP constant
-				// for RFC3339 or ISO8601 includes it. So we do it ourselves.
-				$file->setModifiedDate(date('Y-m-d\TH:i:s.uP', $mtime));
-				$result = $this->service->files->patch($file->getId(), $file, array(
-					'setModifiedDate' => true,
-				));
-			} else {
-				$result = $this->service->files->touch($file->getId());
-			}
-		} else {
-			$parentFolder = $this->getDriveFile(dirname($path));
-			if ($parentFolder) {
-				$file = new \Google_Service_Drive_DriveFile();
-				$file->setTitle(basename($path));
-				$parent = new \Google_Service_Drive_ParentReference();
-				$parent->setId($parentFolder->getId());
-				$file->setParents(array($parent));
-				$result = $this->service->files->insert($file);
-			}
-		}
-		if ($result) {
-			$this->setDriveFile($path, $result);
-		}
-		return (bool)$result;
-	}
-
-	public function test() {
-		if ($this->free_space('')) {
-			return true;
-		}
-		return false;
-	}
-
-	public function hasUpdated($path, $time) {
-		$appConfig = \OC::$server->getAppConfig();
-		if ($this->is_file($path)) {
-			return parent::hasUpdated($path, $time);
-		} else {
-			// Google Drive doesn't change modified times of folders when files inside are updated
-			// Instead we use the Changes API to see if folders have been updated, and it's a pain
-			$folder = $this->getDriveFile($path);
-			if ($folder) {
-				$result = false;
-				$folderId = $folder->getId();
-				$startChangeId = $appConfig->getValue('files_external', $this->getId().'cId');
-				$params = array(
-					'includeDeleted' => true,
-					'includeSubscribed' => true,
-				);
-				if (isset($startChangeId)) {
-					$startChangeId = (int)$startChangeId;
-					$largestChangeId = $startChangeId;
-					$params['startChangeId'] = $startChangeId + 1;
-				} else {
-					$largestChangeId = 0;
-				}
-				$pageToken = true;
-				while ($pageToken) {
-					if ($pageToken !== true) {
-						$params['pageToken'] = $pageToken;
-					}
-					$changes = $this->service->changes->listChanges($params);
-					if ($largestChangeId === 0 || $largestChangeId === $startChangeId) {
-						$largestChangeId = $changes->getLargestChangeId();
-					}
-					if (isset($startChangeId)) {
-						// Check if a file in this folder has been updated
-						// There is no way to filter by folder at the API level...
-						foreach ($changes->getItems() as $change) {
-							$file = $change->getFile();
-							if ($file) {
-								foreach ($file->getParents() as $parent) {
-									if ($parent->getId() === $folderId) {
-										$result = true;
-									// Check if there are changes in different folders
-									} else if ($change->getId() <= $largestChangeId) {
-										// Decrement id so this change is fetched when called again
-										$largestChangeId = $change->getId();
-										$largestChangeId--;
-									}
-								}
-							}
-						}
-						$pageToken = $changes->getNextPageToken();
-					} else {
-						// Assuming the initial scan just occurred and changes are negligible
-						break;
-					}
-				}
-				$appConfig->setValue('files_external', $this->getId().'cId', $largestChangeId);
-				return $result;
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * check if curl is installed
-	 */
-	public static function checkDependencies() {
-		return true;
-	}
+    private $client;
+    private $id;
+    private $service;
+    private $driveFiles;
+
+    // Google Doc mimetypes
+    const FOLDER = 'application/vnd.google-apps.folder';
+    const DOCUMENT = 'application/vnd.google-apps.document';
+    const SPREADSHEET = 'application/vnd.google-apps.spreadsheet';
+    const DRAWING = 'application/vnd.google-apps.drawing';
+    const PRESENTATION = 'application/vnd.google-apps.presentation';
+    const MAP = 'application/vnd.google-apps.map';
+
+    public function __construct($params) {
+        if (isset($params['configured']) && $params['configured'] === 'true'
+            && isset($params['client_id']) && isset($params['client_secret'])
+            && isset($params['token'])
+        ) {
+            $this->client = new \Google_Client();
+            $this->client->setClientId($params['client_id']);
+            $this->client->setClientSecret($params['client_secret']);
+            $this->client->setScopes(array('https://www.googleapis.com/auth/drive'));
+            $this->client->setAccessToken($params['token']);
+            // if curl isn't available we're likely to run into
+            // https://github.com/google/google-api-php-client/issues/59
+            // - disable gzip to avoid it.
+            if (!function_exists('curl_version') || !function_exists('curl_exec')) {
+                $this->client->setClassConfig("Google_Http_Request", "disable_gzip", true);
+            }
+            // note: API connection is lazy
+            $this->service = new \Google_Service_Drive($this->client);
+            $token = json_decode($params['token'], true);
+            $this->id = 'google::'.substr($params['client_id'], 0, 30).$token['created'];
+        } else {
+            throw new \Exception('Creating Google storage failed');
+        }
+    }
+
+    public function getId() {
+        return $this->id;
+    }
+
+    /**
+     * Get the Google_Service_Drive_DriveFile object for the specified path.
+     * Returns false on failure.
+     * @param string $path
+     * @return \Google_Service_Drive_DriveFile|false
+     */
+    private function getDriveFile($path) {
+        // Remove leading and trailing slashes
+        $path = trim($path, '/');
+        if ($path === '.') {
+            $path = '';
+        }
+        if (isset($this->driveFiles[$path])) {
+            return $this->driveFiles[$path];
+        } else if ($path === '') {
+            $root = $this->service->files->get('root');
+            $this->driveFiles[$path] = $root;
+            return $root;
+        } else {
+            // Google Drive SDK does not have methods for retrieving files by path
+            // Instead we must find the id of the parent folder of the file
+            $parentId = $this->getDriveFile('')->getId();
+            $folderNames = explode('/', $path);
+            $path = '';
+            // Loop through each folder of this path to get to the file
+            foreach ($folderNames as $name) {
+                // Reconstruct path from beginning
+                if ($path === '') {
+                    $path .= $name;
+                } else {
+                    $path .= '/'.$name;
+                }
+                if (isset($this->driveFiles[$path])) {
+                    $parentId = $this->driveFiles[$path]->getId();
+                } else {
+                    $q = "title='" . str_replace("'","\\'", $name) . "' and '" . str_replace("'","\\'", $parentId) . "' in parents and trashed = false";
+                    $result = $this->service->files->listFiles(array('q' => $q))->getItems();
+                    if (!empty($result)) {
+                        // Google Drive allows files with the same name, Nextcloud doesn't
+                        if (count($result) > 1) {
+                            $this->onDuplicateFileDetected($path);
+                            return false;
+                        } else {
+                            $file = current($result);
+                            $this->driveFiles[$path] = $file;
+                            $parentId = $file->getId();
+                        }
+                    } else {
+                        // Google Docs have no extension in their title, so try without extension
+                        $pos = strrpos($path, '.');
+                        if ($pos !== false) {
+                            $pathWithoutExt = substr($path, 0, $pos);
+                            $file = $this->getDriveFile($pathWithoutExt);
+                            if ($file && $this->isGoogleDocFile($file)) {
+                                // Switch cached Google_Service_Drive_DriveFile to the correct index
+                                unset($this->driveFiles[$pathWithoutExt]);
+                                $this->driveFiles[$path] = $file;
+                                $parentId = $file->getId();
+                            } else {
+                                return false;
+                            }
+                        } else {
+                            return false;
+                        }
+                    }
+                }
+            }
+            return $this->driveFiles[$path];
+        }
+    }
+
+    /**
+     * Set the Google_Service_Drive_DriveFile object in the cache
+     * @param string $path
+     * @param \Google_Service_Drive_DriveFile|false $file
+     */
+    private function setDriveFile($path, $file) {
+        $path = trim($path, '/');
+        $this->driveFiles[$path] = $file;
+        if ($file === false) {
+            // Remove all children
+            $len = strlen($path);
+            foreach ($this->driveFiles as $key => $file) {
+                if (substr($key, 0, $len) === $path) {
+                    unset($this->driveFiles[$key]);
+                }
+            }
+        }
+    }
+
+    /**
+     * Write a log message to inform about duplicate file names
+     * @param string $path
+     */
+    private function onDuplicateFileDetected($path) {
+        $about = $this->service->about->get();
+        $user = $about->getName();
+        \OCP\Util::writeLog('files_external',
+            'Ignoring duplicate file name: '.$path.' on Google Drive for Google user: '.$user,
+            \OCP\Util::INFO
+        );
+    }
+
+    /**
+     * Generate file extension for a Google Doc, choosing Open Document formats for download
+     * @param string $mimetype
+     * @return string
+     */
+    private function getGoogleDocExtension($mimetype) {
+        if ($mimetype === self::DOCUMENT) {
+            return 'odt';
+        } else if ($mimetype === self::SPREADSHEET) {
+            return 'ods';
+        } else if ($mimetype === self::DRAWING) {
+            return 'jpg';
+        } else if ($mimetype === self::PRESENTATION) {
+            // Download as .odp is not available
+            return 'pdf';
+        } else {
+            return '';
+        }
+    }
+
+    /**
+     * Returns whether the given drive file is a Google Doc file
+     *
+     * @param \Google_Service_Drive_DriveFile
+     *
+     * @return true if the file is a Google Doc file, false otherwise
+     */
+    private function isGoogleDocFile($file) {
+        return $this->getGoogleDocExtension($file->getMimeType()) !== '';
+    }
+
+    public function mkdir($path) {
+        if (!$this->is_dir($path)) {
+            $parentFolder = $this->getDriveFile(dirname($path));
+            if ($parentFolder) {
+                $folder = new \Google_Service_Drive_DriveFile();
+                $folder->setTitle(basename($path));
+                $folder->setMimeType(self::FOLDER);
+                $parent = new \Google_Service_Drive_ParentReference();
+                $parent->setId($parentFolder->getId());
+                $folder->setParents(array($parent));
+                $result = $this->service->files->insert($folder);
+                if ($result) {
+                    $this->setDriveFile($path, $result);
+                }
+                return (bool)$result;
+            }
+        }
+        return false;
+    }
+
+    public function rmdir($path) {
+        if (!$this->isDeletable($path)) {
+            return false;
+        }
+        if (trim($path, '/') === '') {
+            $dir = $this->opendir($path);
+            if(is_resource($dir)) {
+                while (($file = readdir($dir)) !== false) {
+                    if (!\OC\Files\Filesystem::isIgnoredDir($file)) {
+                        if (!$this->unlink($path.'/'.$file)) {
+                            return false;
+                        }
+                    }
+                }
+                closedir($dir);
+            }
+            $this->driveFiles = array();
+            return true;
+        } else {
+            return $this->unlink($path);
+        }
+    }
+
+    public function opendir($path) {
+        $folder = $this->getDriveFile($path);
+        if ($folder) {
+            $files = array();
+            $duplicates = array();
+            $pageToken = true;
+            while ($pageToken) {
+                $params = array();
+                if ($pageToken !== true) {
+                    $params['pageToken'] = $pageToken;
+                }
+                $params['q'] = "'" . str_replace("'","\\'", $folder->getId()) . "' in parents and trashed = false";
+                $children = $this->service->files->listFiles($params);
+                foreach ($children->getItems() as $child) {
+                    $name = $child->getTitle();
+                    // Check if this is a Google Doc i.e. no extension in name
+                    $extension = $child->getFileExtension();
+                    if (empty($extension)) {
+                        if ($child->getMimeType() === self::MAP) {
+                            continue; // No method known to transfer map files, ignore it
+                        } else if ($child->getMimeType() !== self::FOLDER) {
+                            $name .= '.'.$this->getGoogleDocExtension($child->getMimeType());
+                        }
+                    }
+                    if ($path === '') {
+                        $filepath = $name;
+                    } else {
+                        $filepath = $path.'/'.$name;
+                    }
+                    // Google Drive allows files with the same name, Nextcloud doesn't
+                    // Prevent opendir() from returning any duplicate files
+                    $key = array_search($name, $files);
+                    if ($key !== false || isset($duplicates[$filepath])) {
+                        if (!isset($duplicates[$filepath])) {
+                            $duplicates[$filepath] = true;
+                            $this->setDriveFile($filepath, false);
+                            unset($files[$key]);
+                            $this->onDuplicateFileDetected($filepath);
+                        }
+                    } else {
+                        // Cache the Google_Service_Drive_DriveFile for future use
+                        $this->setDriveFile($filepath, $child);
+                        $files[] = $name;
+                    }
+                }
+                $pageToken = $children->getNextPageToken();
+            }
+            return IteratorDirectory::wrap($files);
+        } else {
+            return false;
+        }
+    }
+
+    public function stat($path) {
+        $file = $this->getDriveFile($path);
+        if ($file) {
+            $stat = array();
+            if ($this->filetype($path) === 'dir') {
+                $stat['size'] = 0;
+            } else {
+                // Check if this is a Google Doc
+                if ($this->isGoogleDocFile($file)) {
+                    // Return unknown file size
+                    $stat['size'] = \OCP\Files\FileInfo::SPACE_UNKNOWN;
+                } else {
+                    $stat['size'] = $file->getFileSize();
+                }
+            }
+            $stat['atime'] = strtotime($file->getLastViewedByMeDate());
+            $stat['mtime'] = strtotime($file->getModifiedDate());
+            $stat['ctime'] = strtotime($file->getCreatedDate());
+            return $stat;
+        } else {
+            return false;
+        }
+    }
+
+    public function filetype($path) {
+        if ($path === '') {
+            return 'dir';
+        } else {
+            $file = $this->getDriveFile($path);
+            if ($file) {
+                if ($file->getMimeType() === self::FOLDER) {
+                    return 'dir';
+                } else {
+                    return 'file';
+                }
+            } else {
+                return false;
+            }
+        }
+    }
+
+    public function isUpdatable($path) {
+        $file = $this->getDriveFile($path);
+        if ($file) {
+            return $file->getEditable();
+        } else {
+            return false;
+        }
+    }
+
+    public function file_exists($path) {
+        return (bool)$this->getDriveFile($path);
+    }
+
+    public function unlink($path) {
+        $file = $this->getDriveFile($path);
+        if ($file) {
+            $result = $this->service->files->trash($file->getId());
+            if ($result) {
+                $this->setDriveFile($path, false);
+            }
+            return (bool)$result;
+        } else {
+            return false;
+        }
+    }
+
+    public function rename($path1, $path2) {
+        $file = $this->getDriveFile($path1);
+        if ($file) {
+            $newFile = $this->getDriveFile($path2);
+            if (dirname($path1) === dirname($path2)) {
+                if ($newFile) {
+                    // rename to the name of the target file, could be an office file without extension
+                    $file->setTitle($newFile->getTitle());
+                } else {
+                    $file->setTitle(basename(($path2)));
+                }
+            } else {
+                // Change file parent
+                $parentFolder2 = $this->getDriveFile(dirname($path2));
+                if ($parentFolder2) {
+                    $parent = new \Google_Service_Drive_ParentReference();
+                    $parent->setId($parentFolder2->getId());
+                    $file->setParents(array($parent));
+                } else {
+                    return false;
+                }
+            }
+            // We need to get the object for the existing file with the same
+            // name (if there is one) before we do the patch. If oldfile
+            // exists and is a directory we have to delete it before we
+            // do the rename too.
+            $oldfile = $this->getDriveFile($path2);
+            if ($oldfile && $this->is_dir($path2)) {
+                $this->rmdir($path2);
+                $oldfile = false;
+            }
+            $result = $this->service->files->patch($file->getId(), $file);
+            if ($result) {
+                $this->setDriveFile($path1, false);
+                $this->setDriveFile($path2, $result);
+                if ($oldfile && $newFile) {
+                    // only delete if they have a different id (same id can happen for part files)
+                    if ($newFile->getId() !== $oldfile->getId()) {
+                        $this->service->files->delete($oldfile->getId());
+                    }
+                }
+            }
+            return (bool)$result;
+        } else {
+            return false;
+        }
+    }
+
+    public function fopen($path, $mode) {
+        $pos = strrpos($path, '.');
+        if ($pos !== false) {
+            $ext = substr($path, $pos);
+        } else {
+            $ext = '';
+        }
+        switch ($mode) {
+            case 'r':
+            case 'rb':
+                $file = $this->getDriveFile($path);
+                if ($file) {
+                    $exportLinks = $file->getExportLinks();
+                    $mimetype = $this->getMimeType($path);
+                    $downloadUrl = null;
+                    if ($exportLinks && isset($exportLinks[$mimetype])) {
+                        $downloadUrl = $exportLinks[$mimetype];
+                    } else {
+                        $downloadUrl = $file->getDownloadUrl();
+                    }
+                    if (isset($downloadUrl)) {
+                        $request = new \Google_Http_Request($downloadUrl, 'GET', null, null);
+                        $httpRequest = $this->client->getAuth()->sign($request);
+                        // the library's service doesn't support streaming, so we use Guzzle instead
+                        $client = \OC::$server->getHTTPClientService()->newClient();
+                        try {
+                            $response = $client->get($downloadUrl, [
+                                'headers' => $httpRequest->getRequestHeaders(),
+                                'stream' => true,
+                                'verify' => realpath(__DIR__ . '/../../../3rdparty/google-api-php-client/src/Google/IO/cacerts.pem'),
+                            ]);
+                        } catch (RequestException $e) {
+                            if(!is_null($e->getResponse())) {
+                                if ($e->getResponse()->getStatusCode() === 404) {
+                                    return false;
+                                } else {
+                                    throw $e;
+                                }
+                            } else {
+                                throw $e;
+                            }
+                        }
+
+                        $handle = $response->getBody();
+                        return RetryWrapper::wrap($handle);
+                    }
+                }
+                return false;
+            case 'w':
+            case 'wb':
+            case 'a':
+            case 'ab':
+            case 'r+':
+            case 'w+':
+            case 'wb+':
+            case 'a+':
+            case 'x':
+            case 'x+':
+            case 'c':
+            case 'c+':
+                $tmpFile = \OCP\Files::tmpFile($ext);
+                if ($this->file_exists($path)) {
+                    $source = $this->fopen($path, 'rb');
+                    file_put_contents($tmpFile, $source);
+                }
+                $handle = fopen($tmpFile, $mode);
+                return CallbackWrapper::wrap($handle, null, null, function () use ($path, $tmpFile) {
+                    $this->writeBack($tmpFile, $path);
+                });
+        }
+    }
+
+    public function writeBack($tmpFile, $path) {
+        $parentFolder = $this->getDriveFile(dirname($path));
+        if ($parentFolder) {
+            $mimetype = \OC::$server->getMimeTypeDetector()->detect($tmpFile);
+            $params = array(
+                'mimeType' => $mimetype,
+                'uploadType' => 'media'
+            );
+            $result = false;
+
+            $chunkSizeBytes = 10 * 1024 * 1024;
+
+            $useChunking = false;
+            $size = filesize($tmpFile);
+            if ($size > $chunkSizeBytes) {
+                $useChunking = true;
+            } else {
+                $params['data'] = file_get_contents($tmpFile);
+            }
+
+            if ($this->file_exists($path)) {
+                $file = $this->getDriveFile($path);
+                $this->client->setDefer($useChunking);
+                $request = $this->service->files->update($file->getId(), $file, $params);
+            } else {
+                $file = new \Google_Service_Drive_DriveFile();
+                $file->setTitle(basename($path));
+                $file->setMimeType($mimetype);
+                $parent = new \Google_Service_Drive_ParentReference();
+                $parent->setId($parentFolder->getId());
+                $file->setParents(array($parent));
+                $this->client->setDefer($useChunking);
+                $request = $this->service->files->insert($file, $params);
+            }
+
+            if ($useChunking) {
+                // Create a media file upload to represent our upload process.
+                $media = new \Google_Http_MediaFileUpload(
+                    $this->client,
+                    $request,
+                    'text/plain',
+                    null,
+                    true,
+                    $chunkSizeBytes
+                );
+                $media->setFileSize($size);
+
+                // Upload the various chunks. $status will be false until the process is
+                // complete.
+                $status = false;
+                $handle = fopen($tmpFile, 'rb');
+                while (!$status && !feof($handle)) {
+                    $chunk = fread($handle, $chunkSizeBytes);
+                    $status = $media->nextChunk($chunk);
+                }
+
+                // The final value of $status will be the data from the API for the object
+                // that has been uploaded.
+                $result = false;
+                if ($status !== false) {
+                    $result = $status;
+                }
+
+                fclose($handle);
+            } else {
+                $result = $request;
+            }
+
+            // Reset to the client to execute requests immediately in the future.
+            $this->client->setDefer(false);
+
+            if ($result) {
+                $this->setDriveFile($path, $result);
+            }
+        }
+    }
+
+    public function getMimeType($path) {
+        $file = $this->getDriveFile($path);
+        if ($file) {
+            $mimetype = $file->getMimeType();
+            // Convert Google Doc mimetypes, choosing Open Document formats for download
+            if ($mimetype === self::FOLDER) {
+                return 'httpd/unix-directory';
+            } else if ($mimetype === self::DOCUMENT) {
+                return 'application/vnd.oasis.opendocument.text';
+            } else if ($mimetype === self::SPREADSHEET) {
+                return 'application/x-vnd.oasis.opendocument.spreadsheet';
+            } else if ($mimetype === self::DRAWING) {
+                return 'image/jpeg';
+            } else if ($mimetype === self::PRESENTATION) {
+                // Download as .odp is not available
+                return 'application/pdf';
+            } else {
+                // use extension-based detection, could be an encrypted file
+                return parent::getMimeType($path);
+            }
+        } else {
+            return false;
+        }
+    }
+
+    public function free_space($path) {
+        $about = $this->service->about->get();
+        return $about->getQuotaBytesTotal() - $about->getQuotaBytesUsed();
+    }
+
+    public function touch($path, $mtime = null) {
+        $file = $this->getDriveFile($path);
+        $result = false;
+        if ($file) {
+            if (isset($mtime)) {
+                // This is just RFC3339, but frustratingly, GDrive's API *requires*
+                // the fractions portion be present, while no handy PHP constant
+                // for RFC3339 or ISO8601 includes it. So we do it ourselves.
+                $file->setModifiedDate(date('Y-m-d\TH:i:s.uP', $mtime));
+                $result = $this->service->files->patch($file->getId(), $file, array(
+                    'setModifiedDate' => true,
+                ));
+            } else {
+                $result = $this->service->files->touch($file->getId());
+            }
+        } else {
+            $parentFolder = $this->getDriveFile(dirname($path));
+            if ($parentFolder) {
+                $file = new \Google_Service_Drive_DriveFile();
+                $file->setTitle(basename($path));
+                $parent = new \Google_Service_Drive_ParentReference();
+                $parent->setId($parentFolder->getId());
+                $file->setParents(array($parent));
+                $result = $this->service->files->insert($file);
+            }
+        }
+        if ($result) {
+            $this->setDriveFile($path, $result);
+        }
+        return (bool)$result;
+    }
+
+    public function test() {
+        if ($this->free_space('')) {
+            return true;
+        }
+        return false;
+    }
+
+    public function hasUpdated($path, $time) {
+        $appConfig = \OC::$server->getAppConfig();
+        if ($this->is_file($path)) {
+            return parent::hasUpdated($path, $time);
+        } else {
+            // Google Drive doesn't change modified times of folders when files inside are updated
+            // Instead we use the Changes API to see if folders have been updated, and it's a pain
+            $folder = $this->getDriveFile($path);
+            if ($folder) {
+                $result = false;
+                $folderId = $folder->getId();
+                $startChangeId = $appConfig->getValue('files_external', $this->getId().'cId');
+                $params = array(
+                    'includeDeleted' => true,
+                    'includeSubscribed' => true,
+                );
+                if (isset($startChangeId)) {
+                    $startChangeId = (int)$startChangeId;
+                    $largestChangeId = $startChangeId;
+                    $params['startChangeId'] = $startChangeId + 1;
+                } else {
+                    $largestChangeId = 0;
+                }
+                $pageToken = true;
+                while ($pageToken) {
+                    if ($pageToken !== true) {
+                        $params['pageToken'] = $pageToken;
+                    }
+                    $changes = $this->service->changes->listChanges($params);
+                    if ($largestChangeId === 0 || $largestChangeId === $startChangeId) {
+                        $largestChangeId = $changes->getLargestChangeId();
+                    }
+                    if (isset($startChangeId)) {
+                        // Check if a file in this folder has been updated
+                        // There is no way to filter by folder at the API level...
+                        foreach ($changes->getItems() as $change) {
+                            $file = $change->getFile();
+                            if ($file) {
+                                foreach ($file->getParents() as $parent) {
+                                    if ($parent->getId() === $folderId) {
+                                        $result = true;
+                                    // Check if there are changes in different folders
+                                    } else if ($change->getId() <= $largestChangeId) {
+                                        // Decrement id so this change is fetched when called again
+                                        $largestChangeId = $change->getId();
+                                        $largestChangeId--;
+                                    }
+                                }
+                            }
+                        }
+                        $pageToken = $changes->getNextPageToken();
+                    } else {
+                        // Assuming the initial scan just occurred and changes are negligible
+                        break;
+                    }
+                }
+                $appConfig->setValue('files_external', $this->getId().'cId', $largestChangeId);
+                return $result;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * check if curl is installed
+     */
+    public static function checkDependencies() {
+        return true;
+    }
 
