nextcloud / server

lib/private/Authentication/Token/PublicKeyTokenProvider.php

Indentation +420 added lines, -420 removed lines

@@ -46,424 +46,424 @@
 use Psr\Log\LoggerInterface;
 
 class PublicKeyTokenProvider implements IProvider {
-	use TTransactional;
-
-	/** @var PublicKeyTokenMapper */
-	private $mapper;
-
-	/** @var ICrypto */
-	private $crypto;
-
-	/** @var IConfig */
-	private $config;
-
-	private IDBConnection $db;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	/** @var ITimeFactory */
-	private $time;
-
-	/** @var CappedMemoryCache */
-	private $cache;
-
-	private IHasher $hasher;
-
-	public function __construct(PublicKeyTokenMapper $mapper,
-								ICrypto $crypto,
-								IConfig $config,
-								IDBConnection $db,
-								LoggerInterface $logger,
-								ITimeFactory $time,
-								IHasher $hasher) {
-		$this->mapper = $mapper;
-		$this->crypto = $crypto;
-		$this->config = $config;
-		$this->db = $db;
-		$this->logger = $logger;
-		$this->time = $time;
-
-		$this->cache = new CappedMemoryCache();
-		$this->hasher = $hasher;
-	}
-
-	/**
-	 * {@inheritDoc}
-	 */
-	public function generateToken(string $token,
-								  string $uid,
-								  string $loginName,
-								  ?string $password,
-								  string $name,
-								  int $type = IToken::TEMPORARY_TOKEN,
-								  int $remember = IToken::DO_NOT_REMEMBER): IToken {
-		if (mb_strlen($name) > 128) {
-			$name = mb_substr($name, 0, 120) . '…';
-		}
-
-		$dbToken = $this->newToken($token, $uid, $loginName, $password, $name, $type, $remember);
-		$this->mapper->insert($dbToken);
-
-		// Add the token to the cache
-		$this->cache[$dbToken->getToken()] = $dbToken;
-
-		return $dbToken;
-	}
-
-	public function getToken(string $tokenId): IToken {
-		$tokenHash = $this->hashToken($tokenId);
-
-		if (isset($this->cache[$tokenHash])) {
-			if ($this->cache[$tokenHash] instanceof DoesNotExistException) {
-				$ex = $this->cache[$tokenHash];
-				throw new InvalidTokenException("Token does not exist: " . $ex->getMessage(), 0, $ex);
-			}
-			$token = $this->cache[$tokenHash];
-		} else {
-			try {
-				$token = $this->mapper->getToken($this->hashToken($tokenId));
-				$this->cache[$token->getToken()] = $token;
-			} catch (DoesNotExistException $ex) {
-				try {
-					$token = $this->mapper->getToken($this->hashTokenWithEmptySecret($tokenId));
-					$this->cache[$token->getToken()] = $token;
-					$this->rotate($token, $tokenId, $tokenId);
-				} catch (DoesNotExistException $ex2) {
-					$this->cache[$tokenHash] = $ex2;
-					throw new InvalidTokenException("Token does not exist: " . $ex->getMessage(), 0, $ex);
-				}
-			}
-		}
-
-		if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
-			throw new ExpiredTokenException($token);
-		}
-
-		if ($token->getType() === IToken::WIPE_TOKEN) {
-			throw new WipeTokenException($token);
-		}
-
-		if ($token->getPasswordInvalid() === true) {
-			//The password is invalid we should throw an TokenPasswordExpiredException
-			throw new TokenPasswordExpiredException($token);
-		}
-
-		return $token;
-	}
-
-	public function getTokenById(int $tokenId): IToken {
-		try {
-			$token = $this->mapper->getTokenById($tokenId);
-		} catch (DoesNotExistException $ex) {
-			throw new InvalidTokenException("Token with ID $tokenId does not exist: " . $ex->getMessage(), 0, $ex);
-		}
-
-		if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
-			throw new ExpiredTokenException($token);
-		}
-
-		if ($token->getType() === IToken::WIPE_TOKEN) {
-			throw new WipeTokenException($token);
-		}
-
-		if ($token->getPasswordInvalid() === true) {
-			//The password is invalid we should throw an TokenPasswordExpiredException
-			throw new TokenPasswordExpiredException($token);
-		}
-
-		return $token;
-	}
-
-	public function renewSessionToken(string $oldSessionId, string $sessionId): IToken {
-		$this->cache->clear();
-
-		return $this->atomic(function () use ($oldSessionId, $sessionId) {
-			$token = $this->getToken($oldSessionId);
-
-			if (!($token instanceof PublicKeyToken)) {
-				throw new InvalidTokenException("Invalid token type");
-			}
-
-			$password = null;
-			if (!is_null($token->getPassword())) {
-				$privateKey = $this->decrypt($token->getPrivateKey(), $oldSessionId);
-				$password = $this->decryptPassword($token->getPassword(), $privateKey);
-			}
-			$newToken = $this->generateToken(
-				$sessionId,
-				$token->getUID(),
-				$token->getLoginName(),
-				$password,
-				$token->getName(),
-				IToken::TEMPORARY_TOKEN,
-				$token->getRemember()
-			);
-
-			$this->mapper->delete($token);
-
-			return $newToken;
-		}, $this->db);
-	}
-
-	public function invalidateToken(string $token) {