 }

apps/encryption/lib/Crypto/Crypt.php

Indentation +636 added lines, -636 removed lines

@@ -53,641 +53,641 @@
  */
 class Crypt {
 
-	const DEFAULT_CIPHER = 'AES-256-CTR';
-	// default cipher from old Nextcloud versions
-	const LEGACY_CIPHER = 'AES-128-CFB';
-
-	// default key format, old Nextcloud version encrypted the private key directly
-	// with the user password
-	const LEGACY_KEY_FORMAT = 'password';
-
-	const HEADER_START = 'HBEGIN';
-	const HEADER_END = 'HEND';
-
-	/** @var ILogger */
-	private $logger;
-
-	/** @var string */
-	private $user;
-
-	/** @var IConfig */
-	private $config;
-
-	/** @var array */
-	private $supportedKeyFormats;
-
-	/** @var IL10N */
-	private $l;
-
-	/** @var array */
-	private $supportedCiphersAndKeySize = [
-		'AES-256-CTR' => 32,
-		'AES-128-CTR' => 16,
-		'AES-256-CFB' => 32,
-		'AES-128-CFB' => 16,
-	];
-
-	/**
-	 * @param ILogger $logger
-	 * @param IUserSession $userSession
-	 * @param IConfig $config
-	 * @param IL10N $l
-	 */
-	public function __construct(ILogger $logger, IUserSession $userSession, IConfig $config, IL10N $l) {
-		$this->logger = $logger;
-		$this->user = $userSession && $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : '"no user given"';
-		$this->config = $config;
-		$this->l = $l;
-		$this->supportedKeyFormats = ['hash', 'password'];
-	}
-
-	/**
-	 * create new private/public key-pair for user
-	 *
-	 * @return array|bool
-	 */
-	public function createKeyPair() {
-
-		$log = $this->logger;
-		$res = $this->getOpenSSLPKey();
-
-		if (!$res) {
-			$log->error("Encryption Library couldn't generate users key-pair for {$this->user}",
-				['app' => 'encryption']);
-
-			if (openssl_error_string()) {
-				$log->error('Encryption library openssl_pkey_new() fails: ' . openssl_error_string(),
-					['app' => 'encryption']);
-			}
-		} elseif (openssl_pkey_export($res,
-			$privateKey,
-			null,
-			$this->getOpenSSLConfig())) {
-			$keyDetails = openssl_pkey_get_details($res);
-			$publicKey = $keyDetails['key'];
-
-			return [
-				'publicKey' => $publicKey,
-				'privateKey' => $privateKey
-			];
-		}
-		$log->error('Encryption library couldn\'t export users private key, please check your servers OpenSSL configuration.' . $this->user,
-			['app' => 'encryption']);
-		if (openssl_error_string()) {
-			$log->error('Encryption Library:' . openssl_error_string(),
-				['app' => 'encryption']);
-		}
-
-		return false;
-	}
-
-	/**
-	 * Generates a new private key
-	 *
-	 * @return resource
-	 */
-	public function getOpenSSLPKey() {
-		$config = $this->getOpenSSLConfig();
-		return openssl_pkey_new($config);
-	}
-
-	/**
-	 * get openSSL Config
-	 *
-	 * @return array
-	 */
-	private function getOpenSSLConfig() {
-		$config = ['private_key_bits' => 4096];
-		$config = array_merge(
-			$config,
-			$this->config->getSystemValue('openssl', [])
-		);
-		return $config;
-	}
-
-	/**
-	 * @param string $plainContent
-	 * @param string $passPhrase
-	 * @param int $version
-	 * @param int $position
-	 * @return false|string
-	 * @throws EncryptionFailedException
-	 */
-	public function symmetricEncryptFileContent($plainContent, $passPhrase, $version, $position) {
-
-		if (!$plainContent) {
-			$this->logger->error('Encryption Library, symmetrical encryption failed no content given',
-				['app' => 'encryption']);
-			return false;
-		}
-
-		$iv = $this->generateIv();
-
-		$encryptedContent = $this->encrypt($plainContent,
-			$iv,
-			$passPhrase,
-			$this->getCipher());
-
-		// Create a signature based on the key as well as the current version
-		$sig = $this->createSignature($encryptedContent, $passPhrase.$version.$position);
-
-		// combine content to encrypt the IV identifier and actual IV
-		$catFile = $this->concatIV($encryptedContent, $iv);
-		$catFile = $this->concatSig($catFile, $sig);
-		$padded = $this->addPadding($catFile);
-
-		return $padded;
-	}
-
-	/**
-	 * generate header for encrypted file
-	 *
-	 * @param string $keyFormat (can be 'hash' or 'password')
-	 * @return string
-	 * @throws \InvalidArgumentException
-	 */
-	public function generateHeader($keyFormat = 'hash') {
-
-		if (in_array($keyFormat, $this->supportedKeyFormats, true) === false) {
-			throw new \InvalidArgumentException('key format "' . $keyFormat . '" is not supported');
-		}
-
-		$cipher = $this->getCipher();
-
-		$header = self::HEADER_START
-			. ':cipher:' . $cipher
-			. ':keyFormat:' . $keyFormat
-			. ':' . self::HEADER_END;
-
-		return $header;
-	}
-
-	/**
-	 * @param string $plainContent
-	 * @param string $iv
-	 * @param string $passPhrase
-	 * @param string $cipher
-	 * @return string
-	 * @throws EncryptionFailedException
-	 */
-	private function encrypt($plainContent, $iv, $passPhrase = '', $cipher = self::DEFAULT_CIPHER) {
-		$encryptedContent = openssl_encrypt($plainContent,
-			$cipher,
-			$passPhrase,
-			false,
-			$iv);
-
-		if (!$encryptedContent) {
-			$error = 'Encryption (symmetric) of content failed';
-			$this->logger->error($error . openssl_error_string(),
-				['app' => 'encryption']);
-			throw new EncryptionFailedException($error);
-		}
-
-		return $encryptedContent;
-	}
-
-	/**
-	 * return Cipher either from config.php or the default cipher defined in
-	 * this class
-	 *
-	 * @return string
-	 */
-	public function getCipher() {
-		$cipher = $this->config->getSystemValue('cipher', self::DEFAULT_CIPHER);
-		if (!isset($this->supportedCiphersAndKeySize[$cipher])) {
-			$this->logger->warning(
-					sprintf(
-							'Unsupported cipher (%s) defined in config.php supported. Falling back to %s',
-							$cipher,
-							self::DEFAULT_CIPHER
-					),
-				['app' => 'encryption']);
-			$cipher = self::DEFAULT_CIPHER;
-		}
-
-		// Workaround for OpenSSL 0.9.8. Fallback to an old cipher that should work.
-		if(OPENSSL_VERSION_NUMBER < 0x1000101f) {
-			if($cipher === 'AES-256-CTR' || $cipher === 'AES-128-CTR') {
-				$cipher = self::LEGACY_CIPHER;
-			}
-		}
-
-		return $cipher;
-	}
-
-	/**
-	 * get key size depending on the cipher
-	 *
-	 * @param string $cipher
-	 * @return int
-	 * @throws \InvalidArgumentException
-	 */
-	protected function getKeySize($cipher) {
-		if(isset($this->supportedCiphersAndKeySize[$cipher])) {
-			return $this->supportedCiphersAndKeySize[$cipher];
-		}
-
-		throw new \InvalidArgumentException(
-			sprintf(
-					'Unsupported cipher (%s) defined.',
-					$cipher
-			)
-		);
-	}
-
-	/**
-	 * get legacy cipher
-	 *
-	 * @return string
-	 */
-	public function getLegacyCipher() {
-		return self::LEGACY_CIPHER;
-	}
-
-	/**
-	 * @param string $encryptedContent
-	 * @param string $iv
-	 * @return string
-	 */
-	private function concatIV($encryptedContent, $iv) {
-		return $encryptedContent . '00iv00' . $iv;
-	}
-
-	/**
-	 * @param string $encryptedContent
-	 * @param string $signature
-	 * @return string
-	 */
-	private function concatSig($encryptedContent, $signature) {
-		return $encryptedContent . '00sig00' . $signature;
-	}
-
-	/**
-	 * Note: This is _NOT_ a padding used for encryption purposes. It is solely
-	 * used to achieve the PHP stream size. It has _NOTHING_ to do with the
-	 * encrypted content and is not used in any crypto primitive.
-	 *
-	 * @param string $data
-	 * @return string
-	 */
-	private function addPadding($data) {
-		return $data . 'xxx';
-	}
-
-	/**
-	 * generate password hash used to encrypt the users private key
-	 *
-	 * @param string $password
-	 * @param string $cipher
-	 * @param string $uid only used for user keys
-	 * @return string
-	 */
-	protected function generatePasswordHash($password, $cipher, $uid = '') {
-		$instanceId = $this->config->getSystemValue('instanceid');
-		$instanceSecret = $this->config->getSystemValue('secret');
-		$salt = hash('sha256', $uid . $instanceId . $instanceSecret, true);
-		$keySize = $this->getKeySize($cipher);
-
-		$hash = hash_pbkdf2(
-			'sha256',
-			$password,
-			$salt,
-			100000,
-			$keySize,
-			true
-		);
-
-		return $hash;
-	}
-
-	/**
-	 * encrypt private key
-	 *
-	 * @param string $privateKey
-	 * @param string $password
-	 * @param string $uid for regular users, empty for system keys
-	 * @return false|string
-	 */
-	public function encryptPrivateKey($privateKey, $password, $uid = '') {
-		$cipher = $this->getCipher();
-		$hash = $this->generatePasswordHash($password, $cipher, $uid);
-		$encryptedKey = $this->symmetricEncryptFileContent(
-			$privateKey,
-			$hash,
-			0,
-			0
-		);
-
-		return $encryptedKey;
-	}
-
-	/**
-	 * @param string $privateKey
-	 * @param string $password
-	 * @param string $uid for regular users, empty for system keys
-	 * @return false|string
-	 */
-	public function decryptPrivateKey($privateKey, $password = '', $uid = '') {
-
-		$header = $this->parseHeader($privateKey);
-
-		if (isset($header['cipher'])) {
-			$cipher = $header['cipher'];
-		} else {
-			$cipher = self::LEGACY_CIPHER;
-		}
-
-		if (isset($header['keyFormat'])) {
-			$keyFormat = $header['keyFormat'];
-		} else {
-			$keyFormat = self::LEGACY_KEY_FORMAT;
-		}
-
-		if ($keyFormat === 'hash') {
-			$password = $this->generatePasswordHash($password, $cipher, $uid);
-		}
-
-		// If we found a header we need to remove it from the key we want to decrypt
-		if (!empty($header)) {
-			$privateKey = substr($privateKey,
-				strpos($privateKey,
-					self::HEADER_END) + strlen(self::HEADER_END));
-		}
-
-		$plainKey = $this->symmetricDecryptFileContent(
-			$privateKey,
-			$password,
-			$cipher,
-			0
-		);
-
-		if ($this->isValidPrivateKey($plainKey) === false) {
-			return false;
-		}
-
-		return $plainKey;
-	}
-
-	/**
-	 * check if it is a valid private key
-	 *
-	 * @param string $plainKey
-	 * @return bool
-	 */
-	protected function isValidPrivateKey($plainKey) {
-		$res = openssl_get_privatekey($plainKey);
-		if (is_resource($res)) {
-			$sslInfo = openssl_pkey_get_details($res);
-			if (isset($sslInfo['key'])) {
-				return true;
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * @param string $keyFileContents
-	 * @param string $passPhrase
-	 * @param string $cipher
-	 * @param int $version
-	 * @param int $position
-	 * @return string
-	 * @throws DecryptionFailedException
-	 */
-	public function symmetricDecryptFileContent($keyFileContents, $passPhrase, $cipher = self::DEFAULT_CIPHER, $version = 0, $position = 0) {
-		$catFile = $this->splitMetaData($keyFileContents, $cipher);
-
-		if ($catFile['signature'] !== false) {
-			$this->checkSignature($catFile['encrypted'], $passPhrase.$version.$position, $catFile['signature']);
-		}
-
-		return $this->decrypt($catFile['encrypted'],
-			$catFile['iv'],
-			$passPhrase,
-			$cipher);
-	}
-
-	/**
-	 * check for valid signature
-	 *
-	 * @param string $data
-	 * @param string $passPhrase
-	 * @param string $expectedSignature
-	 * @throws GenericEncryptionException
-	 */
-	private function checkSignature($data, $passPhrase, $expectedSignature) {
-		$signature = $this->createSignature($data, $passPhrase);
-		if (!hash_equals($expectedSignature, $signature)) {
-			throw new GenericEncryptionException('Bad Signature', $this->l->t('Bad Signature'));
-		}
-	}
-
-	/**
-	 * create signature
-	 *
-	 * @param string $data
-	 * @param string $passPhrase
-	 * @return string
-	 */
-	private function createSignature($data, $passPhrase) {
-		$passPhrase = hash('sha512', $passPhrase . 'a', true);
-		$signature = hash_hmac('sha256', $data, $passPhrase);
-		return $signature;
-	}
-
-
-	/**
-	 * remove padding
-	 *
-	 * @param string $padded
-	 * @param bool $hasSignature did the block contain a signature, in this case we use a different padding
-	 * @return string|false
-	 */
-	private function removePadding($padded, $hasSignature = false) {
-		if ($hasSignature === false && substr($padded, -2) === 'xx') {
-			return substr($padded, 0, -2);
-		} elseif ($hasSignature === true && substr($padded, -3) === 'xxx') {
-			return substr($padded, 0, -3);
-		}
-		return false;
-	}
-
-	/**
-	 * split meta data from encrypted file
-	 * Note: for now, we assume that the meta data always start with the iv
-	 *       followed by the signature, if available
-	 *
-	 * @param string $catFile
-	 * @param string $cipher
-	 * @return array
-	 */
-	private function splitMetaData($catFile, $cipher) {
-		if ($this->hasSignature($catFile, $cipher)) {
-			$catFile = $this->removePadding($catFile, true);
-			$meta = substr($catFile, -93);
-			$iv = substr($meta, strlen('00iv00'), 16);
-			$sig = substr($meta, 22 + strlen('00sig00'));
-			$encrypted = substr($catFile, 0, -93);
-		} else {
-			$catFile = $this->removePadding($catFile);
-			$meta = substr($catFile, -22);
-			$iv = substr($meta, -16);
-			$sig = false;
-			$encrypted = substr($catFile, 0, -22);
-		}
-
-		return [
-			'encrypted' => $encrypted,
-			'iv' => $iv,
-			'signature' => $sig
-		];
-	}
-
-	/**
-	 * check if encrypted block is signed
-	 *
-	 * @param string $catFile
-	 * @param string $cipher
-	 * @return bool
-	 * @throws GenericEncryptionException
-	 */
-	private function hasSignature($catFile, $cipher) {
-		$meta = substr($catFile, -93);
-		$signaturePosition = strpos($meta, '00sig00');
-
-		// enforce signature for the new 'CTR' ciphers
-		if ($signaturePosition === false && strpos(strtolower($cipher), 'ctr') !== false) {
-			throw new GenericEncryptionException('Missing Signature', $this->l->t('Missing Signature'));
-		}
-
-		return ($signaturePosition !== false);
-	}
-
-
-	/**
-	 * @param string $encryptedContent
-	 * @param string $iv
-	 * @param string $passPhrase
-	 * @param string $cipher
-	 * @return string
-	 * @throws DecryptionFailedException
-	 */
-	private function decrypt($encryptedContent, $iv, $passPhrase = '', $cipher = self::DEFAULT_CIPHER) {
-		$plainContent = openssl_decrypt($encryptedContent,
-			$cipher,
-			$passPhrase,
-			false,
-			$iv);
-
-		if ($plainContent) {
-			return $plainContent;
-		} else {
-			throw new DecryptionFailedException('Encryption library: Decryption (symmetric) of content failed: ' . openssl_error_string());
-		}
-	}
-
-	/**
-	 * @param string $data
-	 * @return array
-	 */
-	protected function parseHeader($data) {
-		$result = [];
-
-		if (substr($data, 0, strlen(self::HEADER_START)) === self::HEADER_START) {
-			$endAt = strpos($data, self::HEADER_END);
-			$header = substr($data, 0, $endAt + strlen(self::HEADER_END));
-
-			// +1 not to start with an ':' which would result in empty element at the beginning
-			$exploded = explode(':',
-				substr($header, strlen(self::HEADER_START) + 1));
-
-			$element = array_shift($exploded);
-
-			while ($element != self::HEADER_END) {
-				$result[$element] = array_shift($exploded);
-				$element = array_shift($exploded);
-			}
-		}
-
-		return $result;
-	}
-
-	/**
-	 * generate initialization vector
-	 *
-	 * @return string
-	 * @throws GenericEncryptionException
-	 */
-	private function generateIv() {
-		return random_bytes(16);
-	}
-
-	/**
-	 * Generate a cryptographically secure pseudo-random 256-bit ASCII key, used
-	 * as file key
-	 *
-	 * @return string
-	 * @throws \Exception
-	 */
-	public function generateFileKey() {
-		return random_bytes(32);
-	}
-
-	/**
-	 * @param $encKeyFile
-	 * @param $shareKey
-	 * @param $privateKey
-	 * @return string
-	 * @throws MultiKeyDecryptException
-	 */
-	public function multiKeyDecrypt($encKeyFile, $shareKey, $privateKey) {
-		if (!$encKeyFile) {
-			throw new MultiKeyDecryptException('Cannot multikey decrypt empty plain content');
-		}
-
-		if (openssl_open($encKeyFile, $plainContent, $shareKey, $privateKey)) {
-			return $plainContent;
-		} else {
-			throw new MultiKeyDecryptException('multikeydecrypt with share key failed:' . openssl_error_string());
-		}
-	}
-
-	/**
-	 * @param string $plainContent
-	 * @param array $keyFiles
-	 * @return array
-	 * @throws MultiKeyEncryptException
-	 */
-	public function multiKeyEncrypt($plainContent, array $keyFiles) {
-		// openssl_seal returns false without errors if plaincontent is empty
-		// so trigger our own error
-		if (empty($plainContent)) {
-			throw new MultiKeyEncryptException('Cannot multikeyencrypt empty plain content');
-		}
-
-		// Set empty vars to be set by openssl by reference
-		$sealed = '';
-		$shareKeys = [];
-		$mappedShareKeys = [];
-
-		if (openssl_seal($plainContent, $sealed, $shareKeys, $keyFiles)) {
-			$i = 0;
-
-			// Ensure each shareKey is labelled with its corresponding key id
-			foreach ($keyFiles as $userId => $publicKey) {
-				$mappedShareKeys[$userId] = $shareKeys[$i];
-				$i++;
-			}
-
-			return [
-				'keys' => $mappedShareKeys,
-				'data' => $sealed
-			];
-		} else {
-			throw new MultiKeyEncryptException('multikeyencryption failed ' . openssl_error_string());
-		}
-	}
+    const DEFAULT_CIPHER = 'AES-256-CTR';
+    // default cipher from old Nextcloud versions
+    const LEGACY_CIPHER = 'AES-128-CFB';
+
+    // default key format, old Nextcloud version encrypted the private key directly
+    // with the user password
+    const LEGACY_KEY_FORMAT = 'password';
+
+    const HEADER_START = 'HBEGIN';
+    const HEADER_END = 'HEND';
+
+    /** @var ILogger */
+    private $logger;
+
+    /** @var string */
+    private $user;
+
+    /** @var IConfig */
+    private $config;
+
+    /** @var array */
+    private $supportedKeyFormats;
+
+    /** @var IL10N */
+    private $l;
+
+    /** @var array */
+    private $supportedCiphersAndKeySize = [
+        'AES-256-CTR' => 32,
+        'AES-128-CTR' => 16,
+        'AES-256-CFB' => 32,
+        'AES-128-CFB' => 16,
+    ];
+
+    /**
+     * @param ILogger $logger
+     * @param IUserSession $userSession
+     * @param IConfig $config
+     * @param IL10N $l
+     */
+    public function __construct(ILogger $logger, IUserSession $userSession, IConfig $config, IL10N $l) {
+        $this->logger = $logger;
+        $this->user = $userSession && $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : '"no user given"';
+        $this->config = $config;
+        $this->l = $l;
+        $this->supportedKeyFormats = ['hash', 'password'];
+    }
+
+    /**
+     * create new private/public key-pair for user
+     *
+     * @return array|bool
+     */
+    public function createKeyPair() {
+
+        $log = $this->logger;
+        $res = $this->getOpenSSLPKey();
+
+        if (!$res) {
+            $log->error("Encryption Library couldn't generate users key-pair for {$this->user}",
+                ['app' => 'encryption']);
+
+            if (openssl_error_string()) {
+                $log->error('Encryption library openssl_pkey_new() fails: ' . openssl_error_string(),
+                    ['app' => 'encryption']);
+            }
+        } elseif (openssl_pkey_export($res,
+            $privateKey,
+            null,
+            $this->getOpenSSLConfig())) {
+            $keyDetails = openssl_pkey_get_details($res);
+            $publicKey = $keyDetails['key'];
+
+            return [
+                'publicKey' => $publicKey,
+                'privateKey' => $privateKey
+            ];
+        }
+        $log->error('Encryption library couldn\'t export users private key, please check your servers OpenSSL configuration.' . $this->user,
+            ['app' => 'encryption']);
+        if (openssl_error_string()) {
+            $log->error('Encryption Library:' . openssl_error_string(),
+                ['app' => 'encryption']);
+        }
+
+        return false;
+    }
+
+    /**
+     * Generates a new private key
+     *
+     * @return resource
+     */
+    public function getOpenSSLPKey() {
+        $config = $this->getOpenSSLConfig();
+        return openssl_pkey_new($config);
+    }
+
+    /**
+     * get openSSL Config
+     *
+     * @return array
+     */
+    private function getOpenSSLConfig() {
+        $config = ['private_key_bits' => 4096];
+        $config = array_merge(
+            $config,
+            $this->config->getSystemValue('openssl', [])
+        );
+        return $config;
+    }
+
+    /**
+     * @param string $plainContent
+     * @param string $passPhrase
+     * @param int $version
+     * @param int $position
+     * @return false|string
+     * @throws EncryptionFailedException
+     */
+    public function symmetricEncryptFileContent($plainContent, $passPhrase, $version, $position) {
+
+        if (!$plainContent) {
+            $this->logger->error('Encryption Library, symmetrical encryption failed no content given',
+                ['app' => 'encryption']);
+            return false;
+        }
+
+        $iv = $this->generateIv();
+
+        $encryptedContent = $this->encrypt($plainContent,
+            $iv,
+            $passPhrase,
+            $this->getCipher());
+
+        // Create a signature based on the key as well as the current version
+        $sig = $this->createSignature($encryptedContent, $passPhrase.$version.$position);
+
+        // combine content to encrypt the IV identifier and actual IV
+        $catFile = $this->concatIV($encryptedContent, $iv);
+        $catFile = $this->concatSig($catFile, $sig);
+        $padded = $this->addPadding($catFile);
+
+        return $padded;
+    }
+
+    /**
+     * generate header for encrypted file
+     *
+     * @param string $keyFormat (can be 'hash' or 'password')
+     * @return string
+     * @throws \InvalidArgumentException
+     */
+    public function generateHeader($keyFormat = 'hash') {
+
+        if (in_array($keyFormat, $this->supportedKeyFormats, true) === false) {
+            throw new \InvalidArgumentException('key format "' . $keyFormat . '" is not supported');
+        }
+
+        $cipher = $this->getCipher();
+
+        $header = self::HEADER_START
+            . ':cipher:' . $cipher
+            . ':keyFormat:' . $keyFormat
+            . ':' . self::HEADER_END;
+
+        return $header;
+    }
+
+    /**
+     * @param string $plainContent
+     * @param string $iv
+     * @param string $passPhrase
+     * @param string $cipher
+     * @return string
+     * @throws EncryptionFailedException
+     */
+    private function encrypt($plainContent, $iv, $passPhrase = '', $cipher = self::DEFAULT_CIPHER) {
+        $encryptedContent = openssl_encrypt($plainContent,
+            $cipher,
+            $passPhrase,
+            false,
+            $iv);
+
+        if (!$encryptedContent) {
+            $error = 'Encryption (symmetric) of content failed';
+            $this->logger->error($error . openssl_error_string(),
+                ['app' => 'encryption']);
+            throw new EncryptionFailedException($error);
+        }
+
+        return $encryptedContent;
+    }
+
+    /**
+     * return Cipher either from config.php or the default cipher defined in
+     * this class
+     *
+     * @return string
+     */
+    public function getCipher() {
+        $cipher = $this->config->getSystemValue('cipher', self::DEFAULT_CIPHER);
+        if (!isset($this->supportedCiphersAndKeySize[$cipher])) {
+            $this->logger->warning(
+                    sprintf(
+                            'Unsupported cipher (%s) defined in config.php supported. Falling back to %s',
+                            $cipher,
+                            self::DEFAULT_CIPHER
+                    ),
+                ['app' => 'encryption']);
+            $cipher = self::DEFAULT_CIPHER;
+        }
+
+        // Workaround for OpenSSL 0.9.8. Fallback to an old cipher that should work.
+        if(OPENSSL_VERSION_NUMBER < 0x1000101f) {
+            if($cipher === 'AES-256-CTR' || $cipher === 'AES-128-CTR') {
+                $cipher = self::LEGACY_CIPHER;
+            }
+        }
+
+        return $cipher;
+    }
+
+    /**
+     * get key size depending on the cipher
+     *
+     * @param string $cipher
+     * @return int
+     * @throws \InvalidArgumentException
+     */
+    protected function getKeySize($cipher) {
+        if(isset($this->supportedCiphersAndKeySize[$cipher])) {
+            return $this->supportedCiphersAndKeySize[$cipher];
+        }
+
+        throw new \InvalidArgumentException(
+            sprintf(
+                    'Unsupported cipher (%s) defined.',
+                    $cipher
+            )
+        );
+    }
+
+    /**
+     * get legacy cipher
+     *
+     * @return string
+     */
+    public function getLegacyCipher() {
+        return self::LEGACY_CIPHER;
+    }
+
+    /**
+     * @param string $encryptedContent
+     * @param string $iv
+     * @return string
+     */
+    private function concatIV($encryptedContent, $iv) {
+        return $encryptedContent . '00iv00' . $iv;
+    }
+
+    /**
+     * @param string $encryptedContent
+     * @param string $signature
+     * @return string
+     */
+    private function concatSig($encryptedContent, $signature) {
+        return $encryptedContent . '00sig00' . $signature;
+    }
+
+    /**
+     * Note: This is _NOT_ a padding used for encryption purposes. It is solely
+     * used to achieve the PHP stream size. It has _NOTHING_ to do with the
+     * encrypted content and is not used in any crypto primitive.
+     *
+     * @param string $data
+     * @return string
+     */
+    private function addPadding($data) {
+        return $data . 'xxx';
+    }
+
+    /**
+     * generate password hash used to encrypt the users private key
+     *
+     * @param string $password
+     * @param string $cipher
+     * @param string $uid only used for user keys
+     * @return string
+     */
+    protected function generatePasswordHash($password, $cipher, $uid = '') {
+        $instanceId = $this->config->getSystemValue('instanceid');
+        $instanceSecret = $this->config->getSystemValue('secret');
+        $salt = hash('sha256', $uid . $instanceId . $instanceSecret, true);
+        $keySize = $this->getKeySize($cipher);
+
+        $hash = hash_pbkdf2(
+            'sha256',
+            $password,
+            $salt,
+            100000,
+            $keySize,
+            true
+        );
+
+        return $hash;
+    }
+
+    /**
+     * encrypt private key
+     *
+     * @param string $privateKey
+     * @param string $password
+     * @param string $uid for regular users, empty for system keys
+     * @return false|string
+     */
+    public function encryptPrivateKey($privateKey, $password, $uid = '') {
+        $cipher = $this->getCipher();
+        $hash = $this->generatePasswordHash($password, $cipher, $uid);
+        $encryptedKey = $this->symmetricEncryptFileContent(
+            $privateKey,
+            $hash,
+            0,
+            0
+        );
+
+        return $encryptedKey;
+    }
+
+    /**
+     * @param string $privateKey
+     * @param string $password
+     * @param string $uid for regular users, empty for system keys
+     * @return false|string
+     */
+    public function decryptPrivateKey($privateKey, $password = '', $uid = '') {
+
+        $header = $this->parseHeader($privateKey);
+
+        if (isset($header['cipher'])) {
+            $cipher = $header['cipher'];
+        } else {
+            $cipher = self::LEGACY_CIPHER;
+        }
+
+        if (isset($header['keyFormat'])) {
+            $keyFormat = $header['keyFormat'];
+        } else {
+            $keyFormat = self::LEGACY_KEY_FORMAT;
+        }
+
+        if ($keyFormat === 'hash') {
+            $password = $this->generatePasswordHash($password, $cipher, $uid);
+        }
+
+        // If we found a header we need to remove it from the key we want to decrypt
+        if (!empty($header)) {
+            $privateKey = substr($privateKey,
+                strpos($privateKey,
+                    self::HEADER_END) + strlen(self::HEADER_END));
+        }
+
+        $plainKey = $this->symmetricDecryptFileContent(
+            $privateKey,
+            $password,
+            $cipher,
+            0
+        );
+
+        if ($this->isValidPrivateKey($plainKey) === false) {
+            return false;
+        }
+
+        return $plainKey;
+    }
+
+    /**
+     * check if it is a valid private key
+     *
+     * @param string $plainKey
+     * @return bool
+     */
+    protected function isValidPrivateKey($plainKey) {
+        $res = openssl_get_privatekey($plainKey);
+        if (is_resource($res)) {
+            $sslInfo = openssl_pkey_get_details($res);
+            if (isset($sslInfo['key'])) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @param string $keyFileContents
+     * @param string $passPhrase
+     * @param string $cipher
+     * @param int $version
+     * @param int $position
+     * @return string
+     * @throws DecryptionFailedException
+     */
+    public function symmetricDecryptFileContent($keyFileContents, $passPhrase, $cipher = self::DEFAULT_CIPHER, $version = 0, $position = 0) {
+        $catFile = $this->splitMetaData($keyFileContents, $cipher);
+
+        if ($catFile['signature'] !== false) {
+            $this->checkSignature($catFile['encrypted'], $passPhrase.$version.$position, $catFile['signature']);
+        }
+
+        return $this->decrypt($catFile['encrypted'],
+            $catFile['iv'],
+            $passPhrase,
+            $cipher);
+    }
+
+    /**
+     * check for valid signature
+     *
+     * @param string $data
+     * @param string $passPhrase
+     * @param string $expectedSignature
+     * @throws GenericEncryptionException
+     */
+    private function checkSignature($data, $passPhrase, $expectedSignature) {
+        $signature = $this->createSignature($data, $passPhrase);
+        if (!hash_equals($expectedSignature, $signature)) {
+            throw new GenericEncryptionException('Bad Signature', $this->l->t('Bad Signature'));
+        }
+    }
+
+    /**
+     * create signature
+     *
+     * @param string $data
+     * @param string $passPhrase
+     * @return string
+     */
+    private function createSignature($data, $passPhrase) {
+        $passPhrase = hash('sha512', $passPhrase . 'a', true);
+        $signature = hash_hmac('sha256', $data, $passPhrase);
+        return $signature;
+    }
+
+
+    /**
+     * remove padding
+     *
+     * @param string $padded
+     * @param bool $hasSignature did the block contain a signature, in this case we use a different padding
+     * @return string|false
+     */
+    private function removePadding($padded, $hasSignature = false) {
+        if ($hasSignature === false && substr($padded, -2) === 'xx') {
+            return substr($padded, 0, -2);
+        } elseif ($hasSignature === true && substr($padded, -3) === 'xxx') {
+            return substr($padded, 0, -3);
+        }
+        return false;
+    }
+
+    /**
+     * split meta data from encrypted file
+     * Note: for now, we assume that the meta data always start with the iv
+     *       followed by the signature, if available
+     *
+     * @param string $catFile
+     * @param string $cipher
+     * @return array
+     */
+    private function splitMetaData($catFile, $cipher) {
+        if ($this->hasSignature($catFile, $cipher)) {
+            $catFile = $this->removePadding($catFile, true);
+            $meta = substr($catFile, -93);
+            $iv = substr($meta, strlen('00iv00'), 16);
+            $sig = substr($meta, 22 + strlen('00sig00'));
+            $encrypted = substr($catFile, 0, -93);
+        } else {
+            $catFile = $this->removePadding($catFile);
+            $meta = substr($catFile, -22);
+            $iv = substr($meta, -16);
+            $sig = false;
+            $encrypted = substr($catFile, 0, -22);
+        }
+
+        return [
+            'encrypted' => $encrypted,
+            'iv' => $iv,
+            'signature' => $sig
+        ];
+    }
+
+    /**
+     * check if encrypted block is signed
+     *
+     * @param string $catFile
+     * @param string $cipher
+     * @return bool
+     * @throws GenericEncryptionException
+     */
+    private function hasSignature($catFile, $cipher) {
+        $meta = substr($catFile, -93);
+        $signaturePosition = strpos($meta, '00sig00');
+
+        // enforce signature for the new 'CTR' ciphers
+        if ($signaturePosition === false && strpos(strtolower($cipher), 'ctr') !== false) {
+            throw new GenericEncryptionException('Missing Signature', $this->l->t('Missing Signature'));
+        }
+
+        return ($signaturePosition !== false);
+    }
+
+
+    /**
+     * @param string $encryptedContent
+     * @param string $iv
+     * @param string $passPhrase
+     * @param string $cipher
+     * @return string
+     * @throws DecryptionFailedException
+     */
+    private function decrypt($encryptedContent, $iv, $passPhrase = '', $cipher = self::DEFAULT_CIPHER) {
+        $plainContent = openssl_decrypt($encryptedContent,
+            $cipher,
+            $passPhrase,
+            false,
+            $iv);
+
+        if ($plainContent) {
+            return $plainContent;
+        } else {
+            throw new DecryptionFailedException('Encryption library: Decryption (symmetric) of content failed: ' . openssl_error_string());
+        }
+    }
+
+    /**
+     * @param string $data
+     * @return array
+     */
+    protected function parseHeader($data) {
+        $result = [];
+
+        if (substr($data, 0, strlen(self::HEADER_START)) === self::HEADER_START) {
+            $endAt = strpos($data, self::HEADER_END);
+            $header = substr($data, 0, $endAt + strlen(self::HEADER_END));
+
+            // +1 not to start with an ':' which would result in empty element at the beginning
+            $exploded = explode(':',
+                substr($header, strlen(self::HEADER_START) + 1));
+
+            $element = array_shift($exploded);
+
+            while ($element != self::HEADER_END) {
+                $result[$element] = array_shift($exploded);
+                $element = array_shift($exploded);
+            }
+        }
+
+        return $result;
+    }
+
+    /**
+     * generate initialization vector
+     *
+     * @return string
+     * @throws GenericEncryptionException
+     */
+    private function generateIv() {
+        return random_bytes(16);
+    }
+
+    /**
+     * Generate a cryptographically secure pseudo-random 256-bit ASCII key, used
+     * as file key
+     *
+     * @return string
+     * @throws \Exception
+     */
+    public function generateFileKey() {
+        return random_bytes(32);
+    }
+
+    /**
+     * @param $encKeyFile
+     * @param $shareKey
+     * @param $privateKey
+     * @return string
+     * @throws MultiKeyDecryptException
+     */
+    public function multiKeyDecrypt($encKeyFile, $shareKey, $privateKey) {
+        if (!$encKeyFile) {
+            throw new MultiKeyDecryptException('Cannot multikey decrypt empty plain content');
+        }
+
+        if (openssl_open($encKeyFile, $plainContent, $shareKey, $privateKey)) {
+            return $plainContent;
+        } else {
+            throw new MultiKeyDecryptException('multikeydecrypt with share key failed:' . openssl_error_string());
+        }
+    }
+
+    /**
+     * @param string $plainContent
+     * @param array $keyFiles
+     * @return array
+     * @throws MultiKeyEncryptException
+     */
+    public function multiKeyEncrypt($plainContent, array $keyFiles) {
+        // openssl_seal returns false without errors if plaincontent is empty
+        // so trigger our own error
+        if (empty($plainContent)) {
+            throw new MultiKeyEncryptException('Cannot multikeyencrypt empty plain content');
+        }
+
+        // Set empty vars to be set by openssl by reference
+        $sealed = '';
+        $shareKeys = [];
+        $mappedShareKeys = [];
+
+        if (openssl_seal($plainContent, $sealed, $shareKeys, $keyFiles)) {
+            $i = 0;
+
+            // Ensure each shareKey is labelled with its corresponding key id
+            foreach ($keyFiles as $userId => $publicKey) {
+                $mappedShareKeys[$userId] = $shareKeys[$i];
+                $i++;
+            }
+
+            return [
+                'keys' => $mappedShareKeys,
+                'data' => $sealed
+            ];
+        } else {
+            throw new MultiKeyEncryptException('multikeyencryption failed ' . openssl_error_string());
+        }
+    }
 }
 

apps/encryption/lib/Crypto/Encryption.php

Indentation +526 added lines, -526 removed lines

@@ -43,530 +43,530 @@
 
 class Encryption implements IEncryptionModule {
 
-	const ID = 'OC_DEFAULT_MODULE';
-	const DISPLAY_NAME = 'Default encryption module';
-
-	/**
-	 * @var Crypt
-	 */
-	private $crypt;
-
-	/** @var string */
-	private $cipher;
-
-	/** @var string */
-	private $path;
-
-	/** @var string */
-	private $user;
-
-	/** @var string */
-	private $fileKey;
-
-	/** @var string */
-	private $writeCache;
-
-	/** @var KeyManager */
-	private $keyManager;
-
-	/** @var array */
-	private $accessList;
-
-	/** @var boolean */
-	private $isWriteOperation;
-
-	/** @var Util */
-	private $util;
-
-	/** @var  Session */
-	private $session;
-
-	/** @var  ILogger */
-	private $logger;
-
-	/** @var IL10N */
-	private $l;
-
-	/** @var EncryptAll */
-	private $encryptAll;
-
-	/** @var  bool */
-	private $useMasterPassword;
-
-	/** @var DecryptAll  */
-	private $decryptAll;
-
-	/** @var int unencrypted block size if block contains signature */
-	private $unencryptedBlockSizeSigned = 6072;
-
-	/** @var int unencrypted block size */
-	private $unencryptedBlockSize = 6126;
-
-	/** @var int Current version of the file */
-	private $version = 0;
-
-	/** @var array remember encryption signature version */
-	private static $rememberVersion = [];
-
-
-	/**
-	 *
-	 * @param Crypt $crypt
-	 * @param KeyManager $keyManager
-	 * @param Util $util
-	 * @param Session $session
-	 * @param EncryptAll $encryptAll
-	 * @param DecryptAll $decryptAll
-	 * @param ILogger $logger
-	 * @param IL10N $il10n
-	 */
-	public function __construct(Crypt $crypt,
-								KeyManager $keyManager,
-								Util $util,
-								Session $session,
-								EncryptAll $encryptAll,
-								DecryptAll $decryptAll,
-								ILogger $logger,
-								IL10N $il10n) {
-		$this->crypt = $crypt;
-		$this->keyManager = $keyManager;
-		$this->util = $util;
-		$this->session = $session;
-		$this->encryptAll = $encryptAll;
-		$this->decryptAll = $decryptAll;
-		$this->logger = $logger;
-		$this->l = $il10n;
-		$this->useMasterPassword = $util->isMasterKeyEnabled();
-	}
-
-	/**
-	 * @return string defining the technical unique id
-	 */
-	public function getId() {
-		return self::ID;
-	}
-
-	/**
-	 * In comparison to getKey() this function returns a human readable (maybe translated) name
-	 *
-	 * @return string
-	 */
-	public function getDisplayName() {
-		return self::DISPLAY_NAME;
-	}
-
-	/**
-	 * start receiving chunks from a file. This is the place where you can
-	 * perform some initial step before starting encrypting/decrypting the
-	 * chunks
-	 *
-	 * @param string $path to the file
-	 * @param string $user who read/write the file
-	 * @param string $mode php stream open mode
-	 * @param array $header contains the header data read from the file
-	 * @param array $accessList who has access to the file contains the key 'users' and 'public'
-	 *
-	 * @return array $header contain data as key-value pairs which should be
-	 *                       written to the header, in case of a write operation
-	 *                       or if no additional data is needed return a empty array
-	 */
-	public function begin($path, $user, $mode, array $header, array $accessList) {
-		$this->path = $this->getPathToRealFile($path);
-		$this->accessList = $accessList;
-		$this->user = $user;
-		$this->isWriteOperation = false;
-		$this->writeCache = '';
-
-		if($this->session->isReady() === false) {
-			// if the master key is enabled we can initialize encryption
-			// with a empty password and user name
-			if ($this->util->isMasterKeyEnabled()) {
-				$this->keyManager->init('', '');
-			}
-		}
-
-		if ($this->session->decryptAllModeActivated()) {
-			$encryptedFileKey = $this->keyManager->getEncryptedFileKey($this->path);
-			$shareKey = $this->keyManager->getShareKey($this->path, $this->session->getDecryptAllUid());
-			$this->fileKey = $this->crypt->multiKeyDecrypt($encryptedFileKey,
-				$shareKey,
-				$this->session->getDecryptAllKey());
-		} else {
-			$this->fileKey = $this->keyManager->getFileKey($this->path, $this->user);
-		}
-
-		// always use the version from the original file, also part files
-		// need to have a correct version number if they get moved over to the
-		// final location
-		$this->version = (int)$this->keyManager->getVersion($this->stripPartFileExtension($path), new View());
-
-		if (
-			$mode === 'w'
-			|| $mode === 'w+'
-			|| $mode === 'wb'
-			|| $mode === 'wb+'
-		) {
-			$this->isWriteOperation = true;
-			if (empty($this->fileKey)) {
-				$this->fileKey = $this->crypt->generateFileKey();
-			}
-		} else {
-			// if we read a part file we need to increase the version by 1
-			// because the version number was also increased by writing
-			// the part file
-			if(Scanner::isPartialFile($path)) {
-				$this->version = $this->version + 1;
-			}
-		}
-
-		if ($this->isWriteOperation) {
-			$this->cipher = $this->crypt->getCipher();
-		} elseif (isset($header['cipher'])) {
-			$this->cipher = $header['cipher'];
-		} else {
-			// if we read a file without a header we fall-back to the legacy cipher
-			// which was used in <=oC6
-			$this->cipher = $this->crypt->getLegacyCipher();
-		}
-
-		return array('cipher' => $this->cipher, 'signed' => 'true');
-	}
-
-	/**
-	 * last chunk received. This is the place where you can perform some final
-	 * operation and return some remaining data if something is left in your
-	 * buffer.
-	 *
-	 * @param string $path to the file
-	 * @param int $position
-	 * @return string remained data which should be written to the file in case
-	 *                of a write operation
-	 * @throws PublicKeyMissingException
-	 * @throws \Exception
-	 * @throws \OCA\Encryption\Exceptions\MultiKeyEncryptException
-	 */
-	public function end($path, $position = 0) {
-		$result = '';
-		if ($this->isWriteOperation) {
-			$this->keyManager->setVersion($path, $this->version + 1, new View());
-			// in case of a part file we remember the new signature versions
-			// the version will be set later on update.
-			// This way we make sure that other apps listening to the pre-hooks
-			// still get the old version which should be the correct value for them
-			if (Scanner::isPartialFile($path)) {
-				self::$rememberVersion[$this->stripPartFileExtension($path)] = $this->version + 1;
-			}
-			if (!empty($this->writeCache)) {
-				$result = $this->crypt->symmetricEncryptFileContent($this->writeCache, $this->fileKey, $this->version + 1, $position);
-				$this->writeCache = '';
-			}
-			$publicKeys = array();
-			if ($this->useMasterPassword === true) {
-				$publicKeys[$this->keyManager->getMasterKeyId()] = $this->keyManager->getPublicMasterKey();
-			} else {
-				foreach ($this->accessList['users'] as $uid) {
-					try {
-						$publicKeys[$uid] = $this->keyManager->getPublicKey($uid);
-					} catch (PublicKeyMissingException $e) {
-						$this->logger->warning(
-							'no public key found for user "{uid}", user will not be able to read the file',
-							['app' => 'encryption', 'uid' => $uid]
-						);
-						// if the public key of the owner is missing we should fail
-						if ($uid === $this->user) {
-							throw $e;
-						}
-					}
-				}
-			}
-
-			$publicKeys = $this->keyManager->addSystemKeys($this->accessList, $publicKeys, $this->user);
-			$encryptedKeyfiles = $this->crypt->multiKeyEncrypt($this->fileKey, $publicKeys);
-			$this->keyManager->setAllFileKeys($this->path, $encryptedKeyfiles);
-		}
-		return $result;
-	}
-
-	/**
-	 * encrypt data
-	 *
-	 * @param string $data you want to encrypt
-	 * @param int $position
-	 * @return string encrypted data
-	 */
-	public function encrypt($data, $position = 0) {
-		// If extra data is left over from the last round, make sure it
-		// is integrated into the next block
-		if ($this->writeCache) {
-
-			// Concat writeCache to start of $data
-			$data = $this->writeCache . $data;
-
-			// Clear the write cache, ready for reuse - it has been
-			// flushed and its old contents processed
-			$this->writeCache = '';
-
-		}
-
-		$encrypted = '';
-		// While there still remains some data to be processed & written
-		while (strlen($data) > 0) {
-
-			// Remaining length for this iteration, not of the
-			// entire file (may be greater than 8192 bytes)
-			$remainingLength = strlen($data);
-
-			// If data remaining to be written is less than the
-			// size of 1 6126 byte block
-			if ($remainingLength < $this->unencryptedBlockSizeSigned) {
-
-				// Set writeCache to contents of $data
-				// The writeCache will be carried over to the
-				// next write round, and added to the start of
-				// $data to ensure that written blocks are
-				// always the correct length. If there is still
-				// data in writeCache after the writing round
-				// has finished, then the data will be written
-				// to disk by $this->flush().
-				$this->writeCache = $data;
-
-				// Clear $data ready for next round
-				$data = '';
-
-			} else {
-
-				// Read the chunk from the start of $data
-				$chunk = substr($data, 0, $this->unencryptedBlockSizeSigned);
-
-				$encrypted .= $this->crypt->symmetricEncryptFileContent($chunk, $this->fileKey, $this->version + 1, $position);
-
-				// Remove the chunk we just processed from
-				// $data, leaving only unprocessed data in $data
-				// var, for handling on the next round
-				$data = substr($data, $this->unencryptedBlockSizeSigned);
-
-			}
-
-		}
-
-		return $encrypted;
-	}
-
-	/**
-	 * decrypt data
-	 *
-	 * @param string $data you want to decrypt
-	 * @param int $position
-	 * @return string decrypted data
-	 * @throws DecryptionFailedException
-	 */
-	public function decrypt($data, $position = 0) {
-		if (empty($this->fileKey)) {
-			$msg = 'Can not decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.';
-			$hint = $this->l->t('Can not decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.');
-			$this->logger->error($msg);
-
-			throw new DecryptionFailedException($msg, $hint);
-		}
-
-		return $this->crypt->symmetricDecryptFileContent($data, $this->fileKey, $this->cipher, $this->version, $position);
-	}
-
-	/**
-	 * update encrypted file, e.g. give additional users access to the file
-	 *
-	 * @param string $path path to the file which should be updated
-	 * @param string $uid of the user who performs the operation
-	 * @param array $accessList who has access to the file contains the key 'users' and 'public'
-	 * @return boolean
-	 */
-	public function update($path, $uid, array $accessList) {
-
-		if (empty($accessList)) {
-			if (isset(self::$rememberVersion[$path])) {
-				$this->keyManager->setVersion($path, self::$rememberVersion[$path], new View());
-				unset(self::$rememberVersion[$path]);
-			}
-			return;
-		}
-
-		$fileKey = $this->keyManager->getFileKey($path, $uid);
-
-		if (!empty($fileKey)) {
-
-			$publicKeys = array();
-			if ($this->useMasterPassword === true) {
-				$publicKeys[$this->keyManager->getMasterKeyId()] = $this->keyManager->getPublicMasterKey();
-			} else {
-				foreach ($accessList['users'] as $user) {
-					try {
-						$publicKeys[$user] = $this->keyManager->getPublicKey($user);
-					} catch (PublicKeyMissingException $e) {
-						$this->logger->warning('Could not encrypt file for ' . $user . ': ' . $e->getMessage());
-					}
-				}
-			}
-
-			$publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $uid);
-
-			$encryptedFileKey = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys);
-
-			$this->keyManager->deleteAllFileKeys($path);
-
-			$this->keyManager->setAllFileKeys($path, $encryptedFileKey);
-
-		} else {
-			$this->logger->debug('no file key found, we assume that the file "{file}" is not encrypted',
-				array('file' => $path, 'app' => 'encryption'));
-
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * should the file be encrypted or not
-	 *
-	 * @param string $path
-	 * @return boolean
-	 */
-	public function shouldEncrypt($path) {
-		if ($this->util->shouldEncryptHomeStorage() === false) {
-			$storage = $this->util->getStorage($path);
-			if ($storage->instanceOfStorage('\OCP\Files\IHomeStorage')) {
-				return false;
-			}
-		}
-		$parts = explode('/', $path);
-		if (count($parts) < 4) {
-			return false;
-		}
-
-		if ($parts[2] == 'files') {
-			return true;
-		}
-		if ($parts[2] == 'files_versions') {
-			return true;
-		}
-		if ($parts[2] == 'files_trashbin') {
-			return true;
-		}
-
-		return false;
-	}
-
-	/**
-	 * get size of the unencrypted payload per block.
-	 * Nextcloud read/write files with a block size of 8192 byte
-	 *
-	 * @param bool $signed
-	 * @return int
-	 */
-	public function getUnencryptedBlockSize($signed = false) {
-		if ($signed === false) {
-			return $this->unencryptedBlockSize;
-		}
-
-		return $this->unencryptedBlockSizeSigned;
-	}
-
-	/**
-	 * check if the encryption module is able to read the file,
-	 * e.g. if all encryption keys exists
-	 *
-	 * @param string $path
-	 * @param string $uid user for whom we want to check if he can read the file
-	 * @return bool
-	 * @throws DecryptionFailedException
-	 */
-	public function isReadable($path, $uid) {
-		$fileKey = $this->keyManager->getFileKey($path, $uid);
-		if (empty($fileKey)) {
-			$owner = $this->util->getOwner($path);
-			if ($owner !== $uid) {
-				// if it is a shared file we throw a exception with a useful
-				// error message because in this case it means that the file was
-				// shared with the user at a point where the user didn't had a
-				// valid private/public key
-				$msg = 'Encryption module "' . $this->getDisplayName() .
-					'" is not able to read ' . $path;
-				$hint = $this->l->t('Can not read this file, probably this is a shared file. Please ask the file owner to reshare the file with you.');
-				$this->logger->warning($msg);
-				throw new DecryptionFailedException($msg, $hint);
-			}
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * Initial encryption of all files
-	 *
-	 * @param InputInterface $input
-	 * @param OutputInterface $output write some status information to the terminal during encryption
-	 */
-	public function encryptAll(InputInterface $input, OutputInterface $output) {
-		$this->encryptAll->encryptAll($input, $output);
-	}
-
-	/**
-	 * prepare module to perform decrypt all operation
-	 *
-	 * @param InputInterface $input
-	 * @param OutputInterface $output
-	 * @param string $user
-	 * @return bool
-	 */
-	public function prepareDecryptAll(InputInterface $input, OutputInterface $output, $user = '') {
-		return $this->decryptAll->prepare($input, $output, $user);
-	}
-
-
-	/**
-	 * @param string $path
-	 * @return string
-	 */
-	protected function getPathToRealFile($path) {
-		$realPath = $path;
-		$parts = explode('/', $path);
-		if ($parts[2] === 'files_versions') {
-			$realPath = '/' . $parts[1] . '/files/' . implode('/', array_slice($parts, 3));
-			$length = strrpos($realPath, '.');
-			$realPath = substr($realPath, 0, $length);
-		}
-
-		return $realPath;
-	}
-
-	/**
-	 * remove .part file extension and the ocTransferId from the file to get the
-	 * original file name
-	 *
-	 * @param string $path
-	 * @return string
-	 */
-	protected function stripPartFileExtension($path) {
-		if (pathinfo($path, PATHINFO_EXTENSION) === 'part') {
-			$pos = strrpos($path, '.', -6);
-			$path = substr($path, 0, $pos);
-		}
-
-		return $path;
-	}
-
-	/**
-	 * Check if the module is ready to be used by that specific user.
-	 * In case a module is not ready - because e.g. key pairs have not been generated
-	 * upon login this method can return false before any operation starts and might
-	 * cause issues during operations.
-	 *
-	 * @param string $user
-	 * @return boolean
-	 * @since 9.1.0
-	 */
-	public function isReadyForUser($user) {
-		return $this->keyManager->userHasKeys($user);
-	}
+    const ID = 'OC_DEFAULT_MODULE';
+    const DISPLAY_NAME = 'Default encryption module';
+
+    /**
+     * @var Crypt
+     */
+    private $crypt;
+
+    /** @var string */
+    private $cipher;
+
+    /** @var string */
+    private $path;
+
+    /** @var string */
+    private $user;
+
+    /** @var string */
+    private $fileKey;
+
+    /** @var string */
+    private $writeCache;
+
+    /** @var KeyManager */
+    private $keyManager;
+
+    /** @var array */
+    private $accessList;
+
+    /** @var boolean */
+    private $isWriteOperation;
+
+    /** @var Util */
+    private $util;
+
+    /** @var  Session */
+    private $session;
+
+    /** @var  ILogger */
+    private $logger;
+
+    /** @var IL10N */
+    private $l;
+
+    /** @var EncryptAll */
+    private $encryptAll;
+
+    /** @var  bool */
+    private $useMasterPassword;
+
+    /** @var DecryptAll  */
+    private $decryptAll;
+
+    /** @var int unencrypted block size if block contains signature */
+    private $unencryptedBlockSizeSigned = 6072;
+
+    /** @var int unencrypted block size */
+    private $unencryptedBlockSize = 6126;
+
+    /** @var int Current version of the file */
+    private $version = 0;
+
+    /** @var array remember encryption signature version */
+    private static $rememberVersion = [];
+
+
+    /**
+     *
+     * @param Crypt $crypt
+     * @param KeyManager $keyManager
+     * @param Util $util
+     * @param Session $session
+     * @param EncryptAll $encryptAll
+     * @param DecryptAll $decryptAll
+     * @param ILogger $logger
+     * @param IL10N $il10n
+     */
+    public function __construct(Crypt $crypt,
+                                KeyManager $keyManager,
+                                Util $util,
+                                Session $session,
+                                EncryptAll $encryptAll,
+                                DecryptAll $decryptAll,
+                                ILogger $logger,
+                                IL10N $il10n) {
+        $this->crypt = $crypt;
+        $this->keyManager = $keyManager;
+        $this->util = $util;
+        $this->session = $session;
+        $this->encryptAll = $encryptAll;
+        $this->decryptAll = $decryptAll;
+        $this->logger = $logger;
+        $this->l = $il10n;
+        $this->useMasterPassword = $util->isMasterKeyEnabled();
+    }
+
+    /**
+     * @return string defining the technical unique id
+     */
+    public function getId() {
+        return self::ID;
+    }
+
+    /**
+     * In comparison to getKey() this function returns a human readable (maybe translated) name
+     *
+     * @return string
+     */
+    public function getDisplayName() {
+        return self::DISPLAY_NAME;
+    }
+
+    /**
+     * start receiving chunks from a file. This is the place where you can
+     * perform some initial step before starting encrypting/decrypting the
+     * chunks
+     *
+     * @param string $path to the file
+     * @param string $user who read/write the file
+     * @param string $mode php stream open mode
+     * @param array $header contains the header data read from the file
+     * @param array $accessList who has access to the file contains the key 'users' and 'public'
+     *
+     * @return array $header contain data as key-value pairs which should be
+     *                       written to the header, in case of a write operation
+     *                       or if no additional data is needed return a empty array
+     */
+    public function begin($path, $user, $mode, array $header, array $accessList) {
+        $this->path = $this->getPathToRealFile($path);
+        $this->accessList = $accessList;
+        $this->user = $user;
+        $this->isWriteOperation = false;
+        $this->writeCache = '';
+
+        if($this->session->isReady() === false) {
+            // if the master key is enabled we can initialize encryption
+            // with a empty password and user name
+            if ($this->util->isMasterKeyEnabled()) {
+                $this->keyManager->init('', '');
+            }
+        }
+
+        if ($this->session->decryptAllModeActivated()) {
+            $encryptedFileKey = $this->keyManager->getEncryptedFileKey($this->path);
+            $shareKey = $this->keyManager->getShareKey($this->path, $this->session->getDecryptAllUid());
+            $this->fileKey = $this->crypt->multiKeyDecrypt($encryptedFileKey,
+                $shareKey,
+                $this->session->getDecryptAllKey());
+        } else {
+            $this->fileKey = $this->keyManager->getFileKey($this->path, $this->user);
+        }
+
+        // always use the version from the original file, also part files
+        // need to have a correct version number if they get moved over to the
+        // final location
+        $this->version = (int)$this->keyManager->getVersion($this->stripPartFileExtension($path), new View());
+
+        if (
+            $mode === 'w'
+            || $mode === 'w+'
+            || $mode === 'wb'
+            || $mode === 'wb+'
+        ) {
+            $this->isWriteOperation = true;
+            if (empty($this->fileKey)) {
+                $this->fileKey = $this->crypt->generateFileKey();
+            }
+        } else {
+            // if we read a part file we need to increase the version by 1
+            // because the version number was also increased by writing
+            // the part file
+            if(Scanner::isPartialFile($path)) {
+                $this->version = $this->version + 1;
+            }
+        }
+
+        if ($this->isWriteOperation) {
+            $this->cipher = $this->crypt->getCipher();
+        } elseif (isset($header['cipher'])) {
+            $this->cipher = $header['cipher'];
+        } else {
+            // if we read a file without a header we fall-back to the legacy cipher
+            // which was used in <=oC6
+            $this->cipher = $this->crypt->getLegacyCipher();
+        }
+
+        return array('cipher' => $this->cipher, 'signed' => 'true');
+    }
+
+    /**
+     * last chunk received. This is the place where you can perform some final
+     * operation and return some remaining data if something is left in your
+     * buffer.
+     *
+     * @param string $path to the file
+     * @param int $position
+     * @return string remained data which should be written to the file in case
+     *                of a write operation
+     * @throws PublicKeyMissingException
+     * @throws \Exception
+     * @throws \OCA\Encryption\Exceptions\MultiKeyEncryptException
+     */
+    public function end($path, $position = 0) {
+        $result = '';
+        if ($this->isWriteOperation) {
+            $this->keyManager->setVersion($path, $this->version + 1, new View());
+            // in case of a part file we remember the new signature versions
+            // the version will be set later on update.
+            // This way we make sure that other apps listening to the pre-hooks
+            // still get the old version which should be the correct value for them
+            if (Scanner::isPartialFile($path)) {
+                self::$rememberVersion[$this->stripPartFileExtension($path)] = $this->version + 1;
+            }
+            if (!empty($this->writeCache)) {
+                $result = $this->crypt->symmetricEncryptFileContent($this->writeCache, $this->fileKey, $this->version + 1, $position);
+                $this->writeCache = '';
+            }
+            $publicKeys = array();
+            if ($this->useMasterPassword === true) {
+                $publicKeys[$this->keyManager->getMasterKeyId()] = $this->keyManager->getPublicMasterKey();
+            } else {
+                foreach ($this->accessList['users'] as $uid) {
+                    try {
+                        $publicKeys[$uid] = $this->keyManager->getPublicKey($uid);
+                    } catch (PublicKeyMissingException $e) {
+                        $this->logger->warning(
+                            'no public key found for user "{uid}", user will not be able to read the file',
+                            ['app' => 'encryption', 'uid' => $uid]
+                        );
+                        // if the public key of the owner is missing we should fail
+                        if ($uid === $this->user) {
+                            throw $e;
+                        }
+                    }
+                }
+            }
+
+            $publicKeys = $this->keyManager->addSystemKeys($this->accessList, $publicKeys, $this->user);
+            $encryptedKeyfiles = $this->crypt->multiKeyEncrypt($this->fileKey, $publicKeys);
+            $this->keyManager->setAllFileKeys($this->path, $encryptedKeyfiles);
+        }
+        return $result;
+    }
+
+    /**
+     * encrypt data
+     *
+     * @param string $data you want to encrypt
+     * @param int $position
+     * @return string encrypted data
+     */
+    public function encrypt($data, $position = 0) {
+        // If extra data is left over from the last round, make sure it
+        // is integrated into the next block
+        if ($this->writeCache) {
+
+            // Concat writeCache to start of $data
+            $data = $this->writeCache . $data;
+
+            // Clear the write cache, ready for reuse - it has been
+            // flushed and its old contents processed
+            $this->writeCache = '';
+
+        }
+
+        $encrypted = '';
+        // While there still remains some data to be processed & written
+        while (strlen($data) > 0) {
+
+            // Remaining length for this iteration, not of the
+            // entire file (may be greater than 8192 bytes)
+            $remainingLength = strlen($data);
+
+            // If data remaining to be written is less than the
+            // size of 1 6126 byte block
+            if ($remainingLength < $this->unencryptedBlockSizeSigned) {
+
+                // Set writeCache to contents of $data
+                // The writeCache will be carried over to the
+                // next write round, and added to the start of
+                // $data to ensure that written blocks are
+                // always the correct length. If there is still
+                // data in writeCache after the writing round
+                // has finished, then the data will be written
+                // to disk by $this->flush().
+                $this->writeCache = $data;
+
+                // Clear $data ready for next round
+                $data = '';
+
+            } else {
+
+                // Read the chunk from the start of $data
+                $chunk = substr($data, 0, $this->unencryptedBlockSizeSigned);
+
+                $encrypted .= $this->crypt->symmetricEncryptFileContent($chunk, $this->fileKey, $this->version + 1, $position);
+
+                // Remove the chunk we just processed from
+                // $data, leaving only unprocessed data in $data
+                // var, for handling on the next round
+                $data = substr($data, $this->unencryptedBlockSizeSigned);
+
+            }
+
+        }
+
+        return $encrypted;
+    }
+
+    /**
+     * decrypt data
+     *
+     * @param string $data you want to decrypt
+     * @param int $position
+     * @return string decrypted data
+     * @throws DecryptionFailedException
+     */
+    public function decrypt($data, $position = 0) {
+        if (empty($this->fileKey)) {
+            $msg = 'Can not decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.';
+            $hint = $this->l->t('Can not decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.');
+            $this->logger->error($msg);
+
+            throw new DecryptionFailedException($msg, $hint);
+        }
+
+        return $this->crypt->symmetricDecryptFileContent($data, $this->fileKey, $this->cipher, $this->version, $position);
+    }
+
+    /**
+     * update encrypted file, e.g. give additional users access to the file
+     *
+     * @param string $path path to the file which should be updated
+     * @param string $uid of the user who performs the operation
+     * @param array $accessList who has access to the file contains the key 'users' and 'public'
+     * @return boolean
+     */
+    public function update($path, $uid, array $accessList) {
+
+        if (empty($accessList)) {
+            if (isset(self::$rememberVersion[$path])) {
+                $this->keyManager->setVersion($path, self::$rememberVersion[$path], new View());
+                unset(self::$rememberVersion[$path]);
+            }
+            return;
+        }
+
+        $fileKey = $this->keyManager->getFileKey($path, $uid);
+
+        if (!empty($fileKey)) {
+
+            $publicKeys = array();
+            if ($this->useMasterPassword === true) {
+                $publicKeys[$this->keyManager->getMasterKeyId()] = $this->keyManager->getPublicMasterKey();
+            } else {
+                foreach ($accessList['users'] as $user) {
+                    try {
+                        $publicKeys[$user] = $this->keyManager->getPublicKey($user);
+                    } catch (PublicKeyMissingException $e) {
+                        $this->logger->warning('Could not encrypt file for ' . $user . ': ' . $e->getMessage());
+                    }
+                }
+            }
+
+            $publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $uid);
+
+            $encryptedFileKey = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys);
+
+            $this->keyManager->deleteAllFileKeys($path);
+
+            $this->keyManager->setAllFileKeys($path, $encryptedFileKey);
+
+        } else {
+            $this->logger->debug('no file key found, we assume that the file "{file}" is not encrypted',
+                array('file' => $path, 'app' => 'encryption'));
+
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * should the file be encrypted or not
+     *
+     * @param string $path
+     * @return boolean
+     */
+    public function shouldEncrypt($path) {
+        if ($this->util->shouldEncryptHomeStorage() === false) {
+            $storage = $this->util->getStorage($path);
+            if ($storage->instanceOfStorage('\OCP\Files\IHomeStorage')) {
+                return false;
+            }
+        }
+        $parts = explode('/', $path);
+        if (count($parts) < 4) {
+            return false;
+        }
+
+        if ($parts[2] == 'files') {
+            return true;
+        }
+        if ($parts[2] == 'files_versions') {
+            return true;
+        }
+        if ($parts[2] == 'files_trashbin') {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * get size of the unencrypted payload per block.
+     * Nextcloud read/write files with a block size of 8192 byte
+     *
+     * @param bool $signed
+     * @return int
+     */
+    public function getUnencryptedBlockSize($signed = false) {
+        if ($signed === false) {
+            return $this->unencryptedBlockSize;
+        }
+
+        return $this->unencryptedBlockSizeSigned;
+    }
+
+    /**
+     * check if the encryption module is able to read the file,
+     * e.g. if all encryption keys exists
+     *
+     * @param string $path
+     * @param string $uid user for whom we want to check if he can read the file
+     * @return bool
+     * @throws DecryptionFailedException
+     */
+    public function isReadable($path, $uid) {
+        $fileKey = $this->keyManager->getFileKey($path, $uid);
+        if (empty($fileKey)) {
+            $owner = $this->util->getOwner($path);
+            if ($owner !== $uid) {
+                // if it is a shared file we throw a exception with a useful
+                // error message because in this case it means that the file was
+                // shared with the user at a point where the user didn't had a
+                // valid private/public key
+                $msg = 'Encryption module "' . $this->getDisplayName() .
+                    '" is not able to read ' . $path;
+                $hint = $this->l->t('Can not read this file, probably this is a shared file. Please ask the file owner to reshare the file with you.');
+                $this->logger->warning($msg);
+                throw new DecryptionFailedException($msg, $hint);
+            }
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Initial encryption of all files
+     *
+     * @param InputInterface $input
+     * @param OutputInterface $output write some status information to the terminal during encryption
+     */
+    public function encryptAll(InputInterface $input, OutputInterface $output) {
+        $this->encryptAll->encryptAll($input, $output);
+    }
+
+    /**
+     * prepare module to perform decrypt all operation
+     *
+     * @param InputInterface $input
+     * @param OutputInterface $output
+     * @param string $user
+     * @return bool
+     */
+    public function prepareDecryptAll(InputInterface $input, OutputInterface $output, $user = '') {
+        return $this->decryptAll->prepare($input, $output, $user);
+    }
+
+
+    /**
+     * @param string $path
+     * @return string
+     */
+    protected function getPathToRealFile($path) {
+        $realPath = $path;
+        $parts = explode('/', $path);
+        if ($parts[2] === 'files_versions') {
+            $realPath = '/' . $parts[1] . '/files/' . implode('/', array_slice($parts, 3));
+            $length = strrpos($realPath, '.');
+            $realPath = substr($realPath, 0, $length);
+        }
+
+        return $realPath;
+    }
+
+    /**
+     * remove .part file extension and the ocTransferId from the file to get the
+     * original file name
+     *
+     * @param string $path
+     * @return string
+     */
+    protected function stripPartFileExtension($path) {
+        if (pathinfo($path, PATHINFO_EXTENSION) === 'part') {
+            $pos = strrpos($path, '.', -6);
+            $path = substr($path, 0, $pos);
+        }
+
+        return $path;
+    }
+
+    /**
+     * Check if the module is ready to be used by that specific user.
+     * In case a module is not ready - because e.g. key pairs have not been generated
+     * upon login this method can return false before any operation starts and might
+     * cause issues during operations.
+     *
+     * @param string $user
+     * @return boolean
+     * @since 9.1.0
+     */
+    public function isReadyForUser($user) {
+        return $this->keyManager->userHasKeys($user);
+    }
 }

apps/encryption/lib/Hooks/UserHooks.php

Indentation +302 added lines, -302 removed lines

@@ -41,306 +41,306 @@
 
 class UserHooks implements IHook {
 
-	/**
-	 * list of user for which we perform a password reset
-	 * @var array
-	 */
-	protected static $passwordResetUsers = [];
-
-	/**
-	 * @var KeyManager
-	 */
-	private $keyManager;
-	/**
-	 * @var IUserManager
-	 */
-	private $userManager;
-	/**
-	 * @var ILogger
-	 */
-	private $logger;
-	/**
-	 * @var Setup
-	 */
-	private $userSetup;
-	/**
-	 * @var IUserSession
-	 */
-	private $user;
-	/**
-	 * @var Util
-	 */
-	private $util;
-	/**
-	 * @var Session
-	 */
-	private $session;
-	/**
-	 * @var Recovery
-	 */
-	private $recovery;
-	/**
-	 * @var Crypt
-	 */
-	private $crypt;
-
-	/**
-	 * UserHooks constructor.
-	 *
-	 * @param KeyManager $keyManager
-	 * @param IUserManager $userManager
-	 * @param ILogger $logger
-	 * @param Setup $userSetup
-	 * @param IUserSession $user
-	 * @param Util $util
-	 * @param Session $session
-	 * @param Crypt $crypt
-	 * @param Recovery $recovery
-	 */
-	public function __construct(KeyManager $keyManager,
-								IUserManager $userManager,
-								ILogger $logger,
-								Setup $userSetup,
-								IUserSession $user,
-								Util $util,
-								Session $session,
-								Crypt $crypt,
-								Recovery $recovery) {
-
-		$this->keyManager = $keyManager;
-		$this->userManager = $userManager;
-		$this->logger = $logger;
-		$this->userSetup = $userSetup;
-		$this->user = $user;
-		$this->util = $util;
-		$this->session = $session;
-		$this->recovery = $recovery;
-		$this->crypt = $crypt;
-	}
-
-	/**
-	 * Connects Hooks
-	 *
-	 * @return null
-	 */
-	public function addHooks() {
-		OCUtil::connectHook('OC_User', 'post_login', $this, 'login');
-		OCUtil::connectHook('OC_User', 'logout', $this, 'logout');
-
-		// this hooks only make sense if no master key is used
-		if ($this->util->isMasterKeyEnabled() === false) {
-			OCUtil::connectHook('OC_User',
-				'post_setPassword',
-				$this,
-				'setPassphrase');
-
-			OCUtil::connectHook('OC_User',
-				'pre_setPassword',
-				$this,
-				'preSetPassphrase');
-
-			OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
-				'post_passwordReset',
-				$this,
-				'postPasswordReset');
-
-			OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
-				'pre_passwordReset',
-				$this,
-				'prePasswordReset');
-
-			OCUtil::connectHook('OC_User',
-				'post_createUser',
-				$this,
-				'postCreateUser');
-
-			OCUtil::connectHook('OC_User',
-				'post_deleteUser',
-				$this,
-				'postDeleteUser');
-		}
-	}
-
-
-	/**
-	 * Startup encryption backend upon user login
-	 *
-	 * @note This method should never be called for users using client side encryption
-	 * @param array $params
-	 * @return boolean|null
-	 */
-	public function login($params) {
-
-		if (!App::isEnabled('encryption')) {
-			return true;
-		}
-
-		// ensure filesystem is loaded
-		if (!\OC\Files\Filesystem::$loaded) {
-			$this->setupFS($params['uid']);
-		}
-		if ($this->util->isMasterKeyEnabled() === false) {
-			$this->userSetup->setupUser($params['uid'], $params['password']);
-		}
-
-		$this->keyManager->init($params['uid'], $params['password']);
-	}
-
-	/**
-	 * remove keys from session during logout
-	 */
-	public function logout() {
-		$this->session->clear();
-	}
-
-	/**
-	 * setup encryption backend upon user created
-	 *
-	 * @note This method should never be called for users using client side encryption
-	 * @param array $params
-	 */
-	public function postCreateUser($params) {
-
-		if (App::isEnabled('encryption')) {
-			$this->userSetup->setupUser($params['uid'], $params['password']);
-		}
-	}
-
-	/**
-	 * cleanup encryption backend upon user deleted
-	 *
-	 * @param array $params : uid, password
-	 * @note This method should never be called for users using client side encryption
-	 */
-	public function postDeleteUser($params) {
-
-		if (App::isEnabled('encryption')) {
-			$this->keyManager->deletePublicKey($params['uid']);
-		}
-	}
-
-	public function prePasswordReset($params) {
-		if (App::isEnabled('encryption')) {
-			$user = $params['uid'];
-			self::$passwordResetUsers[$user] = true;
-		}
-	}
-
-	public function postPasswordReset($params) {
-		$uid = $params['uid'];
-		$password = $params['password'];
-		$this->keyManager->backupUserKeys('passwordReset', $uid);
-		$this->keyManager->deleteUserKeys($uid);
-		$this->userSetup->setupUser($uid, $password);
-		unset(self::$passwordResetUsers[$uid]);
-	}
-
-	/**
-	 * If the password can't be changed within Nextcloud, than update the key password in advance.
-	 *
-	 * @param array $params : uid, password
-	 * @return boolean|null
-	 */
-	public function preSetPassphrase($params) {
-		$user = $this->userManager->get($params['uid']);
-
-		if ($user && !$user->canChangePassword()) {
-			$this->setPassphrase($params);
-		}
-	}
-
-	/**
-	 * Change a user's encryption passphrase
-	 *
-	 * @param array $params keys: uid, password
-	 * @return boolean|null
-	 */
-	public function setPassphrase($params) {
-
-		// if we are in the process to resetting a user password, we have nothing
-		// to do here
-		if (isset(self::$passwordResetUsers[$params['uid']])) {
-			return true;
-		}
-
-		// Get existing decrypted private key
-		$privateKey = $this->session->getPrivateKey();
-		$user = $this->user->getUser();
-
-		// current logged in user changes his own password
-		if ($user && $params['uid'] === $user->getUID() && $privateKey) {
-
-			// Encrypt private key with new user pwd as passphrase
-			$encryptedPrivateKey = $this->crypt->encryptPrivateKey($privateKey, $params['password'], $params['uid']);
-
-			// Save private key
-			if ($encryptedPrivateKey) {
-				$this->keyManager->setPrivateKey($this->user->getUser()->getUID(),
-					$this->crypt->generateHeader() . $encryptedPrivateKey);
-			} else {
-				$this->logger->error('Encryption could not update users encryption password');
-			}
-
-			// NOTE: Session does not need to be updated as the
-			// private key has not changed, only the passphrase
-			// used to decrypt it has changed
-		} else { // admin changed the password for a different user, create new keys and re-encrypt file keys
-			$user = $params['uid'];
-			$this->initMountPoints($user);
-			$recoveryPassword = isset($params['recoveryPassword']) ? $params['recoveryPassword'] : null;
-
-			// we generate new keys if...
-			// ...we have a recovery password and the user enabled the recovery key
-			// ...encryption was activated for the first time (no keys exists)
-			// ...the user doesn't have any files
-			if (
-				($this->recovery->isRecoveryEnabledForUser($user) && $recoveryPassword)
-				|| !$this->keyManager->userHasKeys($user)
-				|| !$this->util->userHasFiles($user)
-			) {
-
-				// backup old keys
-				//$this->backupAllKeys('recovery');
-
-				$newUserPassword = $params['password'];
-
-				$keyPair = $this->crypt->createKeyPair();
-
-				// Save public key
-				$this->keyManager->setPublicKey($user, $keyPair['publicKey']);
-
-				// Encrypt private key with new password
-				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $user);
-
-				if ($encryptedKey) {
-					$this->keyManager->setPrivateKey($user, $this->crypt->generateHeader() . $encryptedKey);
-
-					if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files
-						$this->recovery->recoverUsersFiles($recoveryPassword, $user);
-					}
-				} else {
-					$this->logger->error('Encryption Could not update users encryption password');
-				}
-			}
-		}
-	}
-
-	/**
-	 * init mount points for given user
-	 *
-	 * @param string $user
-	 * @throws \OC\User\NoUserException
-	 */
-	protected function initMountPoints($user) {
-		Filesystem::initMountPoints($user);
-	}
-
-	/**
-	 * setup file system for user
-	 *
-	 * @param string $uid user id
-	 */
-	protected function setupFS($uid) {
-		\OC_Util::setupFS($uid);
-	}
+    /**
+     * list of user for which we perform a password reset
+     * @var array
+     */
+    protected static $passwordResetUsers = [];
+
+    /**
+     * @var KeyManager
+     */
+    private $keyManager;
+    /**
+     * @var IUserManager
+     */
+    private $userManager;
+    /**
+     * @var ILogger
+     */
+    private $logger;
+    /**
+     * @var Setup
+     */
+    private $userSetup;
+    /**
+     * @var IUserSession
+     */
+    private $user;
+    /**
+     * @var Util
+     */
+    private $util;
+    /**
+     * @var Session
+     */
+    private $session;
+    /**
+     * @var Recovery
+     */
+    private $recovery;
+    /**
+     * @var Crypt
+     */
+    private $crypt;
+
+    /**
+     * UserHooks constructor.
+     *
+     * @param KeyManager $keyManager
+     * @param IUserManager $userManager
+     * @param ILogger $logger
+     * @param Setup $userSetup
+     * @param IUserSession $user
+     * @param Util $util
+     * @param Session $session
+     * @param Crypt $crypt
+     * @param Recovery $recovery
+     */
+    public function __construct(KeyManager $keyManager,
+                                IUserManager $userManager,
+                                ILogger $logger,
+                                Setup $userSetup,
+                                IUserSession $user,
+                                Util $util,
+                                Session $session,
+                                Crypt $crypt,
+                                Recovery $recovery) {
+
+        $this->keyManager = $keyManager;
+        $this->userManager = $userManager;
+        $this->logger = $logger;
+        $this->userSetup = $userSetup;
+        $this->user = $user;
+        $this->util = $util;
+        $this->session = $session;
+        $this->recovery = $recovery;
+        $this->crypt = $crypt;
+    }
+
+    /**
+     * Connects Hooks
+     *
+     * @return null
+     */
+    public function addHooks() {
+        OCUtil::connectHook('OC_User', 'post_login', $this, 'login');
+        OCUtil::connectHook('OC_User', 'logout', $this, 'logout');
+
+        // this hooks only make sense if no master key is used
+        if ($this->util->isMasterKeyEnabled() === false) {
+            OCUtil::connectHook('OC_User',
+                'post_setPassword',
+                $this,
+                'setPassphrase');
+
+            OCUtil::connectHook('OC_User',
+                'pre_setPassword',
+                $this,
+                'preSetPassphrase');
+
+            OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
+                'post_passwordReset',
+                $this,
+                'postPasswordReset');
+
+            OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
+                'pre_passwordReset',
+                $this,
+                'prePasswordReset');
+
+            OCUtil::connectHook('OC_User',
+                'post_createUser',
+                $this,
+                'postCreateUser');
+
+            OCUtil::connectHook('OC_User',
+                'post_deleteUser',
+                $this,
+                'postDeleteUser');
+        }
+    }
+
+
+    /**
+     * Startup encryption backend upon user login
+     *
+     * @note This method should never be called for users using client side encryption
+     * @param array $params
+     * @return boolean|null
+     */
+    public function login($params) {
+
+        if (!App::isEnabled('encryption')) {
+            return true;
+        }
+
+        // ensure filesystem is loaded
+        if (!\OC\Files\Filesystem::$loaded) {
+            $this->setupFS($params['uid']);
+        }
+        if ($this->util->isMasterKeyEnabled() === false) {
+            $this->userSetup->setupUser($params['uid'], $params['password']);
+        }
+
+        $this->keyManager->init($params['uid'], $params['password']);
+    }
+
+    /**
+     * remove keys from session during logout
+     */
+    public function logout() {
+        $this->session->clear();
+    }
+
+    /**
+     * setup encryption backend upon user created
+     *
+     * @note This method should never be called for users using client side encryption
+     * @param array $params
+     */
+    public function postCreateUser($params) {
+
+        if (App::isEnabled('encryption')) {
+            $this->userSetup->setupUser($params['uid'], $params['password']);
+        }
+    }
+
+    /**
+     * cleanup encryption backend upon user deleted
+     *
+     * @param array $params : uid, password
+     * @note This method should never be called for users using client side encryption
+     */
+    public function postDeleteUser($params) {
+
+        if (App::isEnabled('encryption')) {
+            $this->keyManager->deletePublicKey($params['uid']);
+        }
+    }
+
+    public function prePasswordReset($params) {
+        if (App::isEnabled('encryption')) {
+            $user = $params['uid'];
+            self::$passwordResetUsers[$user] = true;
+        }
+    }
+
+    public function postPasswordReset($params) {
+        $uid = $params['uid'];
+        $password = $params['password'];
+        $this->keyManager->backupUserKeys('passwordReset', $uid);
+        $this->keyManager->deleteUserKeys($uid);
+        $this->userSetup->setupUser($uid, $password);
+        unset(self::$passwordResetUsers[$uid]);
+    }
+
+    /**
+     * If the password can't be changed within Nextcloud, than update the key password in advance.
+     *
+     * @param array $params : uid, password
+     * @return boolean|null
+     */
+    public function preSetPassphrase($params) {
+        $user = $this->userManager->get($params['uid']);
+
+        if ($user && !$user->canChangePassword()) {
+            $this->setPassphrase($params);
+        }
+    }
+
+    /**
+     * Change a user's encryption passphrase
+     *
+     * @param array $params keys: uid, password
+     * @return boolean|null
+     */
+    public function setPassphrase($params) {
+
+        // if we are in the process to resetting a user password, we have nothing
+        // to do here
+        if (isset(self::$passwordResetUsers[$params['uid']])) {
+            return true;
+        }
+
+        // Get existing decrypted private key
+        $privateKey = $this->session->getPrivateKey();
+        $user = $this->user->getUser();
+
+        // current logged in user changes his own password
+        if ($user && $params['uid'] === $user->getUID() && $privateKey) {
+
+            // Encrypt private key with new user pwd as passphrase
+            $encryptedPrivateKey = $this->crypt->encryptPrivateKey($privateKey, $params['password'], $params['uid']);
+
+            // Save private key
+            if ($encryptedPrivateKey) {
+                $this->keyManager->setPrivateKey($this->user->getUser()->getUID(),
+                    $this->crypt->generateHeader() . $encryptedPrivateKey);
+            } else {
+                $this->logger->error('Encryption could not update users encryption password');
+            }
+
+            // NOTE: Session does not need to be updated as the
+            // private key has not changed, only the passphrase
+            // used to decrypt it has changed
+        } else { // admin changed the password for a different user, create new keys and re-encrypt file keys
+            $user = $params['uid'];
+            $this->initMountPoints($user);
+            $recoveryPassword = isset($params['recoveryPassword']) ? $params['recoveryPassword'] : null;
+
+            // we generate new keys if...
+            // ...we have a recovery password and the user enabled the recovery key
+            // ...encryption was activated for the first time (no keys exists)
+            // ...the user doesn't have any files
+            if (
+                ($this->recovery->isRecoveryEnabledForUser($user) && $recoveryPassword)
+                || !$this->keyManager->userHasKeys($user)
+                || !$this->util->userHasFiles($user)
+            ) {
+
+                // backup old keys
+                //$this->backupAllKeys('recovery');
+
+                $newUserPassword = $params['password'];
+
+                $keyPair = $this->crypt->createKeyPair();
+
+                // Save public key
+                $this->keyManager->setPublicKey($user, $keyPair['publicKey']);
+
+                // Encrypt private key with new password
+                $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $user);
+
+                if ($encryptedKey) {
+                    $this->keyManager->setPrivateKey($user, $this->crypt->generateHeader() . $encryptedKey);
+
+                    if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files
+                        $this->recovery->recoverUsersFiles($recoveryPassword, $user);
+                    }
+                } else {
+                    $this->logger->error('Encryption Could not update users encryption password');
+                }
+            }
+        }
+    }
+
+    /**
+     * init mount points for given user
+     *
+     * @param string $user
+     * @throws \OC\User\NoUserException
+     */
+    protected function initMountPoints($user) {
+        Filesystem::initMountPoints($user);
+    }
+
+    /**
+     * setup file system for user
+     *
+     * @param string $uid user id
+     */
+    protected function setupFS($uid) {
+        \OC_Util::setupFS($uid);
+    }
 }

apps/encryption/lib/KeyManager.php

Indentation +672 added lines, -672 removed lines

@@ -38,676 +38,676 @@
 
 class KeyManager {
 
-	/**
-	 * @var Session
-	 */
-	protected $session;
-	/**
-	 * @var IStorage
-	 */
-	private $keyStorage;
-	/**
-	 * @var Crypt
-	 */
-	private $crypt;
-	/**
-	 * @var string
-	 */
-	private $recoveryKeyId;
-	/**
-	 * @var string
-	 */
-	private $publicShareKeyId;
-	/**
-	 * @var string
-	 */
-	private $masterKeyId;
-	/**
-	 * @var string UserID
-	 */
-	private $keyId;
-	/**
-	 * @var string
-	 */
-	private $publicKeyId = 'publicKey';
-	/**
-	 * @var string
-	 */
-	private $privateKeyId = 'privateKey';
-
-	/**
-	 * @var string
-	 */
-	private $shareKeyId = 'shareKey';
-
-	/**
-	 * @var string
-	 */
-	private $fileKeyId = 'fileKey';
-	/**
-	 * @var IConfig
-	 */
-	private $config;
-	/**
-	 * @var ILogger
-	 */
-	private $log;
-	/**
-	 * @var Util
-	 */
-	private $util;
-
-	/**
-	 * @param IStorage $keyStorage
-	 * @param Crypt $crypt
-	 * @param IConfig $config
-	 * @param IUserSession $userSession
-	 * @param Session $session
-	 * @param ILogger $log
-	 * @param Util $util
-	 */
-	public function __construct(
-		IStorage $keyStorage,
-		Crypt $crypt,
-		IConfig $config,
-		IUserSession $userSession,
-		Session $session,
-		ILogger $log,
-		Util $util
-	) {
-
-		$this->util = $util;
-		$this->session = $session;
-		$this->keyStorage = $keyStorage;
-		$this->crypt = $crypt;
-		$this->config = $config;
-		$this->log = $log;
-
-		$this->recoveryKeyId = $this->config->getAppValue('encryption',
-			'recoveryKeyId');
-		if (empty($this->recoveryKeyId)) {
-			$this->recoveryKeyId = 'recoveryKey_' . substr(md5(time()), 0, 8);
-			$this->config->setAppValue('encryption',
-				'recoveryKeyId',
-				$this->recoveryKeyId);
-		}
-
-		$this->publicShareKeyId = $this->config->getAppValue('encryption',
-			'publicShareKeyId');
-		if (empty($this->publicShareKeyId)) {
-			$this->publicShareKeyId = 'pubShare_' . substr(md5(time()), 0, 8);
-			$this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
-		}
-
-		$this->masterKeyId = $this->config->getAppValue('encryption',
-			'masterKeyId');
-		if (empty($this->masterKeyId)) {
-			$this->masterKeyId = 'master_' . substr(md5(time()), 0, 8);
-			$this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
-		}
-
-		$this->keyId = $userSession && $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : false;
-		$this->log = $log;
-	}
-
-	/**
-	 * check if key pair for public link shares exists, if not we create one
-	 */
-	public function validateShareKey() {
-		$shareKey = $this->getPublicShareKey();
-		if (empty($shareKey)) {
-			$keyPair = $this->crypt->createKeyPair();
-
-			// Save public key
-			$this->keyStorage->setSystemUserKey(
-				$this->publicShareKeyId . '.publicKey', $keyPair['publicKey'],
-				Encryption::ID);
-
-			// Encrypt private key empty passphrase
-			$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
-			$header = $this->crypt->generateHeader();
-			$this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
-		}
-	}
-
-	/**
-	 * check if a key pair for the master key exists, if not we create one
-	 */
-	public function validateMasterKey() {
-
-		if ($this->util->isMasterKeyEnabled() === false) {
-			return;
-		}
-
-		$masterKey = $this->getPublicMasterKey();
-		if (empty($masterKey)) {
-			$keyPair = $this->crypt->createKeyPair();
-
-			// Save public key
-			$this->keyStorage->setSystemUserKey(
-				$this->masterKeyId . '.publicKey', $keyPair['publicKey'],
-				Encryption::ID);
-
-			// Encrypt private key with system password
-			$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
-			$header = $this->crypt->generateHeader();
-			$this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
-		}
-	}
-
-	/**
-	 * @return bool
-	 */
-	public function recoveryKeyExists() {
-		$key = $this->getRecoveryKey();
-		return (!empty($key));
-	}
-
-	/**
-	 * get recovery key
-	 *
-	 * @return string
-	 */
-	public function getRecoveryKey() {
-		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.publicKey', Encryption::ID);
-	}
-
-	/**
-	 * get recovery key ID
-	 *
-	 * @return string
-	 */
-	public function getRecoveryKeyId() {
-		return $this->recoveryKeyId;
-	}
-
-	/**
-	 * @param string $password
-	 * @return bool
-	 */
-	public function checkRecoveryPassword($password) {
-		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.privateKey', Encryption::ID);
-		$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
-
-		if ($decryptedRecoveryKey) {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param string $uid
-	 * @param string $password
-	 * @param string $keyPair
-	 * @return bool
-	 */
-	public function storeKeyPair($uid, $password, $keyPair) {
-		// Save Public Key
-		$this->setPublicKey($uid, $keyPair['publicKey']);
-
-		$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password, $uid);
-
-		$header = $this->crypt->generateHeader();
-
-		if ($encryptedKey) {
-			$this->setPrivateKey($uid, $header . $encryptedKey);
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param string $password
-	 * @param array $keyPair
-	 * @return bool
-	 */
-	public function setRecoveryKey($password, $keyPair) {
-		// Save Public Key
-		$this->keyStorage->setSystemUserKey($this->getRecoveryKeyId().
-			'.publicKey',
-			$keyPair['publicKey'],
-			Encryption::ID);
-
-		$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password);
-		$header = $this->crypt->generateHeader();
-
-		if ($encryptedKey) {
-			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * @param $userId
-	 * @param $key
-	 * @return bool
-	 */
-	public function setPublicKey($userId, $key) {
-		return $this->keyStorage->setUserKey($userId, $this->publicKeyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * @param $userId
-	 * @param string $key
-	 * @return bool
-	 */
-	public function setPrivateKey($userId, $key) {
-		return $this->keyStorage->setUserKey($userId,
-			$this->privateKeyId,
-			$key,
-			Encryption::ID);
-	}
-
-	/**
-	 * write file key to key storage
-	 *
-	 * @param string $path
-	 * @param string $key
-	 * @return boolean
-	 */
-	public function setFileKey($path, $key) {
-		return $this->keyStorage->setFileKey($path, $this->fileKeyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * set all file keys (the file key and the corresponding share keys)
-	 *
-	 * @param string $path
-	 * @param array $keys
-	 */
-	public function setAllFileKeys($path, $keys) {
-		$this->setFileKey($path, $keys['data']);
-		foreach ($keys['keys'] as $uid => $keyFile) {
-			$this->setShareKey($path, $uid, $keyFile);
-		}
-	}
-
-	/**
-	 * write share key to the key storage
-	 *
-	 * @param string $path
-	 * @param string $uid
-	 * @param string $key
-	 * @return boolean
-	 */
-	public function setShareKey($path, $uid, $key) {
-		$keyId = $uid . '.' . $this->shareKeyId;
-		return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
-	}
-
-	/**
-	 * Decrypt private key and store it
-	 *
-	 * @param string $uid user id
-	 * @param string $passPhrase users password
-	 * @return boolean
-	 */
-	public function init($uid, $passPhrase) {
-
-		$this->session->setStatus(Session::INIT_EXECUTED);
-
-		try {
-			if($this->util->isMasterKeyEnabled()) {
-				$uid = $this->getMasterKeyId();
-				$passPhrase = $this->getMasterKeyPassword();
-				$privateKey = $this->getSystemPrivateKey($uid);
-			} else {
-				$privateKey = $this->getPrivateKey($uid);
-			}
-			$privateKey = $this->crypt->decryptPrivateKey($privateKey, $passPhrase, $uid);
-		} catch (PrivateKeyMissingException $e) {
-			return false;
-		} catch (DecryptionFailedException $e) {
-			return false;
-		} catch (\Exception $e) {
-			$this->log->warning(
-				'Could not decrypt the private key from user "' . $uid . '"" during login. ' .
-				'Assume password change on the user back-end. Error message: '
-				. $e->getMessage()
-			);
-			return false;
-		}
-
-		if ($privateKey) {
-			$this->session->setPrivateKey($privateKey);
-			$this->session->setStatus(Session::INIT_SUCCESSFUL);
-			return true;
-		}
-
-		return false;
-	}
-
-	/**
-	 * @param $userId
-	 * @return string
-	 * @throws PrivateKeyMissingException
-	 */
-	public function getPrivateKey($userId) {
-		$privateKey = $this->keyStorage->getUserKey($userId,
-			$this->privateKeyId, Encryption::ID);
-
-		if (strlen($privateKey) !== 0) {
-			return $privateKey;
-		}
-		throw new PrivateKeyMissingException($userId);
-	}
-
-	/**
-	 * @param string $path
-	 * @param $uid
-	 * @return string
-	 */
-	public function getFileKey($path, $uid) {
-		if ($uid === '') {
-			$uid = null;
-		}
-		$publicAccess = is_null($uid);
-		$encryptedFileKey = $this->keyStorage->getFileKey($path, $this->fileKeyId, Encryption::ID);
-
-		if (empty($encryptedFileKey)) {
-			return '';
-		}
-
-		if ($this->util->isMasterKeyEnabled()) {
-			$uid = $this->getMasterKeyId();
-			$shareKey = $this->getShareKey($path, $uid);
-			if ($publicAccess) {
-				$privateKey = $this->getSystemPrivateKey($uid);
-				$privateKey = $this->crypt->decryptPrivateKey($privateKey, $this->getMasterKeyPassword(), $uid);
-			} else {
-				// when logged in, the master key is already decrypted in the session
-				$privateKey = $this->session->getPrivateKey();
-			}
-		} else if ($publicAccess) {
-			// use public share key for public links
-			$uid = $this->getPublicShareKeyId();
-			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.privateKey', Encryption::ID);
-			$privateKey = $this->crypt->decryptPrivateKey($privateKey);
-		} else {
-			$shareKey = $this->getShareKey($path, $uid);
-			$privateKey = $this->session->getPrivateKey();
-		}
-
-		if ($encryptedFileKey && $shareKey && $privateKey) {
-			return $this->crypt->multiKeyDecrypt($encryptedFileKey,
-				$shareKey,
-				$privateKey);
-		}
-
-		return '';
-	}
-
-	/**
-	 * Get the current version of a file
-	 *
-	 * @param string $path
-	 * @param View $view
-	 * @return int
-	 */
-	public function getVersion($path, View $view) {
-		$fileInfo = $view->getFileInfo($path);
-		if($fileInfo === false) {
-			return 0;
-		}
-		return $fileInfo->getEncryptedVersion();
-	}
-
-	/**
-	 * Set the current version of a file
-	 *
-	 * @param string $path
-	 * @param int $version
-	 * @param View $view
-	 */
-	public function setVersion($path, $version, View $view) {
-		$fileInfo= $view->getFileInfo($path);
-
-		if($fileInfo !== false) {
-			$cache = $fileInfo->getStorage()->getCache();
-			$cache->update($fileInfo->getId(), ['encrypted' => $version, 'encryptedVersion' => $version]);
-		}
-	}
-
-	/**
-	 * get the encrypted file key
-	 *
-	 * @param string $path
-	 * @return string
-	 */
-	public function getEncryptedFileKey($path) {
-		$encryptedFileKey = $this->keyStorage->getFileKey($path,
-			$this->fileKeyId, Encryption::ID);
-
-		return $encryptedFileKey;
-	}
-
-	/**
-	 * delete share key
-	 *
-	 * @param string $path
-	 * @param string $keyId
-	 * @return boolean
-	 */
-	public function deleteShareKey($path, $keyId) {
-		return $this->keyStorage->deleteFileKey(
-			$path,
-			$keyId . '.' . $this->shareKeyId,
-			Encryption::ID);
-	}
-
-
-	/**
-	 * @param $path
-	 * @param $uid
-	 * @return mixed
-	 */
-	public function getShareKey($path, $uid) {
-		$keyId = $uid . '.' . $this->shareKeyId;
-		return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
-	}
-
-	/**
-	 * check if user has a private and a public key
-	 *
-	 * @param string $userId
-	 * @return bool
-	 * @throws PrivateKeyMissingException
-	 * @throws PublicKeyMissingException
-	 */
-	public function userHasKeys($userId) {
-		$privateKey = $publicKey = true;
-		$exception = null;
-
-		try {
-			$this->getPrivateKey($userId);
-		} catch (PrivateKeyMissingException $e) {
-			$privateKey = false;
-			$exception = $e;
-		}
-		try {
-			$this->getPublicKey($userId);
-		} catch (PublicKeyMissingException $e) {
-			$publicKey = false;
-			$exception = $e;
-		}
-
-		if ($privateKey && $publicKey) {
-			return true;
-		} elseif (!$privateKey && !$publicKey) {
-			return false;
-		} else {
-			throw $exception;
-		}
-	}
-
-	/**
-	 * @param $userId
-	 * @return mixed
-	 * @throws PublicKeyMissingException
-	 */
-	public function getPublicKey($userId) {
-		$publicKey = $this->keyStorage->getUserKey($userId, $this->publicKeyId, Encryption::ID);
-
-		if (strlen($publicKey) !== 0) {
-			return $publicKey;
-		}
-		throw new PublicKeyMissingException($userId);
-	}
-
-	public function getPublicShareKeyId() {
-		return $this->publicShareKeyId;
-	}
-
-	/**
-	 * get public key for public link shares
-	 *
-	 * @return string
-	 */
-	public function getPublicShareKey() {
-		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.publicKey', Encryption::ID);
-	}
-
-	/**
-	 * @param string $purpose
-	 * @param string $uid
-	 */
-	public function backupUserKeys($purpose, $uid) {
-		$this->keyStorage->backupUserKeys(Encryption::ID, $purpose, $uid);
-	}
-
-	/**
-	 * creat a backup of the users private and public key and then  delete it
-	 *
-	 * @param string $uid
-	 */
-	public function deleteUserKeys($uid) {
-		$this->deletePublicKey($uid);
-		$this->deletePrivateKey($uid);
-	}
-
-	/**
-	 * @param $uid
-	 * @return bool
-	 */
-	public function deletePublicKey($uid) {
-		return $this->keyStorage->deleteUserKey($uid, $this->publicKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $uid
-	 * @return bool
-	 */
-	private function deletePrivateKey($uid) {
-		return $this->keyStorage->deleteUserKey($uid, $this->privateKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $path
-	 * @return bool
-	 */
-	public function deleteAllFileKeys($path) {
-		return $this->keyStorage->deleteAllFileKeys($path);
-	}
-
-	/**
-	 * @param array $userIds
-	 * @return array
-	 * @throws PublicKeyMissingException
-	 */
-	public function getPublicKeys(array $userIds) {
-		$keys = [];
-
-		foreach ($userIds as $userId) {
-			try {
-				$keys[$userId] = $this->getPublicKey($userId);
-			} catch (PublicKeyMissingException $e) {
-				continue;
-			}
-		}
-
-		return $keys;
-
-	}
-
-	/**
-	 * @param string $keyId
-	 * @return string returns openssl key
-	 */
-	public function getSystemPrivateKey($keyId) {
-		return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
-	}
-
-	/**
-	 * @param string $keyId
-	 * @param string $key
-	 * @return string returns openssl key
-	 */
-	public function setSystemPrivateKey($keyId, $key) {
-		return $this->keyStorage->setSystemUserKey(
-			$keyId . '.' . $this->privateKeyId,
-			$key,
-			Encryption::ID);
-	}
-
-	/**
-	 * add system keys such as the public share key and the recovery key
-	 *
-	 * @param array $accessList
-	 * @param array $publicKeys
-	 * @param string $uid
-	 * @return array
-	 * @throws PublicKeyMissingException
-	 */
-	public function addSystemKeys(array $accessList, array $publicKeys, $uid) {
-		if (!empty($accessList['public'])) {
-			$publicShareKey = $this->getPublicShareKey();
-			if (empty($publicShareKey)) {
-				throw new PublicKeyMissingException($this->getPublicShareKeyId());
-			}
-			$publicKeys[$this->getPublicShareKeyId()] = $publicShareKey;
-		}
-
-		if ($this->recoveryKeyExists() &&
-			$this->util->isRecoveryEnabledForUser($uid)) {
-
-			$publicKeys[$this->getRecoveryKeyId()] = $this->getRecoveryKey();
-		}
-
-		return $publicKeys;
-	}
-
-	/**
-	 * get master key password
-	 *
-	 * @return string
-	 * @throws \Exception
-	 */
-	public function getMasterKeyPassword() {
-		$password = $this->config->getSystemValue('secret');
-		if (empty($password)){
-			throw new \Exception('Can not get secret from Nextcloud instance');
-		}
-
-		return $password;
-	}
-
-	/**
-	 * return master key id
-	 *
-	 * @return string
-	 */
-	public function getMasterKeyId() {
-		return $this->masterKeyId;
-	}
-
-	/**
-	 * get public master key
-	 *
-	 * @return string
-	 */
-	public function getPublicMasterKey() {
-		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.publicKey', Encryption::ID);
-	}
+    /**
+     * @var Session
+     */
+    protected $session;
+    /**
+     * @var IStorage
+     */
+    private $keyStorage;
+    /**
+     * @var Crypt
+     */
+    private $crypt;
+    /**
+     * @var string
+     */
+    private $recoveryKeyId;
+    /**
+     * @var string
+     */
+    private $publicShareKeyId;
+    /**
+     * @var string
+     */
+    private $masterKeyId;
+    /**
+     * @var string UserID
+     */
+    private $keyId;
+    /**
+     * @var string
+     */
+    private $publicKeyId = 'publicKey';
+    /**
+     * @var string
+     */
+    private $privateKeyId = 'privateKey';
+
+    /**
+     * @var string
+     */
+    private $shareKeyId = 'shareKey';
+
+    /**
+     * @var string
+     */
+    private $fileKeyId = 'fileKey';
+    /**
+     * @var IConfig
+     */
+    private $config;
+    /**
+     * @var ILogger
+     */
+    private $log;
+    /**
+     * @var Util
+     */
+    private $util;
+
+    /**
+     * @param IStorage $keyStorage
+     * @param Crypt $crypt
+     * @param IConfig $config
+     * @param IUserSession $userSession
+     * @param Session $session
+     * @param ILogger $log
+     * @param Util $util
+     */
+    public function __construct(
+        IStorage $keyStorage,
+        Crypt $crypt,
+        IConfig $config,
+        IUserSession $userSession,
+        Session $session,
+        ILogger $log,
+        Util $util
+    ) {
+
+        $this->util = $util;
+        $this->session = $session;
+        $this->keyStorage = $keyStorage;
+        $this->crypt = $crypt;
+        $this->config = $config;
+        $this->log = $log;
+
+        $this->recoveryKeyId = $this->config->getAppValue('encryption',
+            'recoveryKeyId');
+        if (empty($this->recoveryKeyId)) {
+            $this->recoveryKeyId = 'recoveryKey_' . substr(md5(time()), 0, 8);
+            $this->config->setAppValue('encryption',
+                'recoveryKeyId',
+                $this->recoveryKeyId);
+        }
+
+        $this->publicShareKeyId = $this->config->getAppValue('encryption',
+            'publicShareKeyId');
+        if (empty($this->publicShareKeyId)) {
+            $this->publicShareKeyId = 'pubShare_' . substr(md5(time()), 0, 8);
+            $this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
+        }
+
+        $this->masterKeyId = $this->config->getAppValue('encryption',
+            'masterKeyId');
+        if (empty($this->masterKeyId)) {
+            $this->masterKeyId = 'master_' . substr(md5(time()), 0, 8);
+            $this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
+        }
+
+        $this->keyId = $userSession && $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : false;
+        $this->log = $log;
+    }
+
+    /**
+     * check if key pair for public link shares exists, if not we create one
+     */
+    public function validateShareKey() {
+        $shareKey = $this->getPublicShareKey();
+        if (empty($shareKey)) {
+            $keyPair = $this->crypt->createKeyPair();
+
+            // Save public key
+            $this->keyStorage->setSystemUserKey(
+                $this->publicShareKeyId . '.publicKey', $keyPair['publicKey'],
+                Encryption::ID);
+
+            // Encrypt private key empty passphrase
+            $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
+            $header = $this->crypt->generateHeader();
+            $this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
+        }
+    }
+
+    /**
+     * check if a key pair for the master key exists, if not we create one
+     */
+    public function validateMasterKey() {
+
+        if ($this->util->isMasterKeyEnabled() === false) {
+            return;
+        }
+
+        $masterKey = $this->getPublicMasterKey();
+        if (empty($masterKey)) {
+            $keyPair = $this->crypt->createKeyPair();
+
+            // Save public key
+            $this->keyStorage->setSystemUserKey(
+                $this->masterKeyId . '.publicKey', $keyPair['publicKey'],
+                Encryption::ID);
+
+            // Encrypt private key with system password
+            $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
+            $header = $this->crypt->generateHeader();
+            $this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
+        }
+    }
+
+    /**
+     * @return bool
+     */
+    public function recoveryKeyExists() {
+        $key = $this->getRecoveryKey();
+        return (!empty($key));
+    }
+
+    /**
+     * get recovery key
+     *
+     * @return string
+     */
+    public function getRecoveryKey() {
+        return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.publicKey', Encryption::ID);
+    }
+
+    /**
+     * get recovery key ID
+     *
+     * @return string
+     */
+    public function getRecoveryKeyId() {
+        return $this->recoveryKeyId;
+    }
+
+    /**
+     * @param string $password
+     * @return bool
+     */
+    public function checkRecoveryPassword($password) {
+        $recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.privateKey', Encryption::ID);
+        $decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
+
+        if ($decryptedRecoveryKey) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param string $uid
+     * @param string $password
+     * @param string $keyPair
+     * @return bool
+     */
+    public function storeKeyPair($uid, $password, $keyPair) {
+        // Save Public Key
+        $this->setPublicKey($uid, $keyPair['publicKey']);
+
+        $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password, $uid);
+
+        $header = $this->crypt->generateHeader();
+
+        if ($encryptedKey) {
+            $this->setPrivateKey($uid, $header . $encryptedKey);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param string $password
+     * @param array $keyPair
+     * @return bool
+     */
+    public function setRecoveryKey($password, $keyPair) {
+        // Save Public Key
+        $this->keyStorage->setSystemUserKey($this->getRecoveryKeyId().
+            '.publicKey',
+            $keyPair['publicKey'],
+            Encryption::ID);
+
+        $encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password);
+        $header = $this->crypt->generateHeader();
+
+        if ($encryptedKey) {
+            $this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param $userId
+     * @param $key
+     * @return bool
+     */
+    public function setPublicKey($userId, $key) {
+        return $this->keyStorage->setUserKey($userId, $this->publicKeyId, $key, Encryption::ID);
+    }
+
+    /**
+     * @param $userId
+     * @param string $key
+     * @return bool
+     */
+    public function setPrivateKey($userId, $key) {
+        return $this->keyStorage->setUserKey($userId,
+            $this->privateKeyId,
+            $key,
+            Encryption::ID);
+    }
+
+    /**
+     * write file key to key storage
+     *
+     * @param string $path
+     * @param string $key
+     * @return boolean
+     */
+    public function setFileKey($path, $key) {
+        return $this->keyStorage->setFileKey($path, $this->fileKeyId, $key, Encryption::ID);
+    }
+
+    /**
+     * set all file keys (the file key and the corresponding share keys)
+     *
+     * @param string $path
+     * @param array $keys
+     */
+    public function setAllFileKeys($path, $keys) {
+        $this->setFileKey($path, $keys['data']);
+        foreach ($keys['keys'] as $uid => $keyFile) {
+            $this->setShareKey($path, $uid, $keyFile);
+        }
+    }
+
+    /**
+     * write share key to the key storage
+     *
+     * @param string $path
+     * @param string $uid
+     * @param string $key
+     * @return boolean
+     */
+    public function setShareKey($path, $uid, $key) {
+        $keyId = $uid . '.' . $this->shareKeyId;
+        return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
+    }
+
+    /**
+     * Decrypt private key and store it
+     *
+     * @param string $uid user id
+     * @param string $passPhrase users password
+     * @return boolean
+     */
+    public function init($uid, $passPhrase) {
+
+        $this->session->setStatus(Session::INIT_EXECUTED);
+
+        try {
+            if($this->util->isMasterKeyEnabled()) {
+                $uid = $this->getMasterKeyId();
+                $passPhrase = $this->getMasterKeyPassword();
+                $privateKey = $this->getSystemPrivateKey($uid);
+            } else {
+                $privateKey = $this->getPrivateKey($uid);
+            }
+            $privateKey = $this->crypt->decryptPrivateKey($privateKey, $passPhrase, $uid);
+        } catch (PrivateKeyMissingException $e) {
+            return false;
+        } catch (DecryptionFailedException $e) {
+            return false;
+        } catch (\Exception $e) {
+            $this->log->warning(
+                'Could not decrypt the private key from user "' . $uid . '"" during login. ' .
+                'Assume password change on the user back-end. Error message: '
+                . $e->getMessage()
+            );
+            return false;
+        }
+
+        if ($privateKey) {
+            $this->session->setPrivateKey($privateKey);
+            $this->session->setStatus(Session::INIT_SUCCESSFUL);
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * @param $userId
+     * @return string
+     * @throws PrivateKeyMissingException
+     */
+    public function getPrivateKey($userId) {
+        $privateKey = $this->keyStorage->getUserKey($userId,
+            $this->privateKeyId, Encryption::ID);
+
+        if (strlen($privateKey) !== 0) {
+            return $privateKey;
+        }
+        throw new PrivateKeyMissingException($userId);
+    }
+
+    /**
+     * @param string $path
+     * @param $uid
+     * @return string
+     */
+    public function getFileKey($path, $uid) {
+        if ($uid === '') {
+            $uid = null;
+        }
+        $publicAccess = is_null($uid);
+        $encryptedFileKey = $this->keyStorage->getFileKey($path, $this->fileKeyId, Encryption::ID);
+
+        if (empty($encryptedFileKey)) {
+            return '';
+        }
+
+        if ($this->util->isMasterKeyEnabled()) {
+            $uid = $this->getMasterKeyId();
+            $shareKey = $this->getShareKey($path, $uid);
+            if ($publicAccess) {
+                $privateKey = $this->getSystemPrivateKey($uid);
+                $privateKey = $this->crypt->decryptPrivateKey($privateKey, $this->getMasterKeyPassword(), $uid);
+            } else {
+                // when logged in, the master key is already decrypted in the session
+                $privateKey = $this->session->getPrivateKey();
+            }
+        } else if ($publicAccess) {
+            // use public share key for public links
+            $uid = $this->getPublicShareKeyId();
+            $shareKey = $this->getShareKey($path, $uid);
+            $privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.privateKey', Encryption::ID);
+            $privateKey = $this->crypt->decryptPrivateKey($privateKey);
+        } else {
+            $shareKey = $this->getShareKey($path, $uid);
+            $privateKey = $this->session->getPrivateKey();
+        }
+
+        if ($encryptedFileKey && $shareKey && $privateKey) {
+            return $this->crypt->multiKeyDecrypt($encryptedFileKey,
+                $shareKey,
+                $privateKey);
+        }
+
+        return '';
+    }
+
+    /**
+     * Get the current version of a file
+     *
+     * @param string $path
+     * @param View $view
+     * @return int
+     */
+    public function getVersion($path, View $view) {
+        $fileInfo = $view->getFileInfo($path);
+        if($fileInfo === false) {
+            return 0;
+        }
+        return $fileInfo->getEncryptedVersion();
+    }
+
+    /**
+     * Set the current version of a file
+     *
+     * @param string $path
+     * @param int $version
+     * @param View $view
+     */
+    public function setVersion($path, $version, View $view) {
+        $fileInfo= $view->getFileInfo($path);
+
+        if($fileInfo !== false) {
+            $cache = $fileInfo->getStorage()->getCache();
+            $cache->update($fileInfo->getId(), ['encrypted' => $version, 'encryptedVersion' => $version]);
+        }
+    }
+
+    /**
+     * get the encrypted file key
+     *
+     * @param string $path
+     * @return string
+     */
+    public function getEncryptedFileKey($path) {
+        $encryptedFileKey = $this->keyStorage->getFileKey($path,
+            $this->fileKeyId, Encryption::ID);
+
+        return $encryptedFileKey;
+    }
+
+    /**
+     * delete share key
+     *
+     * @param string $path
+     * @param string $keyId
+     * @return boolean
+     */
+    public function deleteShareKey($path, $keyId) {
+        return $this->keyStorage->deleteFileKey(
+            $path,
+            $keyId . '.' . $this->shareKeyId,
+            Encryption::ID);
+    }
+
+
+    /**
+     * @param $path
+     * @param $uid
+     * @return mixed
+     */
+    public function getShareKey($path, $uid) {
+        $keyId = $uid . '.' . $this->shareKeyId;
+        return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
+    }
+
+    /**
+     * check if user has a private and a public key
+     *
+     * @param string $userId
+     * @return bool
+     * @throws PrivateKeyMissingException
+     * @throws PublicKeyMissingException
+     */
+    public function userHasKeys($userId) {
+        $privateKey = $publicKey = true;
+        $exception = null;
+
+        try {
+            $this->getPrivateKey($userId);
+        } catch (PrivateKeyMissingException $e) {
+            $privateKey = false;
+            $exception = $e;
+        }
+        try {
+            $this->getPublicKey($userId);
+        } catch (PublicKeyMissingException $e) {
+            $publicKey = false;
+            $exception = $e;
+        }
+
+        if ($privateKey && $publicKey) {
+            return true;
+        } elseif (!$privateKey && !$publicKey) {
+            return false;
+        } else {
+            throw $exception;
+        }
+    }
+
+    /**
+     * @param $userId
+     * @return mixed
+     * @throws PublicKeyMissingException
+     */
+    public function getPublicKey($userId) {
+        $publicKey = $this->keyStorage->getUserKey($userId, $this->publicKeyId, Encryption::ID);
+
+        if (strlen($publicKey) !== 0) {
+            return $publicKey;
+        }
+        throw new PublicKeyMissingException($userId);
+    }
+
+    public function getPublicShareKeyId() {
+        return $this->publicShareKeyId;
+    }
+
+    /**
+     * get public key for public link shares
+     *
+     * @return string
+     */
+    public function getPublicShareKey() {
+        return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.publicKey', Encryption::ID);
+    }
+
+    /**
+     * @param string $purpose
+     * @param string $uid
+     */
+    public function backupUserKeys($purpose, $uid) {
+        $this->keyStorage->backupUserKeys(Encryption::ID, $purpose, $uid);
+    }
+
+    /**
+     * creat a backup of the users private and public key and then  delete it
+     *
+     * @param string $uid
+     */
+    public function deleteUserKeys($uid) {
+        $this->deletePublicKey($uid);
+        $this->deletePrivateKey($uid);
+    }
+
+    /**
+     * @param $uid
+     * @return bool
+     */
+    public function deletePublicKey($uid) {
+        return $this->keyStorage->deleteUserKey($uid, $this->publicKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $uid
+     * @return bool
+     */
+    private function deletePrivateKey($uid) {
+        return $this->keyStorage->deleteUserKey($uid, $this->privateKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $path
+     * @return bool
+     */
+    public function deleteAllFileKeys($path) {
+        return $this->keyStorage->deleteAllFileKeys($path);
+    }
+
+    /**
+     * @param array $userIds
+     * @return array
+     * @throws PublicKeyMissingException
+     */
+    public function getPublicKeys(array $userIds) {
+        $keys = [];
+
+        foreach ($userIds as $userId) {
+            try {
+                $keys[$userId] = $this->getPublicKey($userId);
+            } catch (PublicKeyMissingException $e) {
+                continue;
+            }
+        }
+
+        return $keys;
+
+    }
+
+    /**
+     * @param string $keyId
+     * @return string returns openssl key
+     */
+    public function getSystemPrivateKey($keyId) {
+        return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
+    }
+
+    /**
+     * @param string $keyId
+     * @param string $key
+     * @return string returns openssl key
+     */
+    public function setSystemPrivateKey($keyId, $key) {
+        return $this->keyStorage->setSystemUserKey(
+            $keyId . '.' . $this->privateKeyId,
+            $key,
+            Encryption::ID);
+    }
+
+    /**
+     * add system keys such as the public share key and the recovery key
+     *
+     * @param array $accessList
+     * @param array $publicKeys
+     * @param string $uid
+     * @return array
+     * @throws PublicKeyMissingException
+     */
+    public function addSystemKeys(array $accessList, array $publicKeys, $uid) {
+        if (!empty($accessList['public'])) {
+            $publicShareKey = $this->getPublicShareKey();
+            if (empty($publicShareKey)) {
+                throw new PublicKeyMissingException($this->getPublicShareKeyId());
+            }
+            $publicKeys[$this->getPublicShareKeyId()] = $publicShareKey;
+        }
+
+        if ($this->recoveryKeyExists() &&
+            $this->util->isRecoveryEnabledForUser($uid)) {
+
+            $publicKeys[$this->getRecoveryKeyId()] = $this->getRecoveryKey();
+        }
+
+        return $publicKeys;
+    }
+
+    /**
+     * get master key password
+     *
+     * @return string
+     * @throws \Exception
+     */
+    public function getMasterKeyPassword() {
+        $password = $this->config->getSystemValue('secret');
+        if (empty($password)){
+            throw new \Exception('Can not get secret from Nextcloud instance');
+        }
+
+        return $password;
+    }
+
+    /**
+     * return master key id
+     *
+     * @return string
+     */
+    public function getMasterKeyId() {
+        return $this->masterKeyId;
+    }
+
+    /**
+     * get public master key
+     *
+     * @return string
+     */
+    public function getPublicMasterKey() {
+        return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.publicKey', Encryption::ID);
+    }
 }

apps/federatedfilesharing/lib/FederatedShareProvider.php

Indentation +915 added lines, -915 removed lines

@@ -49,929 +49,929 @@
  */
 class FederatedShareProvider implements IShareProvider {
 
-	const SHARE_TYPE_REMOTE = 6;
-
-	/** @var IDBConnection */
-	private $dbConnection;
-
-	/** @var AddressHandler */
-	private $addressHandler;
-
-	/** @var Notifications */
-	private $notifications;
-
-	/** @var TokenHandler */
-	private $tokenHandler;
-
-	/** @var IL10N */
-	private $l;
-
-	/** @var ILogger */
-	private $logger;
-
-	/** @var IRootFolder */
-	private $rootFolder;
-
-	/** @var IConfig */
-	private $config;
-
-	/** @var string */
-	private $externalShareTable = 'share_external';
-
-	/** @var IUserManager */
-	private $userManager;
-
-	/** @var ICloudIdManager */
-	private $cloudIdManager;
-
-	/**
-	 * DefaultShareProvider constructor.
-	 *
-	 * @param IDBConnection $connection
-	 * @param AddressHandler $addressHandler
-	 * @param Notifications $notifications
-	 * @param TokenHandler $tokenHandler
-	 * @param IL10N $l10n
-	 * @param ILogger $logger
-	 * @param IRootFolder $rootFolder
-	 * @param IConfig $config
-	 * @param IUserManager $userManager
-	 * @param ICloudIdManager $cloudIdManager
-	 */
-	public function __construct(
-			IDBConnection $connection,
-			AddressHandler $addressHandler,
-			Notifications $notifications,
-			TokenHandler $tokenHandler,
-			IL10N $l10n,
-			ILogger $logger,
-			IRootFolder $rootFolder,
-			IConfig $config,
-			IUserManager $userManager,
-			ICloudIdManager $cloudIdManager
-	) {
-		$this->dbConnection = $connection;
-		$this->addressHandler = $addressHandler;
-		$this->notifications = $notifications;
-		$this->tokenHandler = $tokenHandler;
-		$this->l = $l10n;
-		$this->logger = $logger;
-		$this->rootFolder = $rootFolder;
-		$this->config = $config;
-		$this->userManager = $userManager;
-		$this->cloudIdManager = $cloudIdManager;
-	}
-
-	/**
-	 * Return the identifier of this provider.
-	 *
-	 * @return string Containing only [a-zA-Z0-9]
-	 */
-	public function identifier() {
-		return 'ocFederatedSharing';
-	}
-
-	/**
-	 * Share a path
-	 *
-	 * @param IShare $share
-	 * @return IShare The share object
-	 * @throws ShareNotFound
-	 * @throws \Exception
-	 */
-	public function create(IShare $share) {
-
-		$shareWith = $share->getSharedWith();
-		$itemSource = $share->getNodeId();
-		$itemType = $share->getNodeType();
-		$permissions = $share->getPermissions();
-		$sharedBy = $share->getSharedBy();
-
-		/*
+    const SHARE_TYPE_REMOTE = 6;
+
+    /** @var IDBConnection */
+    private $dbConnection;
+
+    /** @var AddressHandler */
+    private $addressHandler;
+
+    /** @var Notifications */
+    private $notifications;
+
+    /** @var TokenHandler */
+    private $tokenHandler;
+
+    /** @var IL10N */
+    private $l;
+
+    /** @var ILogger */
+    private $logger;
+
+    /** @var IRootFolder */
+    private $rootFolder;
+
+    /** @var IConfig */
+    private $config;
+
+    /** @var string */
+    private $externalShareTable = 'share_external';
+
+    /** @var IUserManager */
+    private $userManager;
+
+    /** @var ICloudIdManager */
+    private $cloudIdManager;
+
+    /**
+     * DefaultShareProvider constructor.
+     *
+     * @param IDBConnection $connection
+     * @param AddressHandler $addressHandler
+     * @param Notifications $notifications
+     * @param TokenHandler $tokenHandler
+     * @param IL10N $l10n
+     * @param ILogger $logger
+     * @param IRootFolder $rootFolder
+     * @param IConfig $config
+     * @param IUserManager $userManager
+     * @param ICloudIdManager $cloudIdManager
+     */
+    public function __construct(
+            IDBConnection $connection,
+            AddressHandler $addressHandler,
+            Notifications $notifications,
+            TokenHandler $tokenHandler,
+            IL10N $l10n,
+            ILogger $logger,
+            IRootFolder $rootFolder,
+            IConfig $config,
+            IUserManager $userManager,
+            ICloudIdManager $cloudIdManager
+    ) {
+        $this->dbConnection = $connection;
+        $this->addressHandler = $addressHandler;
+        $this->notifications = $notifications;
+        $this->tokenHandler = $tokenHandler;
+        $this->l = $l10n;
+        $this->logger = $logger;
+        $this->rootFolder = $rootFolder;
+        $this->config = $config;
+        $this->userManager = $userManager;
+        $this->cloudIdManager = $cloudIdManager;
+    }
+
+    /**
+     * Return the identifier of this provider.
+     *
+     * @return string Containing only [a-zA-Z0-9]
+     */
+    public function identifier() {
+        return 'ocFederatedSharing';
+    }
+
+    /**
+     * Share a path
+     *
+     * @param IShare $share
+     * @return IShare The share object
+     * @throws ShareNotFound
+     * @throws \Exception
+     */
+    public function create(IShare $share) {
+
+        $shareWith = $share->getSharedWith();
+        $itemSource = $share->getNodeId();
+        $itemType = $share->getNodeType();
+        $permissions = $share->getPermissions();
+        $sharedBy = $share->getSharedBy();
+
+        /*
 		 * Check if file is not already shared with the remote user
 		 */
-		$alreadyShared = $this->getSharedWith($shareWith, self::SHARE_TYPE_REMOTE, $share->getNode(), 1, 0);
-		if (!empty($alreadyShared)) {
-			$message = 'Sharing %s failed, because this item is already shared with %s';
-			$message_t = $this->l->t('Sharing %s failed, because this item is already shared with %s', array($share->getNode()->getName(), $shareWith));
-			$this->logger->debug(sprintf($message, $share->getNode()->getName(), $shareWith), ['app' => 'Federated File Sharing']);
-			throw new \Exception($message_t);
-		}
-
-
-		// don't allow federated shares if source and target server are the same
-		$cloudId = $this->cloudIdManager->resolveCloudId($shareWith);
-		$currentServer = $this->addressHandler->generateRemoteURL();
-		$currentUser = $sharedBy;
-		if ($this->addressHandler->compareAddresses($cloudId->getUser(), $cloudId->getRemote(), $currentUser, $currentServer)) {
-			$message = 'Not allowed to create a federated share with the same user.';
-			$message_t = $this->l->t('Not allowed to create a federated share with the same user');
-			$this->logger->debug($message, ['app' => 'Federated File Sharing']);
-			throw new \Exception($message_t);
-		}
-
-
-		$share->setSharedWith($cloudId->getId());
-
-		try {
-			$remoteShare = $this->getShareFromExternalShareTable($share);
-		} catch (ShareNotFound $e) {
-			$remoteShare = null;
-		}
-
-		if ($remoteShare) {
-			try {
-				$ownerCloudId = $this->cloudIdManager->getCloudId($remoteShare['owner'], $remoteShare['remote']);
-				$shareId = $this->addShareToDB($itemSource, $itemType, $shareWith, $sharedBy, $ownerCloudId->getId(), $permissions, 'tmp_token_' . time());
-				$share->setId($shareId);
-				list($token, $remoteId) = $this->askOwnerToReShare($shareWith, $share, $shareId);
-				// remote share was create successfully if we get a valid token as return
-				$send = is_string($token) && $token !== '';
-			} catch (\Exception $e) {
-				// fall back to old re-share behavior if the remote server
-				// doesn't support flat re-shares (was introduced with Nextcloud 9.1)
-				$this->removeShareFromTable($share);
-				$shareId = $this->createFederatedShare($share);
-			}
-			if ($send) {
-				$this->updateSuccessfulReshare($shareId, $token);
-				$this->storeRemoteId($shareId, $remoteId);
-			} else {
-				$this->removeShareFromTable($share);
-				$message_t = $this->l->t('File is already shared with %s', [$shareWith]);
-				throw new \Exception($message_t);
-			}
-
-		} else {
-			$shareId = $this->createFederatedShare($share);
-		}
-
-		$data = $this->getRawShare($shareId);
-		return $this->createShareObject($data);
-	}
-
-	/**
-	 * create federated share and inform the recipient
-	 *
-	 * @param IShare $share
-	 * @return int
-	 * @throws ShareNotFound
-	 * @throws \Exception
-	 */
-	protected function createFederatedShare(IShare $share) {
-		$token = $this->tokenHandler->generateToken();
-		$shareId = $this->addShareToDB(
-			$share->getNodeId(),
-			$share->getNodeType(),
-			$share->getSharedWith(),
-			$share->getSharedBy(),
-			$share->getShareOwner(),
-			$share->getPermissions(),
-			$token
-		);
-
-		$failure = false;
-
-		try {
-			$sharedByFederatedId = $share->getSharedBy();
-			if ($this->userManager->userExists($sharedByFederatedId)) {
-				$cloudId = $this->cloudIdManager->getCloudId($sharedByFederatedId, $this->addressHandler->generateRemoteURL());
-				$sharedByFederatedId = $cloudId->getId();
-			}
-			$ownerCloudId = $this->cloudIdManager->getCloudId($share->getShareOwner(), $this->addressHandler->generateRemoteURL());
-			$send = $this->notifications->sendRemoteShare(
-				$token,
-				$share->getSharedWith(),
-				$share->getNode()->getName(),
-				$shareId,
-				$share->getShareOwner(),
-				$ownerCloudId->getId(),
-				$share->getSharedBy(),
-				$sharedByFederatedId
-			);
-
-			if ($send === false) {
-				$failure = true;
-			}
-		} catch (\Exception $e) {
-			$this->logger->error('Failed to notify remote server of federated share, removing share (' . $e->getMessage() . ')');
-			$failure = true;
-		}
-
-		if($failure) {
-			$this->removeShareFromTableById($shareId);
-			$message_t = $this->l->t('Sharing %s failed, could not find %s, maybe the server is currently unreachable or uses a self-signed certificate.',
-				[$share->getNode()->getName(), $share->getSharedWith()]);
-			throw new \Exception($message_t);
-		}
-
-		return $shareId;
-
-	}
-
-	/**
-	 * @param string $shareWith
-	 * @param IShare $share
-	 * @param string $shareId internal share Id
-	 * @return array
-	 * @throws \Exception
-	 */
-	protected function askOwnerToReShare($shareWith, IShare $share, $shareId) {
-
-		$remoteShare = $this->getShareFromExternalShareTable($share);
-		$token = $remoteShare['share_token'];
-		$remoteId = $remoteShare['remote_id'];
-		$remote = $remoteShare['remote'];
-
-		list($token, $remoteId) = $this->notifications->requestReShare(
-			$token,
-			$remoteId,
-			$shareId,
-			$remote,
-			$shareWith,
-			$share->getPermissions()
-		);
-
-		return [$token, $remoteId];
-	}
-
-	/**
-	 * get federated share from the share_external table but exclude mounted link shares
-	 *
-	 * @param IShare $share
-	 * @return array
-	 * @throws ShareNotFound
-	 */
-	protected function getShareFromExternalShareTable(IShare $share) {
-		$query = $this->dbConnection->getQueryBuilder();
-		$query->select('*')->from($this->externalShareTable)
-			->where($query->expr()->eq('user', $query->createNamedParameter($share->getShareOwner())))
-			->andWhere($query->expr()->eq('mountpoint', $query->createNamedParameter($share->getTarget())));
-		$result = $query->execute()->fetchAll();
-
-		if (isset($result[0]) && (int)$result[0]['remote_id'] > 0) {
-			return $result[0];
-		}
-
-		throw new ShareNotFound('share not found in share_external table');
-	}
-
-	/**
-	 * add share to the database and return the ID
-	 *
-	 * @param int $itemSource
-	 * @param string $itemType
-	 * @param string $shareWith
-	 * @param string $sharedBy
-	 * @param string $uidOwner
-	 * @param int $permissions
-	 * @param string $token
-	 * @return int
-	 */
-	private function addShareToDB($itemSource, $itemType, $shareWith, $sharedBy, $uidOwner, $permissions, $token) {
-		$qb = $this->dbConnection->getQueryBuilder();
-		$qb->insert('share')
-			->setValue('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE))
-			->setValue('item_type', $qb->createNamedParameter($itemType))
-			->setValue('item_source', $qb->createNamedParameter($itemSource))
-			->setValue('file_source', $qb->createNamedParameter($itemSource))
-			->setValue('share_with', $qb->createNamedParameter($shareWith))
-			->setValue('uid_owner', $qb->createNamedParameter($uidOwner))
-			->setValue('uid_initiator', $qb->createNamedParameter($sharedBy))
-			->setValue('permissions', $qb->createNamedParameter($permissions))
-			->setValue('token', $qb->createNamedParameter($token))
-			->setValue('stime', $qb->createNamedParameter(time()));
-
-		/*
+        $alreadyShared = $this->getSharedWith($shareWith, self::SHARE_TYPE_REMOTE, $share->getNode(), 1, 0);
+        if (!empty($alreadyShared)) {
+            $message = 'Sharing %s failed, because this item is already shared with %s';
+            $message_t = $this->l->t('Sharing %s failed, because this item is already shared with %s', array($share->getNode()->getName(), $shareWith));
+            $this->logger->debug(sprintf($message, $share->getNode()->getName(), $shareWith), ['app' => 'Federated File Sharing']);
+            throw new \Exception($message_t);
+        }
+
+
+        // don't allow federated shares if source and target server are the same
+        $cloudId = $this->cloudIdManager->resolveCloudId($shareWith);
+        $currentServer = $this->addressHandler->generateRemoteURL();
+        $currentUser = $sharedBy;
+        if ($this->addressHandler->compareAddresses($cloudId->getUser(), $cloudId->getRemote(), $currentUser, $currentServer)) {
+            $message = 'Not allowed to create a federated share with the same user.';
+            $message_t = $this->l->t('Not allowed to create a federated share with the same user');
+            $this->logger->debug($message, ['app' => 'Federated File Sharing']);
+            throw new \Exception($message_t);
+        }
+
+
+        $share->setSharedWith($cloudId->getId());
+
+        try {
+            $remoteShare = $this->getShareFromExternalShareTable($share);
+        } catch (ShareNotFound $e) {
+            $remoteShare = null;
+        }
+
+        if ($remoteShare) {
+            try {
+                $ownerCloudId = $this->cloudIdManager->getCloudId($remoteShare['owner'], $remoteShare['remote']);
+                $shareId = $this->addShareToDB($itemSource, $itemType, $shareWith, $sharedBy, $ownerCloudId->getId(), $permissions, 'tmp_token_' . time());
+                $share->setId($shareId);
+                list($token, $remoteId) = $this->askOwnerToReShare($shareWith, $share, $shareId);
+                // remote share was create successfully if we get a valid token as return
+                $send = is_string($token) && $token !== '';
+            } catch (\Exception $e) {
+                // fall back to old re-share behavior if the remote server
+                // doesn't support flat re-shares (was introduced with Nextcloud 9.1)
+                $this->removeShareFromTable($share);
+                $shareId = $this->createFederatedShare($share);
+            }
+            if ($send) {
+                $this->updateSuccessfulReshare($shareId, $token);
+                $this->storeRemoteId($shareId, $remoteId);
+            } else {
+                $this->removeShareFromTable($share);
+                $message_t = $this->l->t('File is already shared with %s', [$shareWith]);
+                throw new \Exception($message_t);
+            }
+
+        } else {
+            $shareId = $this->createFederatedShare($share);
+        }
+
+        $data = $this->getRawShare($shareId);
+        return $this->createShareObject($data);
+    }
+
+    /**
+     * create federated share and inform the recipient
+     *
+     * @param IShare $share
+     * @return int
+     * @throws ShareNotFound
+     * @throws \Exception
+     */
+    protected function createFederatedShare(IShare $share) {
+        $token = $this->tokenHandler->generateToken();
+        $shareId = $this->addShareToDB(
+            $share->getNodeId(),
+            $share->getNodeType(),
+            $share->getSharedWith(),
+            $share->getSharedBy(),
+            $share->getShareOwner(),
+            $share->getPermissions(),
+            $token
+        );
+
+        $failure = false;
+
+        try {
+            $sharedByFederatedId = $share->getSharedBy();
+            if ($this->userManager->userExists($sharedByFederatedId)) {
+                $cloudId = $this->cloudIdManager->getCloudId($sharedByFederatedId, $this->addressHandler->generateRemoteURL());
+                $sharedByFederatedId = $cloudId->getId();
+            }
+            $ownerCloudId = $this->cloudIdManager->getCloudId($share->getShareOwner(), $this->addressHandler->generateRemoteURL());
+            $send = $this->notifications->sendRemoteShare(
+                $token,
+                $share->getSharedWith(),
+                $share->getNode()->getName(),
+                $shareId,
+                $share->getShareOwner(),
+                $ownerCloudId->getId(),
+                $share->getSharedBy(),
+                $sharedByFederatedId
+            );
+
+            if ($send === false) {
+                $failure = true;
+            }
+        } catch (\Exception $e) {
+            $this->logger->error('Failed to notify remote server of federated share, removing share (' . $e->getMessage() . ')');
+            $failure = true;
+        }
+
+        if($failure) {
+            $this->removeShareFromTableById($shareId);
+            $message_t = $this->l->t('Sharing %s failed, could not find %s, maybe the server is currently unreachable or uses a self-signed certificate.',
+                [$share->getNode()->getName(), $share->getSharedWith()]);
+            throw new \Exception($message_t);
+        }
+
+        return $shareId;
+
+    }
+
+    /**
+     * @param string $shareWith
+     * @param IShare $share
+     * @param string $shareId internal share Id
+     * @return array
+     * @throws \Exception
+     */
+    protected function askOwnerToReShare($shareWith, IShare $share, $shareId) {
+
+        $remoteShare = $this->getShareFromExternalShareTable($share);
+        $token = $remoteShare['share_token'];
+        $remoteId = $remoteShare['remote_id'];
+        $remote = $remoteShare['remote'];
+
+        list($token, $remoteId) = $this->notifications->requestReShare(
+            $token,
+            $remoteId,
+            $shareId,
+            $remote,
+            $shareWith,
+            $share->getPermissions()
+        );
+
+        return [$token, $remoteId];
+    }
+
+    /**
+     * get federated share from the share_external table but exclude mounted link shares
+     *
+     * @param IShare $share
+     * @return array
+     * @throws ShareNotFound
+     */
+    protected function getShareFromExternalShareTable(IShare $share) {
+        $query = $this->dbConnection->getQueryBuilder();
+        $query->select('*')->from($this->externalShareTable)
+            ->where($query->expr()->eq('user', $query->createNamedParameter($share->getShareOwner())))
+            ->andWhere($query->expr()->eq('mountpoint', $query->createNamedParameter($share->getTarget())));
+        $result = $query->execute()->fetchAll();
+
+        if (isset($result[0]) && (int)$result[0]['remote_id'] > 0) {
+            return $result[0];
+        }
+
+        throw new ShareNotFound('share not found in share_external table');
+    }
+
+    /**
+     * add share to the database and return the ID
+     *
+     * @param int $itemSource
+     * @param string $itemType
+     * @param string $shareWith
+     * @param string $sharedBy
+     * @param string $uidOwner
+     * @param int $permissions
+     * @param string $token
+     * @return int
+     */
+    private function addShareToDB($itemSource, $itemType, $shareWith, $sharedBy, $uidOwner, $permissions, $token) {
+        $qb = $this->dbConnection->getQueryBuilder();
+        $qb->insert('share')
+            ->setValue('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE))
+            ->setValue('item_type', $qb->createNamedParameter($itemType))
+            ->setValue('item_source', $qb->createNamedParameter($itemSource))
+            ->setValue('file_source', $qb->createNamedParameter($itemSource))
+            ->setValue('share_with', $qb->createNamedParameter($shareWith))
+            ->setValue('uid_owner', $qb->createNamedParameter($uidOwner))
+            ->setValue('uid_initiator', $qb->createNamedParameter($sharedBy))
+            ->setValue('permissions', $qb->createNamedParameter($permissions))
+            ->setValue('token', $qb->createNamedParameter($token))
+            ->setValue('stime', $qb->createNamedParameter(time()));
+
+        /*
 		 * Added to fix https://github.com/owncloud/core/issues/22215
 		 * Can be removed once we get rid of ajax/share.php
 		 */
-		$qb->setValue('file_target', $qb->createNamedParameter(''));
-
-		$qb->execute();
-		$id = $qb->getLastInsertId();
-
-		return (int)$id;
-	}
-
-	/**
-	 * Update a share
-	 *
-	 * @param IShare $share
-	 * @return IShare The share object
-	 */
-	public function update(IShare $share) {
-		/*
+        $qb->setValue('file_target', $qb->createNamedParameter(''));
+
+        $qb->execute();
+        $id = $qb->getLastInsertId();
+
+        return (int)$id;
+    }
+
+    /**
+     * Update a share
+     *
+     * @param IShare $share
+     * @return IShare The share object
+     */
+    public function update(IShare $share) {
+        /*
 		 * We allow updating the permissions of federated shares
 		 */
-		$qb = $this->dbConnection->getQueryBuilder();
-			$qb->update('share')
-				->where($qb->expr()->eq('id', $qb->createNamedParameter($share->getId())))
-				->set('permissions', $qb->createNamedParameter($share->getPermissions()))
-				->set('uid_owner', $qb->createNamedParameter($share->getShareOwner()))
-				->set('uid_initiator', $qb->createNamedParameter($share->getSharedBy()))
-				->execute();
-
-		// send the updated permission to the owner/initiator, if they are not the same
-		if ($share->getShareOwner() !== $share->getSharedBy()) {
-			$this->sendPermissionUpdate($share);
-		}
-
-		return $share;
-	}
-
-	/**
-	 * send the updated permission to the owner/initiator, if they are not the same
-	 *
-	 * @param IShare $share
-	 * @throws ShareNotFound
-	 * @throws \OC\HintException
-	 */
-	protected function sendPermissionUpdate(IShare $share) {
-		$remoteId = $this->getRemoteId($share);
-		// if the local user is the owner we send the permission change to the initiator
-		if ($this->userManager->userExists($share->getShareOwner())) {
-			list(, $remote) = $this->addressHandler->splitUserRemote($share->getSharedBy());
-		} else { // ... if not we send the permission change to the owner
-			list(, $remote) = $this->addressHandler->splitUserRemote($share->getShareOwner());
-		}
-		$this->notifications->sendPermissionChange($remote, $remoteId, $share->getToken(), $share->getPermissions());
-	}
-
-
-	/**
-	 * update successful reShare with the correct token
-	 *
-	 * @param int $shareId
-	 * @param string $token
-	 */
-	protected function updateSuccessfulReShare($shareId, $token) {
-		$query = $this->dbConnection->getQueryBuilder();
-		$query->update('share')
-			->where($query->expr()->eq('id', $query->createNamedParameter($shareId)))
-			->set('token', $query->createNamedParameter($token))
-			->execute();
-	}
-
-	/**
-	 * store remote ID in federated reShare table
-	 *
-	 * @param $shareId
-	 * @param $remoteId
-	 */
-	public function storeRemoteId($shareId, $remoteId) {
-		$query = $this->dbConnection->getQueryBuilder();
-		$query->insert('federated_reshares')
-			->values(
-				[
-					'share_id' =>  $query->createNamedParameter($shareId),
-					'remote_id' => $query->createNamedParameter($remoteId),
-				]
-			);
-		$query->execute();
-	}
-
-	/**
-	 * get share ID on remote server for federated re-shares
-	 *
-	 * @param IShare $share
-	 * @return int
-	 * @throws ShareNotFound
-	 */
-	public function getRemoteId(IShare $share) {
-		$query = $this->dbConnection->getQueryBuilder();
-		$query->select('remote_id')->from('federated_reshares')
-			->where($query->expr()->eq('share_id', $query->createNamedParameter((int)$share->getId())));
-		$data = $query->execute()->fetch();
-
-		if (!is_array($data) || !isset($data['remote_id'])) {
-			throw new ShareNotFound();
-		}
-
-		return (int)$data['remote_id'];
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function move(IShare $share, $recipient) {
-		/*
+        $qb = $this->dbConnection->getQueryBuilder();
+            $qb->update('share')
+                ->where($qb->expr()->eq('id', $qb->createNamedParameter($share->getId())))
+                ->set('permissions', $qb->createNamedParameter($share->getPermissions()))
+                ->set('uid_owner', $qb->createNamedParameter($share->getShareOwner()))
+                ->set('uid_initiator', $qb->createNamedParameter($share->getSharedBy()))
+                ->execute();
+
+        // send the updated permission to the owner/initiator, if they are not the same
+        if ($share->getShareOwner() !== $share->getSharedBy()) {
+            $this->sendPermissionUpdate($share);
+        }
+
+        return $share;
+    }
+
+    /**
+     * send the updated permission to the owner/initiator, if they are not the same
+     *
+     * @param IShare $share
+     * @throws ShareNotFound
+     * @throws \OC\HintException
+     */
+    protected function sendPermissionUpdate(IShare $share) {
+        $remoteId = $this->getRemoteId($share);
+        // if the local user is the owner we send the permission change to the initiator
+        if ($this->userManager->userExists($share->getShareOwner())) {
+            list(, $remote) = $this->addressHandler->splitUserRemote($share->getSharedBy());
+        } else { // ... if not we send the permission change to the owner
+            list(, $remote) = $this->addressHandler->splitUserRemote($share->getShareOwner());
+        }
+        $this->notifications->sendPermissionChange($remote, $remoteId, $share->getToken(), $share->getPermissions());
+    }
+
+
+    /**
+     * update successful reShare with the correct token
+     *
+     * @param int $shareId
+     * @param string $token
+     */
+    protected function updateSuccessfulReShare($shareId, $token) {
+        $query = $this->dbConnection->getQueryBuilder();
+        $query->update('share')
+            ->where($query->expr()->eq('id', $query->createNamedParameter($shareId)))
+            ->set('token', $query->createNamedParameter($token))
+            ->execute();
+    }
+
+    /**
+     * store remote ID in federated reShare table
+     *
+     * @param $shareId
+     * @param $remoteId
+     */
+    public function storeRemoteId($shareId, $remoteId) {
+        $query = $this->dbConnection->getQueryBuilder();
+        $query->insert('federated_reshares')
+            ->values(
+                [
+                    'share_id' =>  $query->createNamedParameter($shareId),
+                    'remote_id' => $query->createNamedParameter($remoteId),
+                ]
+            );
+        $query->execute();
+    }
+
+    /**
+     * get share ID on remote server for federated re-shares
+     *
+     * @param IShare $share
+     * @return int
+     * @throws ShareNotFound
+     */
+    public function getRemoteId(IShare $share) {
+        $query = $this->dbConnection->getQueryBuilder();
+        $query->select('remote_id')->from('federated_reshares')
+            ->where($query->expr()->eq('share_id', $query->createNamedParameter((int)$share->getId())));
+        $data = $query->execute()->fetch();
+
+        if (!is_array($data) || !isset($data['remote_id'])) {
+            throw new ShareNotFound();
+        }
+
+        return (int)$data['remote_id'];
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function move(IShare $share, $recipient) {
+        /*
 		 * This function does nothing yet as it is just for outgoing
 		 * federated shares.
 		 */
-		return $share;
-	}
-
-	/**
-	 * Get all children of this share
-	 *
-	 * @param IShare $parent
-	 * @return IShare[]
-	 */
-	public function getChildren(IShare $parent) {
-		$children = [];
-
-		$qb = $this->dbConnection->getQueryBuilder();
-		$qb->select('*')
-			->from('share')
-			->where($qb->expr()->eq('parent', $qb->createNamedParameter($parent->getId())))
-			->andWhere($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)))
-			->orderBy('id');
-
-		$cursor = $qb->execute();
-		while($data = $cursor->fetch()) {
-			$children[] = $this->createShareObject($data);
-		}
-		$cursor->closeCursor();
-
-		return $children;
-	}
-
-	/**
-	 * Delete a share (owner unShares the file)
-	 *
-	 * @param IShare $share
-	 */
-	public function delete(IShare $share) {
-
-		list(, $remote) = $this->addressHandler->splitUserRemote($share->getSharedWith());
-
-		$isOwner = false;
-
-		$this->removeShareFromTable($share);
-
-		// if the local user is the owner we can send the unShare request directly...
-		if ($this->userManager->userExists($share->getShareOwner())) {
-			$this->notifications->sendRemoteUnShare($remote, $share->getId(), $share->getToken());
-			$this->revokeShare($share, true);
-			$isOwner = true;
-		} else { // ... if not we need to correct ID for the unShare request
-			$remoteId = $this->getRemoteId($share);
-			$this->notifications->sendRemoteUnShare($remote, $remoteId, $share->getToken());
-			$this->revokeShare($share, false);
-		}
-
-		// send revoke notification to the other user, if initiator and owner are not the same user
-		if ($share->getShareOwner() !== $share->getSharedBy()) {
-			$remoteId = $this->getRemoteId($share);
-			if ($isOwner) {
-				list(, $remote) = $this->addressHandler->splitUserRemote($share->getSharedBy());
-			} else {
-				list(, $remote) = $this->addressHandler->splitUserRemote($share->getShareOwner());
-			}
-			$this->notifications->sendRevokeShare($remote, $remoteId, $share->getToken());
-		}
-	}
-
-	/**
-	 * in case of a re-share we need to send the other use (initiator or owner)
-	 * a message that the file was unshared
-	 *
-	 * @param IShare $share
-	 * @param bool $isOwner the user can either be the owner or the user who re-sahred it
-	 * @throws ShareNotFound
-	 * @throws \OC\HintException
-	 */
-	protected function revokeShare($share, $isOwner) {
-		// also send a unShare request to the initiator, if this is a different user than the owner
-		if ($share->getShareOwner() !== $share->getSharedBy()) {
-			if ($isOwner) {
-				list(, $remote) = $this->addressHandler->splitUserRemote($share->getSharedBy());
-			} else {
-				list(, $remote) = $this->addressHandler->splitUserRemote($share->getShareOwner());
-			}
-			$remoteId = $this->getRemoteId($share);
-			$this->notifications->sendRevokeShare($remote, $remoteId, $share->getToken());
-		}
-	}
-
-	/**
-	 * remove share from table
-	 *
-	 * @param IShare $share
-	 */
-	public function removeShareFromTable(IShare $share) {
-		$this->removeShareFromTableById($share->getId());
-	}
-
-	/**
-	 * remove share from table
-	 *
-	 * @param string $shareId
-	 */
-	private function removeShareFromTableById($shareId) {
-		$qb = $this->dbConnection->getQueryBuilder();
-		$qb->delete('share')
-			->where($qb->expr()->eq('id', $qb->createNamedParameter($shareId)));
-		$qb->execute();
-
-		$qb->delete('federated_reshares')
-			->where($qb->expr()->eq('share_id', $qb->createNamedParameter($shareId)));
-		$qb->execute();
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function deleteFromSelf(IShare $share, $recipient) {
-		// nothing to do here. Technically deleteFromSelf in the context of federated
-		// shares is a umount of a external storage. This is handled here
-		// apps/files_sharing/lib/external/manager.php
-		// TODO move this code over to this app
-		return;
-	}
-
-
-	public function getSharesInFolder($userId, Folder $node, $reshares) {
-		$qb = $this->dbConnection->getQueryBuilder();
-		$qb->select('*')
-			->from('share', 's')
-			->andWhere($qb->expr()->orX(
-				$qb->expr()->eq('item_type', $qb->createNamedParameter('file')),
-				$qb->expr()->eq('item_type', $qb->createNamedParameter('folder'))
-			))
-			->andWhere(
-				$qb->expr()->eq('share_type', $qb->createNamedParameter(\OCP\Share::SHARE_TYPE_REMOTE))
-			);
-
-		/**
-		 * Reshares for this user are shares where they are the owner.
-		 */
-		if ($reshares === false) {
-			$qb->andWhere($qb->expr()->eq('uid_initiator', $qb->createNamedParameter($userId)));
-		} else {
-			$qb->andWhere(
-				$qb->expr()->orX(
-					$qb->expr()->eq('uid_owner', $qb->createNamedParameter($userId)),
-					$qb->expr()->eq('uid_initiator', $qb->createNamedParameter($userId))
-				)
-			);
-		}
-
-		$qb->innerJoin('s', 'filecache' ,'f', $qb->expr()->eq('s.file_source', 'f.fileid'));
-		$qb->andWhere($qb->expr()->eq('f.parent', $qb->createNamedParameter($node->getId())));
-
-		$qb->orderBy('id');
-
-		$cursor = $qb->execute();
-		$shares = [];
-		while ($data = $cursor->fetch()) {
-			$shares[$data['fileid']][] = $this->createShareObject($data);
-		}
-		$cursor->closeCursor();
-
-		return $shares;
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function getSharesBy($userId, $shareType, $node, $reshares, $limit, $offset) {
-		$qb = $this->dbConnection->getQueryBuilder();
-		$qb->select('*')
-			->from('share');
-
-		$qb->andWhere($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)));
-
-		/**
-		 * Reshares for this user are shares where they are the owner.
-		 */
-		if ($reshares === false) {
-			//Special case for old shares created via the web UI
-			$or1 = $qb->expr()->andX(
-				$qb->expr()->eq('uid_owner', $qb->createNamedParameter($userId)),
-				$qb->expr()->isNull('uid_initiator')
-			);
-
-			$qb->andWhere(
-				$qb->expr()->orX(
-					$qb->expr()->eq('uid_initiator', $qb->createNamedParameter($userId)),
-					$or1
-				)
-			);
-		} else {
-			$qb->andWhere(
-				$qb->expr()->orX(
-					$qb->expr()->eq('uid_owner', $qb->createNamedParameter($userId)),
-					$qb->expr()->eq('uid_initiator', $qb->createNamedParameter($userId))
-				)
-			);
-		}
-
-		if ($node !== null) {
-			$qb->andWhere($qb->expr()->eq('file_source', $qb->createNamedParameter($node->getId())));
-		}
-
-		if ($limit !== -1) {
-			$qb->setMaxResults($limit);
-		}
-
-		$qb->setFirstResult($offset);
-		$qb->orderBy('id');
-
-		$cursor = $qb->execute();
-		$shares = [];
-		while($data = $cursor->fetch()) {
-			$shares[] = $this->createShareObject($data);
-		}
-		$cursor->closeCursor();
-
-		return $shares;
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function getShareById($id, $recipientId = null) {
-		$qb = $this->dbConnection->getQueryBuilder();
-
-		$qb->select('*')
-			->from('share')
-			->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
-			->andWhere($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)));
-
-		$cursor = $qb->execute();
-		$data = $cursor->fetch();
-		$cursor->closeCursor();
-
-		if ($data === false) {
-			throw new ShareNotFound();
-		}
-
-		try {
-			$share = $this->createShareObject($data);
-		} catch (InvalidShare $e) {
-			throw new ShareNotFound();
-		}
-
-		return $share;
-	}
-
-	/**
-	 * Get shares for a given path
-	 *
-	 * @param \OCP\Files\Node $path
-	 * @return IShare[]
-	 */
-	public function getSharesByPath(Node $path) {
-		$qb = $this->dbConnection->getQueryBuilder();
-
-		$cursor = $qb->select('*')
-			->from('share')
-			->andWhere($qb->expr()->eq('file_source', $qb->createNamedParameter($path->getId())))
-			->andWhere($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)))
-			->execute();
-
-		$shares = [];
-		while($data = $cursor->fetch()) {
-			$shares[] = $this->createShareObject($data);
-		}
-		$cursor->closeCursor();
-
-		return $shares;
-	}
-
-	/**
-	 * @inheritdoc
-	 */
-	public function getSharedWith($userId, $shareType, $node, $limit, $offset) {
-		/** @var IShare[] $shares */
-		$shares = [];
-
-		//Get shares directly with this user
-		$qb = $this->dbConnection->getQueryBuilder();
-		$qb->select('*')
-			->from('share');
-
-		// Order by id
-		$qb->orderBy('id');
-
-		// Set limit and offset
-		if ($limit !== -1) {
-			$qb->setMaxResults($limit);
-		}
-		$qb->setFirstResult($offset);
-
-		$qb->where($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)));
-		$qb->andWhere($qb->expr()->eq('share_with', $qb->createNamedParameter($userId)));
-
-		// Filter by node if provided
-		if ($node !== null) {
-			$qb->andWhere($qb->expr()->eq('file_source', $qb->createNamedParameter($node->getId())));
-		}
-
-		$cursor = $qb->execute();
-
-		while($data = $cursor->fetch()) {
-			$shares[] = $this->createShareObject($data);
-		}
-		$cursor->closeCursor();
-
-
-		return $shares;
-	}
-
-	/**
-	 * Get a share by token
-	 *
-	 * @param string $token
-	 * @return IShare
-	 * @throws ShareNotFound
-	 */
-	public function getShareByToken($token) {
-		$qb = $this->dbConnection->getQueryBuilder();
-
-		$cursor = $qb->select('*')
-			->from('share')
-			->where($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)))
-			->andWhere($qb->expr()->eq('token', $qb->createNamedParameter($token)))
-			->execute();
-
-		$data = $cursor->fetch();
-
-		if ($data === false) {
-			throw new ShareNotFound('Share not found', $this->l->t('Could not find share'));
-		}
-
-		try {
-			$share = $this->createShareObject($data);
-		} catch (InvalidShare $e) {
-			throw new ShareNotFound('Share not found', $this->l->t('Could not find share'));
-		}
-
-		return $share;
-	}
-
-	/**
-	 * get database row of a give share
-	 *
-	 * @param $id
-	 * @return array
-	 * @throws ShareNotFound
-	 */
-	private function getRawShare($id) {
-
-		// Now fetch the inserted share and create a complete share object
-		$qb = $this->dbConnection->getQueryBuilder();
-		$qb->select('*')
-			->from('share')
-			->where($qb->expr()->eq('id', $qb->createNamedParameter($id)));
-
-		$cursor = $qb->execute();
-		$data = $cursor->fetch();
-		$cursor->closeCursor();
-
-		if ($data === false) {
-			throw new ShareNotFound;
-		}
-
-		return $data;
-	}
-
-	/**
-	 * Create a share object from an database row
-	 *
-	 * @param array $data
-	 * @return IShare
-	 * @throws InvalidShare
-	 * @throws ShareNotFound
-	 */
-	private function createShareObject($data) {
-
-		$share = new Share($this->rootFolder, $this->userManager);
-		$share->setId((int)$data['id'])
-			->setShareType((int)$data['share_type'])
-			->setPermissions((int)$data['permissions'])
-			->setTarget($data['file_target'])
-			->setMailSend((bool)$data['mail_send'])
-			->setToken($data['token']);
-
-		$shareTime = new \DateTime();
-		$shareTime->setTimestamp((int)$data['stime']);
-		$share->setShareTime($shareTime);
-		$share->setSharedWith($data['share_with']);
-
-		if ($data['uid_initiator'] !== null) {
-			$share->setShareOwner($data['uid_owner']);
-			$share->setSharedBy($data['uid_initiator']);
-		} else {
-			//OLD SHARE
-			$share->setSharedBy($data['uid_owner']);
-			$path = $this->getNode($share->getSharedBy(), (int)$data['file_source']);
-
-			$owner = $path->getOwner();
-			$share->setShareOwner($owner->getUID());
-		}
-
-		$share->setNodeId((int)$data['file_source']);
-		$share->setNodeType($data['item_type']);
-
-		$share->setProviderId($this->identifier());
-
-		return $share;
-	}
-
-	/**
-	 * Get the node with file $id for $user
-	 *
-	 * @param string $userId
-	 * @param int $id
-	 * @return \OCP\Files\File|\OCP\Files\Folder
-	 * @throws InvalidShare
-	 */
-	private function getNode($userId, $id) {
-		try {
-			$userFolder = $this->rootFolder->getUserFolder($userId);
-		} catch (NotFoundException $e) {
-			throw new InvalidShare();
-		}
-
-		$nodes = $userFolder->getById($id);
-
-		if (empty($nodes)) {
-			throw new InvalidShare();
-		}
-
-		return $nodes[0];
-	}
-
-	/**
-	 * A user is deleted from the system
-	 * So clean up the relevant shares.
-	 *
-	 * @param string $uid
-	 * @param int $shareType
-	 */
-	public function userDeleted($uid, $shareType) {
-		//TODO: probabaly a good idea to send unshare info to remote servers
-
-		$qb = $this->dbConnection->getQueryBuilder();
-
-		$qb->delete('share')
-			->where($qb->expr()->eq('share_type', $qb->createNamedParameter(\OCP\Share::SHARE_TYPE_REMOTE)))
-			->andWhere($qb->expr()->eq('uid_owner', $qb->createNamedParameter($uid)))
-			->execute();
-	}
-
-	/**
-	 * This provider does not handle groups
-	 *
-	 * @param string $gid
-	 */
-	public function groupDeleted($gid) {
-		// We don't handle groups here
-		return;
-	}
-
-	/**
-	 * This provider does not handle groups
-	 *
-	 * @param string $uid
-	 * @param string $gid
-	 */
-	public function userDeletedFromGroup($uid, $gid) {
-		// We don't handle groups here
-		return;
-	}
-
-	/**
-	 * check if users from other Nextcloud instances are allowed to mount public links share by this instance
-	 *
-	 * @return bool
-	 */
-	public function isOutgoingServer2serverShareEnabled() {
-		$result = $this->config->getAppValue('files_sharing', 'outgoing_server2server_share_enabled', 'yes');
-		return ($result === 'yes');
-	}
-
-	/**
-	 * check if users are allowed to mount public links from other Nextclouds
-	 *
-	 * @return bool
-	 */
-	public function isIncomingServer2serverShareEnabled() {
-		$result = $this->config->getAppValue('files_sharing', 'incoming_server2server_share_enabled', 'yes');
-		return ($result === 'yes');
-	}
-
-	/**
-	 * Check if querying sharees on the lookup server is enabled
-	 *
-	 * @return bool
-	 */
-	public function isLookupServerQueriesEnabled() {
-		$result = $this->config->getAppValue('files_sharing', 'lookupServerEnabled', 'no');
-		return ($result === 'yes');
-	}
-
-
-	/**
-	 * Check if it is allowed to publish user specific data to the lookup server
-	 *
-	 * @return bool
-	 */
-	public function isLookupServerUploadEnabled() {
-		$result = $this->config->getAppValue('files_sharing', 'lookupServerUploadEnabled', 'yes');
-		return ($result === 'yes');
-	}
+        return $share;
+    }
+
+    /**
+     * Get all children of this share
+     *
+     * @param IShare $parent
+     * @return IShare[]
+     */
+    public function getChildren(IShare $parent) {
+        $children = [];
+
+        $qb = $this->dbConnection->getQueryBuilder();
+        $qb->select('*')
+            ->from('share')
+            ->where($qb->expr()->eq('parent', $qb->createNamedParameter($parent->getId())))
+            ->andWhere($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)))
+            ->orderBy('id');
+
+        $cursor = $qb->execute();
+        while($data = $cursor->fetch()) {
+            $children[] = $this->createShareObject($data);
+        }
+        $cursor->closeCursor();
+
+        return $children;
+    }
+
+    /**
+     * Delete a share (owner unShares the file)
+     *
+     * @param IShare $share
+     */
+    public function delete(IShare $share) {
+
+        list(, $remote) = $this->addressHandler->splitUserRemote($share->getSharedWith());
+
+        $isOwner = false;
+
+        $this->removeShareFromTable($share);
+
+        // if the local user is the owner we can send the unShare request directly...
+        if ($this->userManager->userExists($share->getShareOwner())) {
+            $this->notifications->sendRemoteUnShare($remote, $share->getId(), $share->getToken());
+            $this->revokeShare($share, true);
+            $isOwner = true;
+        } else { // ... if not we need to correct ID for the unShare request
+            $remoteId = $this->getRemoteId($share);
+            $this->notifications->sendRemoteUnShare($remote, $remoteId, $share->getToken());
+            $this->revokeShare($share, false);
+        }
+
+        // send revoke notification to the other user, if initiator and owner are not the same user
+        if ($share->getShareOwner() !== $share->getSharedBy()) {
+            $remoteId = $this->getRemoteId($share);
+            if ($isOwner) {
+                list(, $remote) = $this->addressHandler->splitUserRemote($share->getSharedBy());
+            } else {
+                list(, $remote) = $this->addressHandler->splitUserRemote($share->getShareOwner());
+            }
+            $this->notifications->sendRevokeShare($remote, $remoteId, $share->getToken());
+        }
+    }
+
+    /**
+     * in case of a re-share we need to send the other use (initiator or owner)
+     * a message that the file was unshared
+     *
+     * @param IShare $share
+     * @param bool $isOwner the user can either be the owner or the user who re-sahred it
+     * @throws ShareNotFound
+     * @throws \OC\HintException
+     */
+    protected function revokeShare($share, $isOwner) {
+        // also send a unShare request to the initiator, if this is a different user than the owner
+        if ($share->getShareOwner() !== $share->getSharedBy()) {
+            if ($isOwner) {
+                list(, $remote) = $this->addressHandler->splitUserRemote($share->getSharedBy());
+            } else {
+                list(, $remote) = $this->addressHandler->splitUserRemote($share->getShareOwner());
+            }
+            $remoteId = $this->getRemoteId($share);
+            $this->notifications->sendRevokeShare($remote, $remoteId, $share->getToken());
+        }
+    }
+
+    /**
+     * remove share from table
+     *
+     * @param IShare $share
+     */
+    public function removeShareFromTable(IShare $share) {
+        $this->removeShareFromTableById($share->getId());
+    }
+
+    /**
+     * remove share from table
+     *
+     * @param string $shareId
+     */
+    private function removeShareFromTableById($shareId) {
+        $qb = $this->dbConnection->getQueryBuilder();
+        $qb->delete('share')
+            ->where($qb->expr()->eq('id', $qb->createNamedParameter($shareId)));
+        $qb->execute();
+
+        $qb->delete('federated_reshares')
+            ->where($qb->expr()->eq('share_id', $qb->createNamedParameter($shareId)));
+        $qb->execute();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function deleteFromSelf(IShare $share, $recipient) {
+        // nothing to do here. Technically deleteFromSelf in the context of federated
+        // shares is a umount of a external storage. This is handled here
+        // apps/files_sharing/lib/external/manager.php
+        // TODO move this code over to this app
+        return;
+    }
+
+
+    public function getSharesInFolder($userId, Folder $node, $reshares) {
+        $qb = $this->dbConnection->getQueryBuilder();
+        $qb->select('*')
+            ->from('share', 's')
+            ->andWhere($qb->expr()->orX(
+                $qb->expr()->eq('item_type', $qb->createNamedParameter('file')),
+                $qb->expr()->eq('item_type', $qb->createNamedParameter('folder'))
+            ))
+            ->andWhere(
+                $qb->expr()->eq('share_type', $qb->createNamedParameter(\OCP\Share::SHARE_TYPE_REMOTE))
+            );
+
+        /**
+         * Reshares for this user are shares where they are the owner.
+         */
+        if ($reshares === false) {
+            $qb->andWhere($qb->expr()->eq('uid_initiator', $qb->createNamedParameter($userId)));
+        } else {
+            $qb->andWhere(
+                $qb->expr()->orX(
+                    $qb->expr()->eq('uid_owner', $qb->createNamedParameter($userId)),
+                    $qb->expr()->eq('uid_initiator', $qb->createNamedParameter($userId))
+                )
+            );
+        }
+
+        $qb->innerJoin('s', 'filecache' ,'f', $qb->expr()->eq('s.file_source', 'f.fileid'));
+        $qb->andWhere($qb->expr()->eq('f.parent', $qb->createNamedParameter($node->getId())));
+
+        $qb->orderBy('id');
+
+        $cursor = $qb->execute();
+        $shares = [];
+        while ($data = $cursor->fetch()) {
+            $shares[$data['fileid']][] = $this->createShareObject($data);
+        }
+        $cursor->closeCursor();
+
+        return $shares;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getSharesBy($userId, $shareType, $node, $reshares, $limit, $offset) {
+        $qb = $this->dbConnection->getQueryBuilder();
+        $qb->select('*')
+            ->from('share');
+
+        $qb->andWhere($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)));
+
+        /**
+         * Reshares for this user are shares where they are the owner.
+         */
+        if ($reshares === false) {
+            //Special case for old shares created via the web UI
+            $or1 = $qb->expr()->andX(
+                $qb->expr()->eq('uid_owner', $qb->createNamedParameter($userId)),
+                $qb->expr()->isNull('uid_initiator')
+            );
+
+            $qb->andWhere(
+                $qb->expr()->orX(
+                    $qb->expr()->eq('uid_initiator', $qb->createNamedParameter($userId)),
+                    $or1
+                )
+            );
+        } else {
+            $qb->andWhere(
+                $qb->expr()->orX(
+                    $qb->expr()->eq('uid_owner', $qb->createNamedParameter($userId)),
+                    $qb->expr()->eq('uid_initiator', $qb->createNamedParameter($userId))
+                )
+            );
+        }
+
+        if ($node !== null) {
+            $qb->andWhere($qb->expr()->eq('file_source', $qb->createNamedParameter($node->getId())));
+        }
+
+        if ($limit !== -1) {
+            $qb->setMaxResults($limit);
+        }
+
+        $qb->setFirstResult($offset);
+        $qb->orderBy('id');
+
+        $cursor = $qb->execute();
+        $shares = [];
+        while($data = $cursor->fetch()) {
+            $shares[] = $this->createShareObject($data);
+        }
+        $cursor->closeCursor();
+
+        return $shares;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getShareById($id, $recipientId = null) {
+        $qb = $this->dbConnection->getQueryBuilder();
+
+        $qb->select('*')
+            ->from('share')
+            ->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
+            ->andWhere($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)));
+
+        $cursor = $qb->execute();
+        $data = $cursor->fetch();
+        $cursor->closeCursor();
+
+        if ($data === false) {
+            throw new ShareNotFound();
+        }
+
+        try {
+            $share = $this->createShareObject($data);
+        } catch (InvalidShare $e) {
+            throw new ShareNotFound();
+        }
+
+        return $share;
+    }
+
+    /**
+     * Get shares for a given path
+     *
+     * @param \OCP\Files\Node $path
+     * @return IShare[]
+     */
+    public function getSharesByPath(Node $path) {
+        $qb = $this->dbConnection->getQueryBuilder();
+
+        $cursor = $qb->select('*')
+            ->from('share')
+            ->andWhere($qb->expr()->eq('file_source', $qb->createNamedParameter($path->getId())))
+            ->andWhere($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)))
+            ->execute();
+
+        $shares = [];
+        while($data = $cursor->fetch()) {
+            $shares[] = $this->createShareObject($data);
+        }
+        $cursor->closeCursor();
+
+        return $shares;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getSharedWith($userId, $shareType, $node, $limit, $offset) {
+        /** @var IShare[] $shares */
+        $shares = [];
+
+        //Get shares directly with this user
+        $qb = $this->dbConnection->getQueryBuilder();
+        $qb->select('*')
+            ->from('share');
+
+        // Order by id
+        $qb->orderBy('id');
+
+        // Set limit and offset
+        if ($limit !== -1) {
+            $qb->setMaxResults($limit);
+        }
+        $qb->setFirstResult($offset);
+
+        $qb->where($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)));
+        $qb->andWhere($qb->expr()->eq('share_with', $qb->createNamedParameter($userId)));
+
+        // Filter by node if provided
+        if ($node !== null) {
+            $qb->andWhere($qb->expr()->eq('file_source', $qb->createNamedParameter($node->getId())));
+        }
+
+        $cursor = $qb->execute();
+
+        while($data = $cursor->fetch()) {
+            $shares[] = $this->createShareObject($data);
+        }
+        $cursor->closeCursor();
+
+
+        return $shares;
+    }
+
+    /**
+     * Get a share by token
+     *
+     * @param string $token
+     * @return IShare
+     * @throws ShareNotFound
+     */
+    public function getShareByToken($token) {
+        $qb = $this->dbConnection->getQueryBuilder();
+
+        $cursor = $qb->select('*')
+            ->from('share')
+            ->where($qb->expr()->eq('share_type', $qb->createNamedParameter(self::SHARE_TYPE_REMOTE)))
+            ->andWhere($qb->expr()->eq('token', $qb->createNamedParameter($token)))
+            ->execute();
+
+        $data = $cursor->fetch();
+
+        if ($data === false) {
+            throw new ShareNotFound('Share not found', $this->l->t('Could not find share'));
+        }
+
+        try {
+            $share = $this->createShareObject($data);
+        } catch (InvalidShare $e) {
+            throw new ShareNotFound('Share not found', $this->l->t('Could not find share'));
+        }
+
+        return $share;
+    }
+
+    /**
+     * get database row of a give share
+     *
+     * @param $id
+     * @return array
+     * @throws ShareNotFound
+     */
+    private function getRawShare($id) {
+
+        // Now fetch the inserted share and create a complete share object
+        $qb = $this->dbConnection->getQueryBuilder();
+        $qb->select('*')
+            ->from('share')
+            ->where($qb->expr()->eq('id', $qb->createNamedParameter($id)));
+
+        $cursor = $qb->execute();
+        $data = $cursor->fetch();
+        $cursor->closeCursor();
+
+        if ($data === false) {
+            throw new ShareNotFound;
+        }
+
+        return $data;
+    }
+
+    /**
+     * Create a share object from an database row
+     *
+     * @param array $data
+     * @return IShare
+     * @throws InvalidShare
+     * @throws ShareNotFound
+     */
+    private function createShareObject($data) {
+
+        $share = new Share($this->rootFolder, $this->userManager);
+        $share->setId((int)$data['id'])
+            ->setShareType((int)$data['share_type'])
+            ->setPermissions((int)$data['permissions'])
+            ->setTarget($data['file_target'])
+            ->setMailSend((bool)$data['mail_send'])
+            ->setToken($data['token']);
+
+        $shareTime = new \DateTime();
+        $shareTime->setTimestamp((int)$data['stime']);
+        $share->setShareTime($shareTime);
+        $share->setSharedWith($data['share_with']);
+
+        if ($data['uid_initiator'] !== null) {
+            $share->setShareOwner($data['uid_owner']);
+            $share->setSharedBy($data['uid_initiator']);
+        } else {
+            //OLD SHARE
+            $share->setSharedBy($data['uid_owner']);
+            $path = $this->getNode($share->getSharedBy(), (int)$data['file_source']);
+
+            $owner = $path->getOwner();
+            $share->setShareOwner($owner->getUID());
+        }
+
+        $share->setNodeId((int)$data['file_source']);
+        $share->setNodeType($data['item_type']);
+
+        $share->setProviderId($this->identifier());
+
+        return $share;
+    }
+
+    /**
+     * Get the node with file $id for $user
+     *
+     * @param string $userId
+     * @param int $id
+     * @return \OCP\Files\File|\OCP\Files\Folder
+     * @throws InvalidShare
+     */
+    private function getNode($userId, $id) {
+        try {
+            $userFolder = $this->rootFolder->getUserFolder($userId);
+        } catch (NotFoundException $e) {
+            throw new InvalidShare();
+        }
+
+        $nodes = $userFolder->getById($id);
+
+        if (empty($nodes)) {
+            throw new InvalidShare();
+        }
+
+        return $nodes[0];
+    }
+
+    /**
+     * A user is deleted from the system
+     * So clean up the relevant shares.
+     *
+     * @param string $uid
+     * @param int $shareType
+     */
+    public function userDeleted($uid, $shareType) {
+        //TODO: probabaly a good idea to send unshare info to remote servers
+
+        $qb = $this->dbConnection->getQueryBuilder();
+
+        $qb->delete('share')
+            ->where($qb->expr()->eq('share_type', $qb->createNamedParameter(\OCP\Share::SHARE_TYPE_REMOTE)))
+            ->andWhere($qb->expr()->eq('uid_owner', $qb->createNamedParameter($uid)))
+            ->execute();
+    }
+
+    /**
+     * This provider does not handle groups
+     *
+     * @param string $gid
+     */
+    public function groupDeleted($gid) {
+        // We don't handle groups here
+        return;
+    }
+
+    /**
+     * This provider does not handle groups
+     *
+     * @param string $uid
+     * @param string $gid
+     */
+    public function userDeletedFromGroup($uid, $gid) {
+        // We don't handle groups here
+        return;
+    }
+
+    /**
+     * check if users from other Nextcloud instances are allowed to mount public links share by this instance
+     *
+     * @return bool
+     */
+    public function isOutgoingServer2serverShareEnabled() {
+        $result = $this->config->getAppValue('files_sharing', 'outgoing_server2server_share_enabled', 'yes');
+        return ($result === 'yes');
+    }
+
+    /**
+     * check if users are allowed to mount public links from other Nextclouds
+     *
+     * @return bool
+     */
+    public function isIncomingServer2serverShareEnabled() {
+        $result = $this->config->getAppValue('files_sharing', 'incoming_server2server_share_enabled', 'yes');
+        return ($result === 'yes');
+    }
+
+    /**
+     * Check if querying sharees on the lookup server is enabled
+     *
+     * @return bool
+     */
+    public function isLookupServerQueriesEnabled() {
+        $result = $this->config->getAppValue('files_sharing', 'lookupServerEnabled', 'no');
+        return ($result === 'yes');
+    }
+
+
+    /**
+     * Check if it is allowed to publish user specific data to the lookup server
+     *
+     * @return bool
+     */
+    public function isLookupServerUploadEnabled() {
+        $result = $this->config->getAppValue('files_sharing', 'lookupServerUploadEnabled', 'yes');
+        return ($result === 'yes');
+    }
 }

apps/files_trashbin/lib/Trashbin.php

Indentation +937 added lines, -937 removed lines

@@ -47,941 +47,941 @@
 
 class Trashbin {
 
-	// unit: percentage; 50% of available disk space/quota
-	const DEFAULTMAXSIZE = 50;
-
-	/**
-	 * Whether versions have already be rescanned during this PHP request
-	 *
-	 * @var bool
-	 */
-	private static $scannedVersions = false;
-
-	/**
-	 * Ensure we don't need to scan the file during the move to trash
-	 * by triggering the scan in the pre-hook
-	 *
-	 * @param array $params
-	 */
-	public static function ensureFileScannedHook($params) {
-		try {
-			self::getUidAndFilename($params['path']);
-		} catch (NotFoundException $e) {
-			// nothing to scan for non existing files
-		}
-	}
-
-	/**
-	 * get the UID of the owner of the file and the path to the file relative to
-	 * owners files folder
-	 *
-	 * @param string $filename
-	 * @return array
-	 * @throws \OC\User\NoUserException
-	 */
-	public static function getUidAndFilename($filename) {
-		$uid = Filesystem::getOwner($filename);
-		$userManager = \OC::$server->getUserManager();
-		// if the user with the UID doesn't exists, e.g. because the UID points
-		// to a remote user with a federated cloud ID we use the current logged-in
-		// user. We need a valid local user to move the file to the right trash bin
-		if (!$userManager->userExists($uid)) {
-			$uid = User::getUser();
-		}
-		if (!$uid) {
-			// no owner, usually because of share link from ext storage
-			return [null, null];
-		}
-		Filesystem::initMountPoints($uid);
-		if ($uid != User::getUser()) {
-			$info = Filesystem::getFileInfo($filename);
-			$ownerView = new View('/' . $uid . '/files');
-			try {
-				$filename = $ownerView->getPath($info['fileid']);
-			} catch (NotFoundException $e) {
-				$filename = null;
-			}
-		}
-		return [$uid, $filename];
-	}
-
-	/**
-	 * get original location of files for user
-	 *
-	 * @param string $user
-	 * @return array (filename => array (timestamp => original location))
-	 */
-	public static function getLocations($user) {
-		$query = \OC_DB::prepare('SELECT `id`, `timestamp`, `location`'
-			. ' FROM `*PREFIX*files_trash` WHERE `user`=?');
-		$result = $query->execute(array($user));
-		$array = array();
-		while ($row = $result->fetchRow()) {
-			if (isset($array[$row['id']])) {
-				$array[$row['id']][$row['timestamp']] = $row['location'];
-			} else {
-				$array[$row['id']] = array($row['timestamp'] => $row['location']);
-			}
-		}
-		return $array;
-	}
-
-	/**
-	 * get original location of file
-	 *
-	 * @param string $user
-	 * @param string $filename
-	 * @param string $timestamp
-	 * @return string original location
-	 */
-	public static function getLocation($user, $filename, $timestamp) {
-		$query = \OC_DB::prepare('SELECT `location` FROM `*PREFIX*files_trash`'
-			. ' WHERE `user`=? AND `id`=? AND `timestamp`=?');
-		$result = $query->execute(array($user, $filename, $timestamp))->fetchAll();
-		if (isset($result[0]['location'])) {
-			return $result[0]['location'];
-		} else {
-			return false;
-		}
-	}
-
-	private static function setUpTrash($user) {
-		$view = new View('/' . $user);
-		if (!$view->is_dir('files_trashbin')) {
-			$view->mkdir('files_trashbin');
-		}
-		if (!$view->is_dir('files_trashbin/files')) {
-			$view->mkdir('files_trashbin/files');
-		}
-		if (!$view->is_dir('files_trashbin/versions')) {
-			$view->mkdir('files_trashbin/versions');
-		}
-		if (!$view->is_dir('files_trashbin/keys')) {
-			$view->mkdir('files_trashbin/keys');
-		}
-	}
-
-
-	/**
-	 * copy file to owners trash
-	 *
-	 * @param string $sourcePath
-	 * @param string $owner
-	 * @param string $targetPath
-	 * @param $user
-	 * @param integer $timestamp
-	 */
-	private static function copyFilesToUser($sourcePath, $owner, $targetPath, $user, $timestamp) {
-		self::setUpTrash($owner);
-
-		$targetFilename = basename($targetPath);
-		$targetLocation = dirname($targetPath);
-
-		$sourceFilename = basename($sourcePath);
-
-		$view = new View('/');
-
-		$target = $user . '/files_trashbin/files/' . $targetFilename . '.d' . $timestamp;
-		$source = $owner . '/files_trashbin/files/' . $sourceFilename . '.d' . $timestamp;
-		self::copy_recursive($source, $target, $view);
-
-
-		if ($view->file_exists($target)) {
-			$query = \OC_DB::prepare("INSERT INTO `*PREFIX*files_trash` (`id`,`timestamp`,`location`,`user`) VALUES (?,?,?,?)");
-			$result = $query->execute(array($targetFilename, $timestamp, $targetLocation, $user));
-			if (!$result) {
-				\OCP\Util::writeLog('files_trashbin', 'trash bin database couldn\'t be updated for the files owner', \OCP\Util::ERROR);
-			}
-		}
-	}
-
-
-	/**
-	 * move file to the trash bin
-	 *
-	 * @param string $file_path path to the deleted file/directory relative to the files root directory
-	 * @param bool $ownerOnly delete for owner only (if file gets moved out of a shared folder)
-	 *
-	 * @return bool
-	 */
-	public static function move2trash($file_path, $ownerOnly = false) {
-		// get the user for which the filesystem is setup
-		$root = Filesystem::getRoot();
-		list(, $user) = explode('/', $root);
-		list($owner, $ownerPath) = self::getUidAndFilename($file_path);
-
-		// if no owner found (ex: ext storage + share link), will use the current user's trashbin then
-		if (is_null($owner)) {
-			$owner = $user;
-			$ownerPath = $file_path;
-		}
-
-		$ownerView = new View('/' . $owner);
-		// file has been deleted in between
-		if (is_null($ownerPath) || $ownerPath === '' || !$ownerView->file_exists('/files/' . $ownerPath)) {
-			return true;
-		}
-
-		self::setUpTrash($user);
-		if ($owner !== $user) {
-			// also setup for owner
-			self::setUpTrash($owner);
-		}
-
-		$path_parts = pathinfo($ownerPath);
-
-		$filename = $path_parts['basename'];
-		$location = $path_parts['dirname'];
-		$timestamp = time();
-
-		// disable proxy to prevent recursive calls
-		$trashPath = '/files_trashbin/files/' . $filename . '.d' . $timestamp;
-
-		/** @var \OC\Files\Storage\Storage $trashStorage */
-		list($trashStorage, $trashInternalPath) = $ownerView->resolvePath($trashPath);
-		/** @var \OC\Files\Storage\Storage $sourceStorage */
-		list($sourceStorage, $sourceInternalPath) = $ownerView->resolvePath('/files/' . $ownerPath);
-		try {
-			$moveSuccessful = true;
-			if ($trashStorage->file_exists($trashInternalPath)) {
-				$trashStorage->unlink($trashInternalPath);
-			}
-			$trashStorage->moveFromStorage($sourceStorage, $sourceInternalPath, $trashInternalPath);
-		} catch (\OCA\Files_Trashbin\Exceptions\CopyRecursiveException $e) {
-			$moveSuccessful = false;
-			if ($trashStorage->file_exists($trashInternalPath)) {
-				$trashStorage->unlink($trashInternalPath);
-			}
-			\OCP\Util::writeLog('files_trashbin', 'Couldn\'t move ' . $file_path . ' to the trash bin', \OCP\Util::ERROR);
-		}
-
-		if ($sourceStorage->file_exists($sourceInternalPath)) { // failed to delete the original file, abort
-			if ($sourceStorage->is_dir($sourceInternalPath)) {
-				$sourceStorage->rmdir($sourceInternalPath);
-			} else {
-				$sourceStorage->unlink($sourceInternalPath);
-			}
-			return false;
-		}
-
-		$trashStorage->getUpdater()->renameFromStorage($sourceStorage, $sourceInternalPath, $trashInternalPath);
-
-		if ($moveSuccessful) {
-			$query = \OC_DB::prepare("INSERT INTO `*PREFIX*files_trash` (`id`,`timestamp`,`location`,`user`) VALUES (?,?,?,?)");
-			$result = $query->execute(array($filename, $timestamp, $location, $owner));
-			if (!$result) {
-				\OCP\Util::writeLog('files_trashbin', 'trash bin database couldn\'t be updated', \OCP\Util::ERROR);
-			}
-			\OCP\Util::emitHook('\OCA\Files_Trashbin\Trashbin', 'post_moveToTrash', array('filePath' => Filesystem::normalizePath($file_path),
-				'trashPath' => Filesystem::normalizePath($filename . '.d' . $timestamp)));
-
-			self::retainVersions($filename, $owner, $ownerPath, $timestamp);
-
-			// if owner !== user we need to also add a copy to the users trash
-			if ($user !== $owner && $ownerOnly === false) {
-				self::copyFilesToUser($ownerPath, $owner, $file_path, $user, $timestamp);
-			}
-		}
-
-		self::scheduleExpire($user);
-
-		// if owner !== user we also need to update the owners trash size
-		if ($owner !== $user) {
-			self::scheduleExpire($owner);
-		}
-
-		return $moveSuccessful;
-	}
-
-	/**
-	 * Move file versions to trash so that they can be restored later
-	 *
-	 * @param string $filename of deleted file
-	 * @param string $owner owner user id
-	 * @param string $ownerPath path relative to the owner's home storage
-	 * @param integer $timestamp when the file was deleted
-	 */
-	private static function retainVersions($filename, $owner, $ownerPath, $timestamp) {
-		if (\OCP\App::isEnabled('files_versions') && !empty($ownerPath)) {
-
-			$user = User::getUser();
-			$rootView = new View('/');
-
-			if ($rootView->is_dir($owner . '/files_versions/' . $ownerPath)) {
-				if ($owner !== $user) {
-					self::copy_recursive($owner . '/files_versions/' . $ownerPath, $owner . '/files_trashbin/versions/' . basename($ownerPath) . '.d' . $timestamp, $rootView);
-				}
-				self::move($rootView, $owner . '/files_versions/' . $ownerPath, $user . '/files_trashbin/versions/' . $filename . '.d' . $timestamp);
-			} else if ($versions = \OCA\Files_Versions\Storage::getVersions($owner, $ownerPath)) {
-
-				foreach ($versions as $v) {
-					if ($owner !== $user) {
-						self::copy($rootView, $owner . '/files_versions' . $v['path'] . '.v' . $v['version'], $owner . '/files_trashbin/versions/' . $v['name'] . '.v' . $v['version'] . '.d' . $timestamp);
-					}
-					self::move($rootView, $owner . '/files_versions' . $v['path'] . '.v' . $v['version'], $user . '/files_trashbin/versions/' . $filename . '.v' . $v['version'] . '.d' . $timestamp);
-				}
-			}
-		}
-	}
-
-	/**
-	 * Move a file or folder on storage level
-	 *
-	 * @param View $view
-	 * @param string $source
-	 * @param string $target
-	 * @return bool
-	 */
-	private static function move(View $view, $source, $target) {
-		/** @var \OC\Files\Storage\Storage $sourceStorage */
-		list($sourceStorage, $sourceInternalPath) = $view->resolvePath($source);
-		/** @var \OC\Files\Storage\Storage $targetStorage */
-		list($targetStorage, $targetInternalPath) = $view->resolvePath($target);
-		/** @var \OC\Files\Storage\Storage $ownerTrashStorage */
-
-		$result = $targetStorage->moveFromStorage($sourceStorage, $sourceInternalPath, $targetInternalPath);
-		if ($result) {
-			$targetStorage->getUpdater()->renameFromStorage($sourceStorage, $sourceInternalPath, $targetInternalPath);
-		}
-		return $result;
-	}
-
-	/**
-	 * Copy a file or folder on storage level
-	 *
-	 * @param View $view
-	 * @param string $source
-	 * @param string $target
-	 * @return bool
-	 */
-	private static function copy(View $view, $source, $target) {
-		/** @var \OC\Files\Storage\Storage $sourceStorage */
-		list($sourceStorage, $sourceInternalPath) = $view->resolvePath($source);
-		/** @var \OC\Files\Storage\Storage $targetStorage */
-		list($targetStorage, $targetInternalPath) = $view->resolvePath($target);
-		/** @var \OC\Files\Storage\Storage $ownerTrashStorage */
-
-		$result = $targetStorage->copyFromStorage($sourceStorage, $sourceInternalPath, $targetInternalPath);
-		if ($result) {
-			$targetStorage->getUpdater()->update($targetInternalPath);
-		}
-		return $result;
-	}
-
-	/**
-	 * Restore a file or folder from trash bin
-	 *
-	 * @param string $file path to the deleted file/folder relative to "files_trashbin/files/",
-	 * including the timestamp suffix ".d12345678"
-	 * @param string $filename name of the file/folder
-	 * @param int $timestamp time when the file/folder was deleted
-	 *
-	 * @return bool true on success, false otherwise
-	 */
-	public static function restore($file, $filename, $timestamp) {
-		$user = User::getUser();
-		$view = new View('/' . $user);
-
-		$location = '';
-		if ($timestamp) {
-			$location = self::getLocation($user, $filename, $timestamp);
-			if ($location === false) {
-				\OCP\Util::writeLog('files_trashbin', 'trash bin database inconsistent!', \OCP\Util::ERROR);
-			} else {
-				// if location no longer exists, restore file in the root directory
-				if ($location !== '/' &&
-					(!$view->is_dir('files/' . $location) ||
-						!$view->isCreatable('files/' . $location))
-				) {
-					$location = '';
-				}
-			}
-		}
-
-		// we need a  extension in case a file/dir with the same name already exists
-		$uniqueFilename = self::getUniqueFilename($location, $filename, $view);
-
-		$source = Filesystem::normalizePath('files_trashbin/files/' . $file);
-		$target = Filesystem::normalizePath('files/' . $location . '/' . $uniqueFilename);
-		if (!$view->file_exists($source)) {
-			return false;
-		}
-		$mtime = $view->filemtime($source);
-
-		// restore file
-		$restoreResult = $view->rename($source, $target);
-
-		// handle the restore result
-		if ($restoreResult) {
-			$fakeRoot = $view->getRoot();
-			$view->chroot('/' . $user . '/files');
-			$view->touch('/' . $location . '/' . $uniqueFilename, $mtime);
-			$view->chroot($fakeRoot);
-			\OCP\Util::emitHook('\OCA\Files_Trashbin\Trashbin', 'post_restore', array('filePath' => Filesystem::normalizePath('/' . $location . '/' . $uniqueFilename),
-				'trashPath' => Filesystem::normalizePath($file)));
-
-			self::restoreVersions($view, $file, $filename, $uniqueFilename, $location, $timestamp);
-
-			if ($timestamp) {
-				$query = \OC_DB::prepare('DELETE FROM `*PREFIX*files_trash` WHERE `user`=? AND `id`=? AND `timestamp`=?');
-				$query->execute(array($user, $filename, $timestamp));
-			}
-
-			return true;
-		}
-
-		return false;
-	}
-
-	/**
-	 * restore versions from trash bin
-	 *
-	 * @param View $view file view
-	 * @param string $file complete path to file
-	 * @param string $filename name of file once it was deleted
-	 * @param string $uniqueFilename new file name to restore the file without overwriting existing files
-	 * @param string $location location if file
-	 * @param int $timestamp deletion time
-	 * @return false|null
-	 */
-	private static function restoreVersions(View $view, $file, $filename, $uniqueFilename, $location, $timestamp) {
-
-		if (\OCP\App::isEnabled('files_versions')) {
-
-			$user = User::getUser();
-			$rootView = new View('/');
-
-			$target = Filesystem::normalizePath('/' . $location . '/' . $uniqueFilename);
-
-			list($owner, $ownerPath) = self::getUidAndFilename($target);
-
-			// file has been deleted in between
-			if (empty($ownerPath)) {
-				return false;
-			}
-
-			if ($timestamp) {
-				$versionedFile = $filename;
-			} else {
-				$versionedFile = $file;
-			}
-
-			if ($view->is_dir('/files_trashbin/versions/' . $file)) {
-				$rootView->rename(Filesystem::normalizePath($user . '/files_trashbin/versions/' . $file), Filesystem::normalizePath($owner . '/files_versions/' . $ownerPath));
-			} else if ($versions = self::getVersionsFromTrash($versionedFile, $timestamp, $user)) {
-				foreach ($versions as $v) {
-					if ($timestamp) {
-						$rootView->rename($user . '/files_trashbin/versions/' . $versionedFile . '.v' . $v . '.d' . $timestamp, $owner . '/files_versions/' . $ownerPath . '.v' . $v);
-					} else {
-						$rootView->rename($user . '/files_trashbin/versions/' . $versionedFile . '.v' . $v, $owner . '/files_versions/' . $ownerPath . '.v' . $v);
-					}
-				}
-			}
-		}
-	}
-
-	/**
-	 * delete all files from the trash
-	 */
-	public static function deleteAll() {
-		$user = User::getUser();
-		$view = new View('/' . $user);
-		$fileInfos = $view->getDirectoryContent('files_trashbin/files');
-
-		// Array to store the relative path in (after the file is deleted, the view won't be able to relativise the path anymore)
-		$filePaths = array();
-		foreach($fileInfos as $fileInfo){
-			$filePaths[] = $view->getRelativePath($fileInfo->getPath());
-		}
-		unset($fileInfos); // save memory
-
-		// Bulk PreDelete-Hook
-		\OC_Hook::emit('\OCP\Trashbin', 'preDeleteAll', array('paths' => $filePaths));
-
-		// Single-File Hooks
-		foreach($filePaths as $path){
-			self::emitTrashbinPreDelete($path);
-		}
-
-		// actual file deletion
-		$view->deleteAll('files_trashbin');
-		$query = \OC_DB::prepare('DELETE FROM `*PREFIX*files_trash` WHERE `user`=?');
-		$query->execute(array($user));
-
-		// Bulk PostDelete-Hook
-		\OC_Hook::emit('\OCP\Trashbin', 'deleteAll', array('paths' => $filePaths));
-
-		// Single-File Hooks
-		foreach($filePaths as $path){
-			self::emitTrashbinPostDelete($path);
-		}
-
-		$view->mkdir('files_trashbin');
-		$view->mkdir('files_trashbin/files');
-
-		return true;
-	}
-
-	/**
-	 * wrapper function to emit the 'preDelete' hook of \OCP\Trashbin before a file is deleted
-	 * @param string $path
-	 */
-	protected static function emitTrashbinPreDelete($path){
-		\OC_Hook::emit('\OCP\Trashbin', 'preDelete', array('path' => $path));
-	}
-
-	/**
-	 * wrapper function to emit the 'delete' hook of \OCP\Trashbin after a file has been deleted
-	 * @param string $path
-	 */
-	protected static function emitTrashbinPostDelete($path){
-		\OC_Hook::emit('\OCP\Trashbin', 'delete', array('path' => $path));
-	}
-
-	/**
-	 * delete file from trash bin permanently
-	 *
-	 * @param string $filename path to the file
-	 * @param string $user
-	 * @param int $timestamp of deletion time
-	 *
-	 * @return int size of deleted files
-	 */
-	public static function delete($filename, $user, $timestamp = null) {
-		$view = new View('/' . $user);
-		$size = 0;
-
-		if ($timestamp) {
-			$query = \OC_DB::prepare('DELETE FROM `*PREFIX*files_trash` WHERE `user`=? AND `id`=? AND `timestamp`=?');
-			$query->execute(array($user, $filename, $timestamp));
-			$file = $filename . '.d' . $timestamp;
-		} else {
-			$file = $filename;
-		}
-
-		$size += self::deleteVersions($view, $file, $filename, $timestamp, $user);
-
-		if ($view->is_dir('/files_trashbin/files/' . $file)) {
-			$size += self::calculateSize(new View('/' . $user . '/files_trashbin/files/' . $file));
-		} else {
-			$size += $view->filesize('/files_trashbin/files/' . $file);
-		}
-		self::emitTrashbinPreDelete('/files_trashbin/files/' . $file);
-		$view->unlink('/files_trashbin/files/' . $file);
-		self::emitTrashbinPostDelete('/files_trashbin/files/' . $file);
-
-		return $size;
-	}
-
-	/**
-	 * @param View $view
-	 * @param string $file
-	 * @param string $filename
-	 * @param integer|null $timestamp
-	 * @param string $user
-	 * @return int
-	 */
-	private static function deleteVersions(View $view, $file, $filename, $timestamp, $user) {
-		$size = 0;
-		if (\OCP\App::isEnabled('files_versions')) {
-			if ($view->is_dir('files_trashbin/versions/' . $file)) {
-				$size += self::calculateSize(new View('/' . $user . '/files_trashbin/versions/' . $file));
-				$view->unlink('files_trashbin/versions/' . $file);
-			} else if ($versions = self::getVersionsFromTrash($filename, $timestamp, $user)) {
-				foreach ($versions as $v) {
-					if ($timestamp) {
-						$size += $view->filesize('/files_trashbin/versions/' . $filename . '.v' . $v . '.d' . $timestamp);
-						$view->unlink('/files_trashbin/versions/' . $filename . '.v' . $v . '.d' . $timestamp);
-					} else {
-						$size += $view->filesize('/files_trashbin/versions/' . $filename . '.v' . $v);
-						$view->unlink('/files_trashbin/versions/' . $filename . '.v' . $v);
-					}
-				}
-			}
-		}
-		return $size;
-	}
-
-	/**
-	 * check to see whether a file exists in trashbin
-	 *
-	 * @param string $filename path to the file
-	 * @param int $timestamp of deletion time
-	 * @return bool true if file exists, otherwise false
-	 */
-	public static function file_exists($filename, $timestamp = null) {
-		$user = User::getUser();
-		$view = new View('/' . $user);
-
-		if ($timestamp) {
-			$filename = $filename . '.d' . $timestamp;
-		} else {
-			$filename = $filename;
-		}
-
-		$target = Filesystem::normalizePath('files_trashbin/files/' . $filename);
-		return $view->file_exists($target);
-	}
-
-	/**
-	 * deletes used space for trash bin in db if user was deleted
-	 *
-	 * @param string $uid id of deleted user
-	 * @return bool result of db delete operation
-	 */
-	public static function deleteUser($uid) {
-		$query = \OC_DB::prepare('DELETE FROM `*PREFIX*files_trash` WHERE `user`=?');
-		return $query->execute(array($uid));
-	}
-
-	/**
-	 * calculate remaining free space for trash bin
-	 *
-	 * @param integer $trashbinSize current size of the trash bin
-	 * @param string $user
-	 * @return int available free space for trash bin
-	 */
-	private static function calculateFreeSpace($trashbinSize, $user) {
-		$softQuota = true;
-		$userObject = \OC::$server->getUserManager()->get($user);
-		if(is_null($userObject)) {
-			return 0;
-		}
-		$quota = $userObject->getQuota();
-		if ($quota === null || $quota === 'none') {
-			$quota = Filesystem::free_space('/');
-			$softQuota = false;
-			// inf or unknown free space
-			if ($quota < 0) {
-				$quota = PHP_INT_MAX;
-			}
-		} else {
-			$quota = \OCP\Util::computerFileSize($quota);
-		}
-
-		// calculate available space for trash bin
-		// subtract size of files and current trash bin size from quota
-		if ($softQuota) {
-			$userFolder = \OC::$server->getUserFolder($user);
-			if(is_null($userFolder)) {
-				return 0;
-			}
-			$free = $quota - $userFolder->getSize(); // remaining free space for user
-			if ($free > 0) {
-				$availableSpace = ($free * self::DEFAULTMAXSIZE / 100) - $trashbinSize; // how much space can be used for versions
-			} else {
-				$availableSpace = $free - $trashbinSize;
-			}
-		} else {
-			$availableSpace = $quota;
-		}
-
-		return $availableSpace;
-	}
-
-	/**
-	 * resize trash bin if necessary after a new file was added to Nextcloud
-	 *
-	 * @param string $user user id
-	 */
-	public static function resizeTrash($user) {
-
-		$size = self::getTrashbinSize($user);
-
-		$freeSpace = self::calculateFreeSpace($size, $user);
-
-		if ($freeSpace < 0) {
-			self::scheduleExpire($user);
-		}
-	}
-
-	/**
-	 * clean up the trash bin
-	 *
-	 * @param string $user
-	 */
-	public static function expire($user) {
-		$trashBinSize = self::getTrashbinSize($user);
-		$availableSpace = self::calculateFreeSpace($trashBinSize, $user);
-
-		$dirContent = Helper::getTrashFiles('/', $user, 'mtime');
-
-		// delete all files older then $retention_obligation
-		list($delSize, $count) = self::deleteExpiredFiles($dirContent, $user);
-
-		$availableSpace += $delSize;
-
-		// delete files from trash until we meet the trash bin size limit again
-		self::deleteFiles(array_slice($dirContent, $count), $user, $availableSpace);
-	}
-
-	/**
-	 * @param string $user
-	 */
-	private static function scheduleExpire($user) {
-		// let the admin disable auto expire
-		$application = new Application();
-		$expiration = $application->getContainer()->query('Expiration');
-		if ($expiration->isEnabled()) {
-			\OC::$server->getCommandBus()->push(new Expire($user));
-		}
-	}
-
-	/**
-	 * if the size limit for the trash bin is reached, we delete the oldest
-	 * files in the trash bin until we meet the limit again
-	 *
-	 * @param array $files
-	 * @param string $user
-	 * @param int $availableSpace available disc space
-	 * @return int size of deleted files
-	 */
-	protected static function deleteFiles($files, $user, $availableSpace) {
-		$application = new Application();
-		$expiration = $application->getContainer()->query('Expiration');
-		$size = 0;
-
-		if ($availableSpace < 0) {
-			foreach ($files as $file) {
-				if ($availableSpace < 0 && $expiration->isExpired($file['mtime'], true)) {
-					$tmp = self::delete($file['name'], $user, $file['mtime']);
-					\OCP\Util::writeLog('files_trashbin', 'remove "' . $file['name'] . '" (' . $tmp . 'B) to meet the limit of trash bin size (50% of available quota)', \OCP\Util::INFO);
-					$availableSpace += $tmp;
-					$size += $tmp;
-				} else {
-					break;
-				}
-			}
-		}
-		return $size;
-	}
-
-	/**
-	 * delete files older then max storage time
-	 *
-	 * @param array $files list of files sorted by mtime
-	 * @param string $user
-	 * @return integer[] size of deleted files and number of deleted files
-	 */
-	public static function deleteExpiredFiles($files, $user) {
-		$application = new Application();
-		$expiration = $application->getContainer()->query('Expiration');
-		$size = 0;
-		$count = 0;
-		foreach ($files as $file) {
-			$timestamp = $file['mtime'];
-			$filename = $file['name'];
-			if ($expiration->isExpired($timestamp)) {
-				$count++;
-				$size += self::delete($filename, $user, $timestamp);
-				\OC::$server->getLogger()->info(
-					'Remove "' . $filename . '" from trashbin because it exceeds max retention obligation term.',
-					['app' => 'files_trashbin']
-				);
-			} else {
-				break;
-			}
-		}
-
-		return array($size, $count);
-	}
-
-	/**
-	 * recursive copy to copy a whole directory
-	 *
-	 * @param string $source source path, relative to the users files directory
-	 * @param string $destination destination path relative to the users root directoy
-	 * @param View $view file view for the users root directory
-	 * @return int
-	 * @throws Exceptions\CopyRecursiveException
-	 */
-	private static function copy_recursive($source, $destination, View $view) {
-		$size = 0;
-		if ($view->is_dir($source)) {
-			$view->mkdir($destination);
-			$view->touch($destination, $view->filemtime($source));
-			foreach ($view->getDirectoryContent($source) as $i) {
-				$pathDir = $source . '/' . $i['name'];
-				if ($view->is_dir($pathDir)) {
-					$size += self::copy_recursive($pathDir, $destination . '/' . $i['name'], $view);
-				} else {
-					$size += $view->filesize($pathDir);
-					$result = $view->copy($pathDir, $destination . '/' . $i['name']);
-					if (!$result) {
-						throw new \OCA\Files_Trashbin\Exceptions\CopyRecursiveException();
-					}
-					$view->touch($destination . '/' . $i['name'], $view->filemtime($pathDir));
-				}
-			}
-		} else {
-			$size += $view->filesize($source);
-			$result = $view->copy($source, $destination);
-			if (!$result) {
-				throw new \OCA\Files_Trashbin\Exceptions\CopyRecursiveException();
-			}
-			$view->touch($destination, $view->filemtime($source));
-		}
-		return $size;
-	}
-
-	/**
-	 * find all versions which belong to the file we want to restore
-	 *
-	 * @param string $filename name of the file which should be restored
-	 * @param int $timestamp timestamp when the file was deleted
-	 * @return array
-	 */
-	private static function getVersionsFromTrash($filename, $timestamp, $user) {
-		$view = new View('/' . $user . '/files_trashbin/versions');
-		$versions = array();
-
-		//force rescan of versions, local storage may not have updated the cache
-		if (!self::$scannedVersions) {
-			/** @var \OC\Files\Storage\Storage $storage */
-			list($storage,) = $view->resolvePath('/');
-			$storage->getScanner()->scan('files_trashbin/versions');
-			self::$scannedVersions = true;
-		}
-
-		if ($timestamp) {
-			// fetch for old versions
-			$matches = $view->searchRaw($filename . '.v%.d' . $timestamp);
-			$offset = -strlen($timestamp) - 2;
-		} else {
-			$matches = $view->searchRaw($filename . '.v%');
-		}
-
-		if (is_array($matches)) {
-			foreach ($matches as $ma) {
-				if ($timestamp) {
-					$parts = explode('.v', substr($ma['path'], 0, $offset));
-					$versions[] = (end($parts));
-				} else {
-					$parts = explode('.v', $ma);
-					$versions[] = (end($parts));
-				}
-			}
-		}
-		return $versions;
-	}
-
-	/**
-	 * find unique extension for restored file if a file with the same name already exists
-	 *
-	 * @param string $location where the file should be restored
-	 * @param string $filename name of the file
-	 * @param View $view filesystem view relative to users root directory
-	 * @return string with unique extension
-	 */
-	private static function getUniqueFilename($location, $filename, View $view) {
-		$ext = pathinfo($filename, PATHINFO_EXTENSION);
-		$name = pathinfo($filename, PATHINFO_FILENAME);
-		$l = \OC::$server->getL10N('files_trashbin');
-
-		$location = '/' . trim($location, '/');
-
-		// if extension is not empty we set a dot in front of it
-		if ($ext !== '') {
-			$ext = '.' . $ext;
-		}
-
-		if ($view->file_exists('files' . $location . '/' . $filename)) {
-			$i = 2;
-			$uniqueName = $name . " (" . $l->t("restored") . ")" . $ext;
-			while ($view->file_exists('files' . $location . '/' . $uniqueName)) {
-				$uniqueName = $name . " (" . $l->t("restored") . " " . $i . ")" . $ext;
-				$i++;
-			}
-
-			return $uniqueName;
-		}
-
-		return $filename;
-	}
-
-	/**
-	 * get the size from a given root folder
-	 *
-	 * @param View $view file view on the root folder
-	 * @return integer size of the folder
-	 */
-	private static function calculateSize($view) {
-		$root = \OC::$server->getConfig()->getSystemValue('datadirectory', \OC::$SERVERROOT . '/data') . $view->getAbsolutePath('');
-		if (!file_exists($root)) {
-			return 0;
-		}
-		$iterator = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($root), \RecursiveIteratorIterator::CHILD_FIRST);
-		$size = 0;
-
-		/**
-		 * RecursiveDirectoryIterator on an NFS path isn't iterable with foreach
-		 * This bug is fixed in PHP 5.5.9 or before
-		 * See #8376
-		 */
-		$iterator->rewind();
-		while ($iterator->valid()) {
-			$path = $iterator->current();
-			$relpath = substr($path, strlen($root) - 1);
-			if (!$view->is_dir($relpath)) {
-				$size += $view->filesize($relpath);
-			}
-			$iterator->next();
-		}
-		return $size;
-	}
-
-	/**
-	 * get current size of trash bin from a given user
-	 *
-	 * @param string $user user who owns the trash bin
-	 * @return integer trash bin size
-	 */
-	private static function getTrashbinSize($user) {
-		$view = new View('/' . $user);
-		$fileInfo = $view->getFileInfo('/files_trashbin');
-		return isset($fileInfo['size']) ? $fileInfo['size'] : 0;
-	}
-
-	/**
-	 * register hooks
-	 */
-	public static function registerHooks() {
-		// create storage wrapper on setup
-		\OCP\Util::connectHook('OC_Filesystem', 'preSetup', 'OCA\Files_Trashbin\Storage', 'setupStorage');
-		//Listen to delete user signal
-		\OCP\Util::connectHook('OC_User', 'pre_deleteUser', 'OCA\Files_Trashbin\Hooks', 'deleteUser_hook');
-		//Listen to post write hook
-		\OCP\Util::connectHook('OC_Filesystem', 'post_write', 'OCA\Files_Trashbin\Hooks', 'post_write_hook');
-		// pre and post-rename, disable trash logic for the copy+unlink case
-		\OCP\Util::connectHook('OC_Filesystem', 'delete', 'OCA\Files_Trashbin\Trashbin', 'ensureFileScannedHook');
-		\OCP\Util::connectHook('OC_Filesystem', 'rename', 'OCA\Files_Trashbin\Storage', 'preRenameHook');
-		\OCP\Util::connectHook('OC_Filesystem', 'post_rename', 'OCA\Files_Trashbin\Storage', 'postRenameHook');
-	}
-
-	/**
-	 * check if trash bin is empty for a given user
-	 *
-	 * @param string $user
-	 * @return bool
-	 */
-	public static function isEmpty($user) {
-
-		$view = new View('/' . $user . '/files_trashbin');
-		if ($view->is_dir('/files') && $dh = $view->opendir('/files')) {
-			while ($file = readdir($dh)) {
-				if (!Filesystem::isIgnoredDir($file)) {
-					return false;
-				}
-			}
-		}
-		return true;
-	}
-
-	/**
-	 * @param $path
-	 * @return string
-	 */
-	public static function preview_icon($path) {
-		return \OCP\Util::linkToRoute('core_ajax_trashbin_preview', array('x' => 32, 'y' => 32, 'file' => $path));
-	}
+    // unit: percentage; 50% of available disk space/quota
+    const DEFAULTMAXSIZE = 50;
+
+    /**
+     * Whether versions have already be rescanned during this PHP request
+     *
+     * @var bool
+     */
+    private static $scannedVersions = false;
+
+    /**
+     * Ensure we don't need to scan the file during the move to trash
+     * by triggering the scan in the pre-hook
+     *
+     * @param array $params
+     */
+    public static function ensureFileScannedHook($params) {
+        try {
+            self::getUidAndFilename($params['path']);
+        } catch (NotFoundException $e) {
+            // nothing to scan for non existing files
+        }
+    }
+
+    /**
+     * get the UID of the owner of the file and the path to the file relative to
+     * owners files folder
+     *
+     * @param string $filename
+     * @return array
+     * @throws \OC\User\NoUserException
+     */
+    public static function getUidAndFilename($filename) {
+        $uid = Filesystem::getOwner($filename);
+        $userManager = \OC::$server->getUserManager();
+        // if the user with the UID doesn't exists, e.g. because the UID points
+        // to a remote user with a federated cloud ID we use the current logged-in
+        // user. We need a valid local user to move the file to the right trash bin
+        if (!$userManager->userExists($uid)) {
+            $uid = User::getUser();
+        }
+        if (!$uid) {
+            // no owner, usually because of share link from ext storage
+            return [null, null];
+        }
+        Filesystem::initMountPoints($uid);
+        if ($uid != User::getUser()) {
+            $info = Filesystem::getFileInfo($filename);
+            $ownerView = new View('/' . $uid . '/files');
+            try {
+                $filename = $ownerView->getPath($info['fileid']);
+            } catch (NotFoundException $e) {
+                $filename = null;
+            }
+        }
+        return [$uid, $filename];
+    }
+
+    /**
+     * get original location of files for user
+     *
+     * @param string $user
+     * @return array (filename => array (timestamp => original location))
+     */
+    public static function getLocations($user) {
+        $query = \OC_DB::prepare('SELECT `id`, `timestamp`, `location`'
+            . ' FROM `*PREFIX*files_trash` WHERE `user`=?');
+        $result = $query->execute(array($user));
+        $array = array();
+        while ($row = $result->fetchRow()) {
+            if (isset($array[$row['id']])) {
+                $array[$row['id']][$row['timestamp']] = $row['location'];
+            } else {
+                $array[$row['id']] = array($row['timestamp'] => $row['location']);
+            }
+        }
+        return $array;
+    }
+
+    /**
+     * get original location of file
+     *
+     * @param string $user
+     * @param string $filename
+     * @param string $timestamp
+     * @return string original location
+     */
+    public static function getLocation($user, $filename, $timestamp) {
+        $query = \OC_DB::prepare('SELECT `location` FROM `*PREFIX*files_trash`'
+            . ' WHERE `user`=? AND `id`=? AND `timestamp`=?');
+        $result = $query->execute(array($user, $filename, $timestamp))->fetchAll();
+        if (isset($result[0]['location'])) {
+            return $result[0]['location'];
+        } else {
+            return false;
+        }
+    }
+
+    private static function setUpTrash($user) {
+        $view = new View('/' . $user);
+        if (!$view->is_dir('files_trashbin')) {
+            $view->mkdir('files_trashbin');
+        }
+        if (!$view->is_dir('files_trashbin/files')) {
+            $view->mkdir('files_trashbin/files');
+        }
+        if (!$view->is_dir('files_trashbin/versions')) {
+            $view->mkdir('files_trashbin/versions');
+        }
+        if (!$view->is_dir('files_trashbin/keys')) {
+            $view->mkdir('files_trashbin/keys');
+        }
+    }
+
+
+    /**
+     * copy file to owners trash
+     *
+     * @param string $sourcePath
+     * @param string $owner
+     * @param string $targetPath
+     * @param $user
+     * @param integer $timestamp
+     */
+    private static function copyFilesToUser($sourcePath, $owner, $targetPath, $user, $timestamp) {
+        self::setUpTrash($owner);
+
+        $targetFilename = basename($targetPath);
+        $targetLocation = dirname($targetPath);
+
+        $sourceFilename = basename($sourcePath);
+
+        $view = new View('/');
+
+        $target = $user . '/files_trashbin/files/' . $targetFilename . '.d' . $timestamp;
+        $source = $owner . '/files_trashbin/files/' . $sourceFilename . '.d' . $timestamp;
+        self::copy_recursive($source, $target, $view);
+
+
+        if ($view->file_exists($target)) {
+            $query = \OC_DB::prepare("INSERT INTO `*PREFIX*files_trash` (`id`,`timestamp`,`location`,`user`) VALUES (?,?,?,?)");
+            $result = $query->execute(array($targetFilename, $timestamp, $targetLocation, $user));
+            if (!$result) {
+                \OCP\Util::writeLog('files_trashbin', 'trash bin database couldn\'t be updated for the files owner', \OCP\Util::ERROR);
+            }
+        }
+    }
+
+
+    /**
+     * move file to the trash bin
+     *
+     * @param string $file_path path to the deleted file/directory relative to the files root directory
+     * @param bool $ownerOnly delete for owner only (if file gets moved out of a shared folder)
+     *
+     * @return bool
+     */
+    public static function move2trash($file_path, $ownerOnly = false) {
+        // get the user for which the filesystem is setup
+        $root = Filesystem::getRoot();
+        list(, $user) = explode('/', $root);
+        list($owner, $ownerPath) = self::getUidAndFilename($file_path);
+
+        // if no owner found (ex: ext storage + share link), will use the current user's trashbin then
+        if (is_null($owner)) {
+            $owner = $user;
+            $ownerPath = $file_path;
+        }
+
+        $ownerView = new View('/' . $owner);
+        // file has been deleted in between
+        if (is_null($ownerPath) || $ownerPath === '' || !$ownerView->file_exists('/files/' . $ownerPath)) {
+            return true;
+        }
+
+        self::setUpTrash($user);
+        if ($owner !== $user) {
+            // also setup for owner
+            self::setUpTrash($owner);
+        }
+
+        $path_parts = pathinfo($ownerPath);
+
+        $filename = $path_parts['basename'];
+        $location = $path_parts['dirname'];
+        $timestamp = time();
+
+        // disable proxy to prevent recursive calls
+        $trashPath = '/files_trashbin/files/' . $filename . '.d' . $timestamp;
+
+        /** @var \OC\Files\Storage\Storage $trashStorage */
+        list($trashStorage, $trashInternalPath) = $ownerView->resolvePath($trashPath);
+        /** @var \OC\Files\Storage\Storage $sourceStorage */
+        list($sourceStorage, $sourceInternalPath) = $ownerView->resolvePath('/files/' . $ownerPath);
+        try {
+            $moveSuccessful = true;
+            if ($trashStorage->file_exists($trashInternalPath)) {
+                $trashStorage->unlink($trashInternalPath);
+            }
+            $trashStorage->moveFromStorage($sourceStorage, $sourceInternalPath, $trashInternalPath);
+        } catch (\OCA\Files_Trashbin\Exceptions\CopyRecursiveException $e) {
+            $moveSuccessful = false;
+            if ($trashStorage->file_exists($trashInternalPath)) {
+                $trashStorage->unlink($trashInternalPath);
+            }
+            \OCP\Util::writeLog('files_trashbin', 'Couldn\'t move ' . $file_path . ' to the trash bin', \OCP\Util::ERROR);
+        }
+
+        if ($sourceStorage->file_exists($sourceInternalPath)) { // failed to delete the original file, abort
+            if ($sourceStorage->is_dir($sourceInternalPath)) {
+                $sourceStorage->rmdir($sourceInternalPath);
+            } else {
+                $sourceStorage->unlink($sourceInternalPath);
+            }
+            return false;
+        }
+
+        $trashStorage->getUpdater()->renameFromStorage($sourceStorage, $sourceInternalPath, $trashInternalPath);
+
+        if ($moveSuccessful) {
+            $query = \OC_DB::prepare("INSERT INTO `*PREFIX*files_trash` (`id`,`timestamp`,`location`,`user`) VALUES (?,?,?,?)");
+            $result = $query->execute(array($filename, $timestamp, $location, $owner));
+            if (!$result) {
+                \OCP\Util::writeLog('files_trashbin', 'trash bin database couldn\'t be updated', \OCP\Util::ERROR);
+            }
+            \OCP\Util::emitHook('\OCA\Files_Trashbin\Trashbin', 'post_moveToTrash', array('filePath' => Filesystem::normalizePath($file_path),
+                'trashPath' => Filesystem::normalizePath($filename . '.d' . $timestamp)));
+
+            self::retainVersions($filename, $owner, $ownerPath, $timestamp);
+
+            // if owner !== user we need to also add a copy to the users trash
+            if ($user !== $owner && $ownerOnly === false) {
+                self::copyFilesToUser($ownerPath, $owner, $file_path, $user, $timestamp);
+            }
+        }
+
+        self::scheduleExpire($user);
+
+        // if owner !== user we also need to update the owners trash size
+        if ($owner !== $user) {
+            self::scheduleExpire($owner);
+        }
+
+        return $moveSuccessful;
+    }
+
+    /**
+     * Move file versions to trash so that they can be restored later
+     *
+     * @param string $filename of deleted file
+     * @param string $owner owner user id
+     * @param string $ownerPath path relative to the owner's home storage
+     * @param integer $timestamp when the file was deleted
+     */
+    private static function retainVersions($filename, $owner, $ownerPath, $timestamp) {
+        if (\OCP\App::isEnabled('files_versions') && !empty($ownerPath)) {
+
+            $user = User::getUser();
+            $rootView = new View('/');
+
+            if ($rootView->is_dir($owner . '/files_versions/' . $ownerPath)) {
+                if ($owner !== $user) {
+                    self::copy_recursive($owner . '/files_versions/' . $ownerPath, $owner . '/files_trashbin/versions/' . basename($ownerPath) . '.d' . $timestamp, $rootView);
+                }
+                self::move($rootView, $owner . '/files_versions/' . $ownerPath, $user . '/files_trashbin/versions/' . $filename . '.d' . $timestamp);
+            } else if ($versions = \OCA\Files_Versions\Storage::getVersions($owner, $ownerPath)) {
+
+                foreach ($versions as $v) {
+                    if ($owner !== $user) {
+                        self::copy($rootView, $owner . '/files_versions' . $v['path'] . '.v' . $v['version'], $owner . '/files_trashbin/versions/' . $v['name'] . '.v' . $v['version'] . '.d' . $timestamp);
+                    }
+                    self::move($rootView, $owner . '/files_versions' . $v['path'] . '.v' . $v['version'], $user . '/files_trashbin/versions/' . $filename . '.v' . $v['version'] . '.d' . $timestamp);
+                }
+            }
+        }
+    }
+
+    /**
+     * Move a file or folder on storage level
+     *
+     * @param View $view
+     * @param string $source
+     * @param string $target
+     * @return bool
+     */
+    private static function move(View $view, $source, $target) {
+        /** @var \OC\Files\Storage\Storage $sourceStorage */
+        list($sourceStorage, $sourceInternalPath) = $view->resolvePath($source);
+        /** @var \OC\Files\Storage\Storage $targetStorage */
+        list($targetStorage, $targetInternalPath) = $view->resolvePath($target);
+        /** @var \OC\Files\Storage\Storage $ownerTrashStorage */
+
+        $result = $targetStorage->moveFromStorage($sourceStorage, $sourceInternalPath, $targetInternalPath);
+        if ($result) {
+            $targetStorage->getUpdater()->renameFromStorage($sourceStorage, $sourceInternalPath, $targetInternalPath);
+        }
+        return $result;
+    }
+
+    /**
+     * Copy a file or folder on storage level
+     *
+     * @param View $view
+     * @param string $source
+     * @param string $target
+     * @return bool
+     */
+    private static function copy(View $view, $source, $target) {
+        /** @var \OC\Files\Storage\Storage $sourceStorage */
+        list($sourceStorage, $sourceInternalPath) = $view->resolvePath($source);
+        /** @var \OC\Files\Storage\Storage $targetStorage */
+        list($targetStorage, $targetInternalPath) = $view->resolvePath($target);
+        /** @var \OC\Files\Storage\Storage $ownerTrashStorage */
+
+        $result = $targetStorage->copyFromStorage($sourceStorage, $sourceInternalPath, $targetInternalPath);
+        if ($result) {
+            $targetStorage->getUpdater()->update($targetInternalPath);
+        }
+        return $result;
+    }
+
+    /**
+     * Restore a file or folder from trash bin
+     *
+     * @param string $file path to the deleted file/folder relative to "files_trashbin/files/",
+     * including the timestamp suffix ".d12345678"
+     * @param string $filename name of the file/folder
+     * @param int $timestamp time when the file/folder was deleted
+     *
+     * @return bool true on success, false otherwise
+     */
+    public static function restore($file, $filename, $timestamp) {
+        $user = User::getUser();
+        $view = new View('/' . $user);
+
+        $location = '';
+        if ($timestamp) {
+            $location = self::getLocation($user, $filename, $timestamp);
+            if ($location === false) {
+                \OCP\Util::writeLog('files_trashbin', 'trash bin database inconsistent!', \OCP\Util::ERROR);
+            } else {
+                // if location no longer exists, restore file in the root directory
+                if ($location !== '/' &&
+                    (!$view->is_dir('files/' . $location) ||
+                        !$view->isCreatable('files/' . $location))
+                ) {
+                    $location = '';
+                }
+            }
+        }
+
+        // we need a  extension in case a file/dir with the same name already exists
+        $uniqueFilename = self::getUniqueFilename($location, $filename, $view);
+
+        $source = Filesystem::normalizePath('files_trashbin/files/' . $file);
+        $target = Filesystem::normalizePath('files/' . $location . '/' . $uniqueFilename);
+        if (!$view->file_exists($source)) {
+            return false;
+        }
+        $mtime = $view->filemtime($source);
+
+        // restore file
+        $restoreResult = $view->rename($source, $target);
+
+        // handle the restore result
+        if ($restoreResult) {
+            $fakeRoot = $view->getRoot();
+            $view->chroot('/' . $user . '/files');
+            $view->touch('/' . $location . '/' . $uniqueFilename, $mtime);
+            $view->chroot($fakeRoot);
+            \OCP\Util::emitHook('\OCA\Files_Trashbin\Trashbin', 'post_restore', array('filePath' => Filesystem::normalizePath('/' . $location . '/' . $uniqueFilename),
+                'trashPath' => Filesystem::normalizePath($file)));
+
+            self::restoreVersions($view, $file, $filename, $uniqueFilename, $location, $timestamp);
+
+            if ($timestamp) {
+                $query = \OC_DB::prepare('DELETE FROM `*PREFIX*files_trash` WHERE `user`=? AND `id`=? AND `timestamp`=?');
+                $query->execute(array($user, $filename, $timestamp));
+            }
+
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * restore versions from trash bin
+     *
+     * @param View $view file view
+     * @param string $file complete path to file
+     * @param string $filename name of file once it was deleted
+     * @param string $uniqueFilename new file name to restore the file without overwriting existing files
+     * @param string $location location if file
+     * @param int $timestamp deletion time
+     * @return false|null
+     */
+    private static function restoreVersions(View $view, $file, $filename, $uniqueFilename, $location, $timestamp) {
+
+        if (\OCP\App::isEnabled('files_versions')) {
+
+            $user = User::getUser();
+            $rootView = new View('/');
+
+            $target = Filesystem::normalizePath('/' . $location . '/' . $uniqueFilename);
+
+            list($owner, $ownerPath) = self::getUidAndFilename($target);
+
+            // file has been deleted in between
+            if (empty($ownerPath)) {
+                return false;
+            }
+
+            if ($timestamp) {
+                $versionedFile = $filename;
+            } else {
+                $versionedFile = $file;
+            }
+
+            if ($view->is_dir('/files_trashbin/versions/' . $file)) {
+                $rootView->rename(Filesystem::normalizePath($user . '/files_trashbin/versions/' . $file), Filesystem::normalizePath($owner . '/files_versions/' . $ownerPath));
+            } else if ($versions = self::getVersionsFromTrash($versionedFile, $timestamp, $user)) {
+                foreach ($versions as $v) {
+                    if ($timestamp) {
+                        $rootView->rename($user . '/files_trashbin/versions/' . $versionedFile . '.v' . $v . '.d' . $timestamp, $owner . '/files_versions/' . $ownerPath . '.v' . $v);
+                    } else {
+                        $rootView->rename($user . '/files_trashbin/versions/' . $versionedFile . '.v' . $v, $owner . '/files_versions/' . $ownerPath . '.v' . $v);
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * delete all files from the trash
+     */
+    public static function deleteAll() {
+        $user = User::getUser();
+        $view = new View('/' . $user);
+        $fileInfos = $view->getDirectoryContent('files_trashbin/files');
+
+        // Array to store the relative path in (after the file is deleted, the view won't be able to relativise the path anymore)
+        $filePaths = array();
+        foreach($fileInfos as $fileInfo){
+            $filePaths[] = $view->getRelativePath($fileInfo->getPath());
+        }
+        unset($fileInfos); // save memory
+
+        // Bulk PreDelete-Hook
+        \OC_Hook::emit('\OCP\Trashbin', 'preDeleteAll', array('paths' => $filePaths));
+
+        // Single-File Hooks
+        foreach($filePaths as $path){
+            self::emitTrashbinPreDelete($path);
+        }
+
+        // actual file deletion
+        $view->deleteAll('files_trashbin');
+        $query = \OC_DB::prepare('DELETE FROM `*PREFIX*files_trash` WHERE `user`=?');
+        $query->execute(array($user));
+
+        // Bulk PostDelete-Hook
+        \OC_Hook::emit('\OCP\Trashbin', 'deleteAll', array('paths' => $filePaths));
+
+        // Single-File Hooks
+        foreach($filePaths as $path){
+            self::emitTrashbinPostDelete($path);
+        }
+
+        $view->mkdir('files_trashbin');
+        $view->mkdir('files_trashbin/files');
+
+        return true;
+    }
+
+    /**
+     * wrapper function to emit the 'preDelete' hook of \OCP\Trashbin before a file is deleted
+     * @param string $path
+     */
+    protected static function emitTrashbinPreDelete($path){
+        \OC_Hook::emit('\OCP\Trashbin', 'preDelete', array('path' => $path));
+    }
+
+    /**
+     * wrapper function to emit the 'delete' hook of \OCP\Trashbin after a file has been deleted
+     * @param string $path
+     */
+    protected static function emitTrashbinPostDelete($path){
+        \OC_Hook::emit('\OCP\Trashbin', 'delete', array('path' => $path));
+    }
+
+    /**
+     * delete file from trash bin permanently
+     *
+     * @param string $filename path to the file
+     * @param string $user
+     * @param int $timestamp of deletion time
+     *
+     * @return int size of deleted files
+     */
+    public static function delete($filename, $user, $timestamp = null) {
+        $view = new View('/' . $user);
+        $size = 0;
+
+        if ($timestamp) {
+            $query = \OC_DB::prepare('DELETE FROM `*PREFIX*files_trash` WHERE `user`=? AND `id`=? AND `timestamp`=?');
+            $query->execute(array($user, $filename, $timestamp));
+            $file = $filename . '.d' . $timestamp;
+        } else {
+            $file = $filename;
+        }
+
+        $size += self::deleteVersions($view, $file, $filename, $timestamp, $user);
+
+        if ($view->is_dir('/files_trashbin/files/' . $file)) {
+            $size += self::calculateSize(new View('/' . $user . '/files_trashbin/files/' . $file));
+        } else {
+            $size += $view->filesize('/files_trashbin/files/' . $file);
+        }
+        self::emitTrashbinPreDelete('/files_trashbin/files/' . $file);
+        $view->unlink('/files_trashbin/files/' . $file);
+        self::emitTrashbinPostDelete('/files_trashbin/files/' . $file);
+
+        return $size;
+    }
+
+    /**
+     * @param View $view
+     * @param string $file
+     * @param string $filename
+     * @param integer|null $timestamp
+     * @param string $user
+     * @return int
+     */
+    private static function deleteVersions(View $view, $file, $filename, $timestamp, $user) {
+        $size = 0;
+        if (\OCP\App::isEnabled('files_versions')) {
+            if ($view->is_dir('files_trashbin/versions/' . $file)) {
+                $size += self::calculateSize(new View('/' . $user . '/files_trashbin/versions/' . $file));
+                $view->unlink('files_trashbin/versions/' . $file);
+            } else if ($versions = self::getVersionsFromTrash($filename, $timestamp, $user)) {
+                foreach ($versions as $v) {
+                    if ($timestamp) {
+                        $size += $view->filesize('/files_trashbin/versions/' . $filename . '.v' . $v . '.d' . $timestamp);
+                        $view->unlink('/files_trashbin/versions/' . $filename . '.v' . $v . '.d' . $timestamp);
+                    } else {
+                        $size += $view->filesize('/files_trashbin/versions/' . $filename . '.v' . $v);
+                        $view->unlink('/files_trashbin/versions/' . $filename . '.v' . $v);
+                    }
+                }
+            }
+        }
+        return $size;
+    }
+
+    /**
+     * check to see whether a file exists in trashbin
+     *
+     * @param string $filename path to the file
+     * @param int $timestamp of deletion time
+     * @return bool true if file exists, otherwise false
+     */
+    public static function file_exists($filename, $timestamp = null) {
+        $user = User::getUser();
+        $view = new View('/' . $user);
+
+        if ($timestamp) {
+            $filename = $filename . '.d' . $timestamp;
+        } else {
+            $filename = $filename;
+        }
+
+        $target = Filesystem::normalizePath('files_trashbin/files/' . $filename);
+        return $view->file_exists($target);
+    }
+
+    /**
+     * deletes used space for trash bin in db if user was deleted
+     *
+     * @param string $uid id of deleted user
+     * @return bool result of db delete operation
+     */
+    public static function deleteUser($uid) {
+        $query = \OC_DB::prepare('DELETE FROM `*PREFIX*files_trash` WHERE `user`=?');
+        return $query->execute(array($uid));
+    }
+
+    /**
+     * calculate remaining free space for trash bin
+     *
+     * @param integer $trashbinSize current size of the trash bin
+     * @param string $user
+     * @return int available free space for trash bin
+     */
+    private static function calculateFreeSpace($trashbinSize, $user) {
+        $softQuota = true;
+        $userObject = \OC::$server->getUserManager()->get($user);
+        if(is_null($userObject)) {
+            return 0;
+        }
+        $quota = $userObject->getQuota();
+        if ($quota === null || $quota === 'none') {
+            $quota = Filesystem::free_space('/');
+            $softQuota = false;
+            // inf or unknown free space
+            if ($quota < 0) {
+                $quota = PHP_INT_MAX;
+            }
+        } else {
+            $quota = \OCP\Util::computerFileSize($quota);
+        }
+
+        // calculate available space for trash bin
+        // subtract size of files and current trash bin size from quota
+        if ($softQuota) {
+            $userFolder = \OC::$server->getUserFolder($user);
+            if(is_null($userFolder)) {
+                return 0;
+            }
+            $free = $quota - $userFolder->getSize(); // remaining free space for user
+            if ($free > 0) {
+                $availableSpace = ($free * self::DEFAULTMAXSIZE / 100) - $trashbinSize; // how much space can be used for versions
+            } else {
+                $availableSpace = $free - $trashbinSize;
+            }
+        } else {
+            $availableSpace = $quota;
+        }
+
+        return $availableSpace;
+    }
+
+    /**
+     * resize trash bin if necessary after a new file was added to Nextcloud
+     *
+     * @param string $user user id
+     */
+    public static function resizeTrash($user) {
+
+        $size = self::getTrashbinSize($user);
+
+        $freeSpace = self::calculateFreeSpace($size, $user);
+
+        if ($freeSpace < 0) {
+            self::scheduleExpire($user);
+        }
+    }
+
+    /**
+     * clean up the trash bin
+     *
+     * @param string $user
+     */
+    public static function expire($user) {
+        $trashBinSize = self::getTrashbinSize($user);
+        $availableSpace = self::calculateFreeSpace($trashBinSize, $user);
+
+        $dirContent = Helper::getTrashFiles('/', $user, 'mtime');
+
+        // delete all files older then $retention_obligation
+        list($delSize, $count) = self::deleteExpiredFiles($dirContent, $user);
+
+        $availableSpace += $delSize;
+
+        // delete files from trash until we meet the trash bin size limit again
+        self::deleteFiles(array_slice($dirContent, $count), $user, $availableSpace);
+    }
+
+    /**
+     * @param string $user
+     */
+    private static function scheduleExpire($user) {
+        // let the admin disable auto expire
+        $application = new Application();
+        $expiration = $application->getContainer()->query('Expiration');
+        if ($expiration->isEnabled()) {
+            \OC::$server->getCommandBus()->push(new Expire($user));
+        }
+    }
+
+    /**
+     * if the size limit for the trash bin is reached, we delete the oldest
+     * files in the trash bin until we meet the limit again
+     *
+     * @param array $files
+     * @param string $user
+     * @param int $availableSpace available disc space
+     * @return int size of deleted files
+     */
+    protected static function deleteFiles($files, $user, $availableSpace) {
+        $application = new Application();
+        $expiration = $application->getContainer()->query('Expiration');
+        $size = 0;
+
+        if ($availableSpace < 0) {
+            foreach ($files as $file) {
+                if ($availableSpace < 0 && $expiration->isExpired($file['mtime'], true)) {
+                    $tmp = self::delete($file['name'], $user, $file['mtime']);
+                    \OCP\Util::writeLog('files_trashbin', 'remove "' . $file['name'] . '" (' . $tmp . 'B) to meet the limit of trash bin size (50% of available quota)', \OCP\Util::INFO);
+                    $availableSpace += $tmp;
+                    $size += $tmp;
+                } else {
+                    break;
+                }
+            }
+        }
+        return $size;
+    }
+
+    /**
+     * delete files older then max storage time
+     *
+     * @param array $files list of files sorted by mtime
+     * @param string $user
+     * @return integer[] size of deleted files and number of deleted files
+     */
+    public static function deleteExpiredFiles($files, $user) {
+        $application = new Application();
+        $expiration = $application->getContainer()->query('Expiration');
+        $size = 0;
+        $count = 0;
+        foreach ($files as $file) {
+            $timestamp = $file['mtime'];
+            $filename = $file['name'];
+            if ($expiration->isExpired($timestamp)) {
+                $count++;
+                $size += self::delete($filename, $user, $timestamp);
+                \OC::$server->getLogger()->info(
+                    'Remove "' . $filename . '" from trashbin because it exceeds max retention obligation term.',
+                    ['app' => 'files_trashbin']
+                );
+            } else {
+                break;
+            }
+        }
+
+        return array($size, $count);
+    }
+
+    /**
+     * recursive copy to copy a whole directory
+     *
+     * @param string $source source path, relative to the users files directory
+     * @param string $destination destination path relative to the users root directoy
+     * @param View $view file view for the users root directory
+     * @return int
+     * @throws Exceptions\CopyRecursiveException
+     */
+    private static function copy_recursive($source, $destination, View $view) {
+        $size = 0;
+        if ($view->is_dir($source)) {
+            $view->mkdir($destination);
+            $view->touch($destination, $view->filemtime($source));
+            foreach ($view->getDirectoryContent($source) as $i) {
+                $pathDir = $source . '/' . $i['name'];
+                if ($view->is_dir($pathDir)) {
+                    $size += self::copy_recursive($pathDir, $destination . '/' . $i['name'], $view);
+                } else {
+                    $size += $view->filesize($pathDir);
+                    $result = $view->copy($pathDir, $destination . '/' . $i['name']);
+                    if (!$result) {
+                        throw new \OCA\Files_Trashbin\Exceptions\CopyRecursiveException();
+                    }
+                    $view->touch($destination . '/' . $i['name'], $view->filemtime($pathDir));
+                }
+            }
+        } else {
+            $size += $view->filesize($source);
+            $result = $view->copy($source, $destination);
+            if (!$result) {
+                throw new \OCA\Files_Trashbin\Exceptions\CopyRecursiveException();
+            }
+            $view->touch($destination, $view->filemtime($source));
+        }
+        return $size;
+    }
+
+    /**
+     * find all versions which belong to the file we want to restore
+     *
+     * @param string $filename name of the file which should be restored
+     * @param int $timestamp timestamp when the file was deleted
+     * @return array
+     */
+    private static function getVersionsFromTrash($filename, $timestamp, $user) {
+        $view = new View('/' . $user . '/files_trashbin/versions');
+        $versions = array();
+
+        //force rescan of versions, local storage may not have updated the cache
+        if (!self::$scannedVersions) {
+            /** @var \OC\Files\Storage\Storage $storage */
+            list($storage,) = $view->resolvePath('/');
+            $storage->getScanner()->scan('files_trashbin/versions');
+            self::$scannedVersions = true;
+        }
+
+        if ($timestamp) {
+            // fetch for old versions
+            $matches = $view->searchRaw($filename . '.v%.d' . $timestamp);
+            $offset = -strlen($timestamp) - 2;
+        } else {
+            $matches = $view->searchRaw($filename . '.v%');
+        }
+
+        if (is_array($matches)) {
+            foreach ($matches as $ma) {
+                if ($timestamp) {
+                    $parts = explode('.v', substr($ma['path'], 0, $offset));
+                    $versions[] = (end($parts));
+                } else {
+                    $parts = explode('.v', $ma);
+                    $versions[] = (end($parts));
+                }
+            }
+        }
+        return $versions;
+    }
+
+    /**
+     * find unique extension for restored file if a file with the same name already exists
+     *
+     * @param string $location where the file should be restored
+     * @param string $filename name of the file
+     * @param View $view filesystem view relative to users root directory
+     * @return string with unique extension
+     */
+    private static function getUniqueFilename($location, $filename, View $view) {
+        $ext = pathinfo($filename, PATHINFO_EXTENSION);
+        $name = pathinfo($filename, PATHINFO_FILENAME);
+        $l = \OC::$server->getL10N('files_trashbin');
+
+        $location = '/' . trim($location, '/');
+
+        // if extension is not empty we set a dot in front of it
+        if ($ext !== '') {
+            $ext = '.' . $ext;
+        }
+
+        if ($view->file_exists('files' . $location . '/' . $filename)) {
+            $i = 2;
+            $uniqueName = $name . " (" . $l->t("restored") . ")" . $ext;
+            while ($view->file_exists('files' . $location . '/' . $uniqueName)) {
+                $uniqueName = $name . " (" . $l->t("restored") . " " . $i . ")" . $ext;
+                $i++;
+            }
+
+            return $uniqueName;
+        }
+
+        return $filename;
+    }
+
+    /**
+     * get the size from a given root folder
+     *
+     * @param View $view file view on the root folder
+     * @return integer size of the folder
+     */
+    private static function calculateSize($view) {
+        $root = \OC::$server->getConfig()->getSystemValue('datadirectory', \OC::$SERVERROOT . '/data') . $view->getAbsolutePath('');
+        if (!file_exists($root)) {
+            return 0;
+        }
+        $iterator = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($root), \RecursiveIteratorIterator::CHILD_FIRST);
+        $size = 0;
+
+        /**
+         * RecursiveDirectoryIterator on an NFS path isn't iterable with foreach
+         * This bug is fixed in PHP 5.5.9 or before
+         * See #8376
+         */
+        $iterator->rewind();
+        while ($iterator->valid()) {
+            $path = $iterator->current();
+            $relpath = substr($path, strlen($root) - 1);
+            if (!$view->is_dir($relpath)) {
+                $size += $view->filesize($relpath);
+            }
+            $iterator->next();
+        }
+        return $size;
+    }
+
+    /**
+     * get current size of trash bin from a given user
+     *
+     * @param string $user user who owns the trash bin
+     * @return integer trash bin size
+     */
+    private static function getTrashbinSize($user) {
+        $view = new View('/' . $user);
+        $fileInfo = $view->getFileInfo('/files_trashbin');
+        return isset($fileInfo['size']) ? $fileInfo['size'] : 0;
+    }
+
+    /**
+     * register hooks
+     */
+    public static function registerHooks() {
+        // create storage wrapper on setup
+        \OCP\Util::connectHook('OC_Filesystem', 'preSetup', 'OCA\Files_Trashbin\Storage', 'setupStorage');
+        //Listen to delete user signal
+        \OCP\Util::connectHook('OC_User', 'pre_deleteUser', 'OCA\Files_Trashbin\Hooks', 'deleteUser_hook');
+        //Listen to post write hook
+        \OCP\Util::connectHook('OC_Filesystem', 'post_write', 'OCA\Files_Trashbin\Hooks', 'post_write_hook');
+        // pre and post-rename, disable trash logic for the copy+unlink case
+        \OCP\Util::connectHook('OC_Filesystem', 'delete', 'OCA\Files_Trashbin\Trashbin', 'ensureFileScannedHook');
+        \OCP\Util::connectHook('OC_Filesystem', 'rename', 'OCA\Files_Trashbin\Storage', 'preRenameHook');
+        \OCP\Util::connectHook('OC_Filesystem', 'post_rename', 'OCA\Files_Trashbin\Storage', 'postRenameHook');
+    }
+
+    /**
+     * check if trash bin is empty for a given user
+     *
+     * @param string $user
+     * @return bool
+     */
+    public static function isEmpty($user) {
+
+        $view = new View('/' . $user . '/files_trashbin');
+        if ($view->is_dir('/files') && $dh = $view->opendir('/files')) {
+            while ($file = readdir($dh)) {
+                if (!Filesystem::isIgnoredDir($file)) {
+                    return false;
+                }
+            }
+        }
+        return true;
+    }
+
+    /**
+     * @param $path
+     * @return string
+     */
+    public static function preview_icon($path) {
+        return \OCP\Util::linkToRoute('core_ajax_trashbin_preview', array('x' => 32, 'y' => 32, 'file' => $path));
+    }
 }

apps/user_ldap/lib/ILDAPWrapper.php

Indentation +186 added lines, -186 removed lines

@@ -29,192 +29,192 @@
 
 interface ILDAPWrapper {
 
-	//LDAP functions in use
-
-	/**
-	 * Bind to LDAP directory
-	 * @param resource $link LDAP link resource
-	 * @param string $dn an RDN to log in with
-	 * @param string $password the password
-	 * @return bool true on success, false otherwise
-	 *
-	 * with $dn and $password as null a anonymous bind is attempted.
-	 */
-	public function bind($link, $dn, $password);
-
-	/**
-	 * connect to an LDAP server
-	 * @param string $host The host to connect to
-	 * @param string $port The port to connect to
-	 * @return mixed a link resource on success, otherwise false
-	 */
-	public function connect($host, $port);
-
-	/**
-	 * Send LDAP pagination control
-	 * @param resource $link LDAP link resource
-	 * @param int $pageSize number of results per page
-	 * @param bool $isCritical Indicates whether the pagination is critical of not.
-	 * @param string $cookie structure sent by LDAP server
-	 * @return bool true on success, false otherwise
-	 */
-	public function controlPagedResult($link, $pageSize, $isCritical, $cookie);
-
-	/**
-	 * Retrieve the LDAP pagination cookie
-	 * @param resource $link LDAP link resource
-	 * @param resource $result LDAP result resource
-	 * @param string $cookie structure sent by LDAP server
-	 * @return bool true on success, false otherwise
-	 *
-	 * Corresponds to ldap_control_paged_result_response
-	 */
-	public function controlPagedResultResponse($link, $result, &$cookie);
-
-	/**
-	 * Count the number of entries in a search
-	 * @param resource $link LDAP link resource
-	 * @param resource $result LDAP result resource
-	 * @return int|false number of results on success, false otherwise
-	 */
-	public function countEntries($link, $result);
-
-	/**
-	 * Return the LDAP error number of the last LDAP command
-	 * @param resource $link LDAP link resource
-	 * @return string error message as string
-	 */
-	public function errno($link);
-
-	/**
-	 * Return the LDAP error message of the last LDAP command
-	 * @param resource $link LDAP link resource
-	 * @return int error code as integer
-	 */
-	public function error($link);
-
-	/**
-	 * Splits DN into its component parts
-	 * @param string $dn
-	 * @param int @withAttrib
-	 * @return array|false
-	 * @link http://www.php.net/manual/en/function.ldap-explode-dn.php
-	 */
-	public function explodeDN($dn, $withAttrib);
-
-	/**
-	 * Return first result id
-	 * @param resource $link LDAP link resource
-	 * @param resource $result LDAP result resource
-	 * @return Resource an LDAP search result resource
-	 * */
-	public function firstEntry($link, $result);
-
-	/**
-	 * Get attributes from a search result entry
-	 * @param resource $link LDAP link resource
-	 * @param resource $result LDAP result resource
-	 * @return array containing the results, false on error
-	 * */
-	public function getAttributes($link, $result);
-
-	/**
-	 * Get the DN of a result entry
-	 * @param resource $link LDAP link resource
-	 * @param resource $result LDAP result resource
-	 * @return string containing the DN, false on error
-	 */
-	public function getDN($link, $result);
-
-	/**
-	 * Get all result entries
-	 * @param resource $link LDAP link resource
-	 * @param resource $result LDAP result resource
-	 * @return array containing the results, false on error
-	 */
-	public function getEntries($link, $result);
-
-	/**
-	 * Return next result id
-	 * @param resource $link LDAP link resource
-	 * @param resource $result LDAP entry result resource
-	 * @return resource an LDAP search result resource
-	 * */
-	public function nextEntry($link, $result);
-
-	/**
-	 * Read an entry
-	 * @param resource $link LDAP link resource
-	 * @param array $baseDN The DN of the entry to read from
-	 * @param string $filter An LDAP filter
-	 * @param array $attr array of the attributes to read
-	 * @return resource an LDAP search result resource
-	 */
-	public function read($link, $baseDN, $filter, $attr);
-
-	/**
-	 * Search LDAP tree
-	 * @param resource $link LDAP link resource
-	 * @param string $baseDN The DN of the entry to read from
-	 * @param string $filter An LDAP filter
-	 * @param array $attr array of the attributes to read
-	 * @param int $attrsOnly optional, 1 if only attribute types shall be returned
-	 * @param int $limit optional, limits the result entries
-	 * @return resource|false an LDAP search result resource, false on error
-	 */
-	public function search($link, $baseDN, $filter, $attr, $attrsOnly = 0, $limit = 0);
+    //LDAP functions in use
+
+    /**
+     * Bind to LDAP directory
+     * @param resource $link LDAP link resource
+     * @param string $dn an RDN to log in with
+     * @param string $password the password
+     * @return bool true on success, false otherwise
+     *
+     * with $dn and $password as null a anonymous bind is attempted.
+     */
+    public function bind($link, $dn, $password);
+
+    /**
+     * connect to an LDAP server
+     * @param string $host The host to connect to
+     * @param string $port The port to connect to
+     * @return mixed a link resource on success, otherwise false
+     */
+    public function connect($host, $port);
+
+    /**
+     * Send LDAP pagination control
+     * @param resource $link LDAP link resource
+     * @param int $pageSize number of results per page
+     * @param bool $isCritical Indicates whether the pagination is critical of not.
+     * @param string $cookie structure sent by LDAP server
+     * @return bool true on success, false otherwise
+     */
+    public function controlPagedResult($link, $pageSize, $isCritical, $cookie);
+
+    /**
+     * Retrieve the LDAP pagination cookie
+     * @param resource $link LDAP link resource
+     * @param resource $result LDAP result resource
+     * @param string $cookie structure sent by LDAP server
+     * @return bool true on success, false otherwise
+     *
+     * Corresponds to ldap_control_paged_result_response
+     */
+    public function controlPagedResultResponse($link, $result, &$cookie);
+
+    /**
+     * Count the number of entries in a search
+     * @param resource $link LDAP link resource
+     * @param resource $result LDAP result resource
+     * @return int|false number of results on success, false otherwise
+     */
+    public function countEntries($link, $result);
+
+    /**
+     * Return the LDAP error number of the last LDAP command
+     * @param resource $link LDAP link resource
+     * @return string error message as string
+     */
+    public function errno($link);
+
+    /**
+     * Return the LDAP error message of the last LDAP command
+     * @param resource $link LDAP link resource
+     * @return int error code as integer
+     */
+    public function error($link);
+
+    /**
+     * Splits DN into its component parts
+     * @param string $dn
+     * @param int @withAttrib
+     * @return array|false
+     * @link http://www.php.net/manual/en/function.ldap-explode-dn.php
+     */
+    public function explodeDN($dn, $withAttrib);
+
+    /**
+     * Return first result id
+     * @param resource $link LDAP link resource
+     * @param resource $result LDAP result resource
+     * @return Resource an LDAP search result resource
+     * */
+    public function firstEntry($link, $result);
+
+    /**
+     * Get attributes from a search result entry
+     * @param resource $link LDAP link resource
+     * @param resource $result LDAP result resource
+     * @return array containing the results, false on error
+     * */
+    public function getAttributes($link, $result);
+
+    /**
+     * Get the DN of a result entry
+     * @param resource $link LDAP link resource
+     * @param resource $result LDAP result resource
+     * @return string containing the DN, false on error
+     */
+    public function getDN($link, $result);
+
+    /**
+     * Get all result entries
+     * @param resource $link LDAP link resource
+     * @param resource $result LDAP result resource
+     * @return array containing the results, false on error
+     */
+    public function getEntries($link, $result);
+
+    /**
+     * Return next result id
+     * @param resource $link LDAP link resource
+     * @param resource $result LDAP entry result resource
+     * @return resource an LDAP search result resource
+     * */
+    public function nextEntry($link, $result);
+
+    /**
+     * Read an entry
+     * @param resource $link LDAP link resource
+     * @param array $baseDN The DN of the entry to read from
+     * @param string $filter An LDAP filter
+     * @param array $attr array of the attributes to read
+     * @return resource an LDAP search result resource
+     */
+    public function read($link, $baseDN, $filter, $attr);
+
+    /**
+     * Search LDAP tree
+     * @param resource $link LDAP link resource
+     * @param string $baseDN The DN of the entry to read from
+     * @param string $filter An LDAP filter
+     * @param array $attr array of the attributes to read
+     * @param int $attrsOnly optional, 1 if only attribute types shall be returned
+     * @param int $limit optional, limits the result entries
+     * @return resource|false an LDAP search result resource, false on error
+     */
+    public function search($link, $baseDN, $filter, $attr, $attrsOnly = 0, $limit = 0);
 	
-	/**
-	 * Replace the value of a userPassword by $password
-	 * @param resource $link LDAP link resource
-	 * @param string $userDN the DN of the user whose password is to be replaced
-	 * @param string $password the new value for the userPassword
-	 * @return bool true on success, false otherwise
-	 */
-	public function modReplace($link, $userDN, $password);
-
-	/**
-	 * Sets the value of the specified option to be $value
-	 * @param resource $link LDAP link resource
-	 * @param string $option a defined LDAP Server option
-	 * @param int $value the new value for the option
-	 * @return bool true on success, false otherwise
-	 */
-	public function setOption($link, $option, $value);
-
-	/**
-	 * establish Start TLS
-	 * @param resource $link LDAP link resource
-	 * @return bool true on success, false otherwise
-	 */
-	public function startTls($link);
-
-	/**
-	 * Unbind from LDAP directory
-	 * @param resource $link LDAP link resource
-	 * @return bool true on success, false otherwise
-	 */
-	public function unbind($link);
-
-	//additional required methods in Nextcloud
-
-	/**
-	 * Checks whether the server supports LDAP
-	 * @return bool true if it the case, false otherwise
-	 * */
-	public function areLDAPFunctionsAvailable();
-
-	/**
-	 * Checks whether PHP supports LDAP Paged Results
-	 * @return bool true if it the case, false otherwise
-	 * */
-	public function hasPagedResultSupport();
-
-	/**
-	 * Checks whether the submitted parameter is a resource
-	 * @param resource $resource the resource variable to check
-	 * @return bool true if it is a resource, false otherwise
-	 */
-	public function isResource($resource);
+    /**
+     * Replace the value of a userPassword by $password
+     * @param resource $link LDAP link resource
+     * @param string $userDN the DN of the user whose password is to be replaced
+     * @param string $password the new value for the userPassword
+     * @return bool true on success, false otherwise
+     */
+    public function modReplace($link, $userDN, $password);
+
+    /**
+     * Sets the value of the specified option to be $value
+     * @param resource $link LDAP link resource
+     * @param string $option a defined LDAP Server option
+     * @param int $value the new value for the option
+     * @return bool true on success, false otherwise
+     */
+    public function setOption($link, $option, $value);
+
+    /**
+     * establish Start TLS
+     * @param resource $link LDAP link resource
+     * @return bool true on success, false otherwise
+     */
+    public function startTls($link);
+
+    /**
+     * Unbind from LDAP directory
+     * @param resource $link LDAP link resource
+     * @return bool true on success, false otherwise
+     */
+    public function unbind($link);
+
+    //additional required methods in Nextcloud
+
+    /**
+     * Checks whether the server supports LDAP
+     * @return bool true if it the case, false otherwise
+     * */
+    public function areLDAPFunctionsAvailable();
+
+    /**
+     * Checks whether PHP supports LDAP Paged Results
+     * @return bool true if it the case, false otherwise
+     * */
+    public function hasPagedResultSupport();
+
+    /**
+     * Checks whether the submitted parameter is a resource
+     * @param resource $resource the resource variable to check
+     * @return bool true if it is a resource, false otherwise
+     */
+    public function isResource($resource);
 
 }

apps/user_ldap/lib/Command/ShowRemnants.php

Indentation +52 added lines, -52 removed lines

@@ -35,61 +35,61 @@
 use OCP\IDateTimeFormatter;
 
 class ShowRemnants extends Command {
-	/** @var \OCA\User_LDAP\User\DeletedUsersIndex */
-	protected $dui;
+    /** @var \OCA\User_LDAP\User\DeletedUsersIndex */
+    protected $dui;
 
-	/** @var \OCP\IDateTimeFormatter */
-	protected $dateFormatter;
+    /** @var \OCP\IDateTimeFormatter */
+    protected $dateFormatter;
 
-	/**
-	 * @param DeletedUsersIndex $dui
-	 * @param IDateTimeFormatter $dateFormatter
-	 */
-	public function __construct(DeletedUsersIndex $dui, IDateTimeFormatter $dateFormatter) {
-		$this->dui = $dui;
-		$this->dateFormatter = $dateFormatter;
-		parent::__construct();
-	}
+    /**
+     * @param DeletedUsersIndex $dui
+     * @param IDateTimeFormatter $dateFormatter
+     */
+    public function __construct(DeletedUsersIndex $dui, IDateTimeFormatter $dateFormatter) {
+        $this->dui = $dui;
+        $this->dateFormatter = $dateFormatter;
+        parent::__construct();
+    }
 
-	protected function configure() {
-		$this
-			->setName('ldap:show-remnants')
-			->setDescription('shows which users are not available on LDAP anymore, but have remnants in Nextcloud.')
-			->addOption('json', null, InputOption::VALUE_NONE, 'return JSON array instead of pretty table.');
-	}
+    protected function configure() {
+        $this
+            ->setName('ldap:show-remnants')
+            ->setDescription('shows which users are not available on LDAP anymore, but have remnants in Nextcloud.')
+            ->addOption('json', null, InputOption::VALUE_NONE, 'return JSON array instead of pretty table.');
+    }
 
-	/**
-	 * executes the command, i.e. creeates and outputs a table of LDAP users marked as deleted
-	 *
-	 * {@inheritdoc}
-	 */
-	protected function execute(InputInterface $input, OutputInterface $output) {
-		/** @var \Symfony\Component\Console\Helper\Table $table */
-		$table = new Table($output);
-		$table->setHeaders(array(
-			'Nextcloud name', 'Display Name', 'LDAP UID', 'LDAP DN', 'Last Login',
-			'Dir', 'Sharer'));
-		$rows = array();
-		$resultSet = $this->dui->getUsers();
-		foreach($resultSet as $user) {
-			$hAS = $user->getHasActiveShares() ? 'Y' : 'N';
-			$lastLogin = ($user->getLastLogin() > 0) ?
-				$this->dateFormatter->formatDate($user->getLastLogin()) : '-';
-			$rows[] = array('ocName'      => $user->getOCName(),
-							'displayName' => $user->getDisplayName(),
-							'uid'         => $user->getUID(),
-							'dn'          => $user->getDN(),
-							'lastLogin'   => $lastLogin,
-							'homePath'    => $user->getHomePath(),
-							'sharer'      => $hAS
-			);
-		}
+    /**
+     * executes the command, i.e. creeates and outputs a table of LDAP users marked as deleted
+     *
+     * {@inheritdoc}
+     */
+    protected function execute(InputInterface $input, OutputInterface $output) {
+        /** @var \Symfony\Component\Console\Helper\Table $table */
+        $table = new Table($output);
+        $table->setHeaders(array(
+            'Nextcloud name', 'Display Name', 'LDAP UID', 'LDAP DN', 'Last Login',
+            'Dir', 'Sharer'));
+        $rows = array();
+        $resultSet = $this->dui->getUsers();
+        foreach($resultSet as $user) {
+            $hAS = $user->getHasActiveShares() ? 'Y' : 'N';
+            $lastLogin = ($user->getLastLogin() > 0) ?
+                $this->dateFormatter->formatDate($user->getLastLogin()) : '-';
+            $rows[] = array('ocName'      => $user->getOCName(),
+                            'displayName' => $user->getDisplayName(),
+                            'uid'         => $user->getUID(),
+                            'dn'          => $user->getDN(),
+                            'lastLogin'   => $lastLogin,
+                            'homePath'    => $user->getHomePath(),
+                            'sharer'      => $hAS
+            );
+        }
 
-		if ($input->getOption('json')) {
-			$output->writeln(json_encode($rows));			
-		} else {
-			$table->setRows($rows);
-			$table->render($output);
-		}
-	}
+        if ($input->getOption('json')) {
+            $output->writeln(json_encode($rows));			
+        } else {
+            $table->setRows($rows);
+            $table->render($output);
+        }
+    }
 }