-		$this->cache->clear();
-
-		$this->mapper->invalidate($this->hashToken($token));
-		$this->mapper->invalidate($this->hashTokenWithEmptySecret($token));
-	}
-
-	public function invalidateTokenById(string $uid, int $id) {
-		$this->cache->clear();
-
-		$this->mapper->deleteById($uid, $id);
-	}
-
-	public function invalidateOldTokens() {
-		$this->cache->clear();
-
-		$olderThan = $this->time->getTime() - (int) $this->config->getSystemValue('session_lifetime', 60 * 60 * 24);
-		$this->logger->debug('Invalidating session tokens older than ' . date('c', $olderThan), ['app' => 'cron']);
-		$this->mapper->invalidateOld($olderThan, IToken::DO_NOT_REMEMBER);
-		$rememberThreshold = $this->time->getTime() - (int) $this->config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
-		$this->logger->debug('Invalidating remembered session tokens older than ' . date('c', $rememberThreshold), ['app' => 'cron']);
-		$this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
-	}
-
-	public function updateToken(IToken $token) {
-		$this->cache->clear();
-
-		if (!($token instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-		$this->mapper->update($token);
-	}
-
-	public function updateTokenActivity(IToken $token) {
-		$this->cache->clear();
-
-		if (!($token instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		$activityInterval = $this->config->getSystemValueInt('token_auth_activity_update', 60);
-		$activityInterval = min(max($activityInterval, 0), 300);
-
-		/** @var PublicKeyToken $token */
-		$now = $this->time->getTime();
-		if ($token->getLastActivity() < ($now - $activityInterval)) {
-			$token->setLastActivity($now);
-			$this->mapper->updateActivity($token, $now);
-		}
-	}
-
-	public function getTokenByUser(string $uid): array {
-		return $this->mapper->getTokenByUser($uid);
-	}
-
-	public function getPassword(IToken $savedToken, string $tokenId): string {
-		if (!($savedToken instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		if ($savedToken->getPassword() === null) {
-			throw new PasswordlessTokenException();
-		}
-
-		// Decrypt private key with tokenId
-		$privateKey = $this->decrypt($savedToken->getPrivateKey(), $tokenId);
-
-		// Decrypt password with private key
-		return $this->decryptPassword($savedToken->getPassword(), $privateKey);
-	}
-
-	public function setPassword(IToken $token, string $tokenId, string $password) {
-		$this->cache->clear();
-
-		if (!($token instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		// When changing passwords all temp tokens are deleted
-		$this->mapper->deleteTempToken($token);
-
-		// Update the password for all tokens
-		$tokens = $this->mapper->getTokenByUser($token->getUID());
-		foreach ($tokens as $t) {
-			$publicKey = $t->getPublicKey();
-			$t->setPassword($this->encryptPassword($password, $publicKey));
-			$t->setPasswordHash($this->hashPassword($password));
-			$this->updateToken($t);
-		}
-	}
-
-	private function hashPassword(string $password): string {
-		return $this->hasher->hash(sha1($password) . $password);
-	}
-
-	public function rotate(IToken $token, string $oldTokenId, string $newTokenId): IToken {
-		$this->cache->clear();
-
-		if (!($token instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		// Decrypt private key with oldTokenId
-		$privateKey = $this->decrypt($token->getPrivateKey(), $oldTokenId);
-		// Encrypt with the new token
-		$token->setPrivateKey($this->encrypt($privateKey, $newTokenId));
-
-		$token->setToken($this->hashToken($newTokenId));
-		$this->updateToken($token);
-
-		return $token;
-	}
-
-	private function encrypt(string $plaintext, string $token): string {
-		$secret = $this->config->getSystemValue('secret');
-		return $this->crypto->encrypt($plaintext, $token . $secret);
-	}
-
-	/**
-	 * @throws InvalidTokenException
-	 */
-	private function decrypt(string $cipherText, string $token): string {
-		$secret = $this->config->getSystemValue('secret');
-		try {
-			return $this->crypto->decrypt($cipherText, $token . $secret);
-		} catch (\Exception $ex) {
-			// Retry with empty secret as a fallback for instances where the secret might not have been set by accident
-			try {
-				return $this->crypto->decrypt($cipherText, $token);
-			} catch (\Exception $ex2) {
-				// Delete the invalid token
-				$this->invalidateToken($token);
-				throw new InvalidTokenException("Could not decrypt token password: " . $ex->getMessage(), 0, $ex2);
-			}
-		}
-	}
-
-	private function encryptPassword(string $password, string $publicKey): string {
-		openssl_public_encrypt($password, $encryptedPassword, $publicKey, OPENSSL_PKCS1_OAEP_PADDING);
-		$encryptedPassword = base64_encode($encryptedPassword);
-
-		return $encryptedPassword;
-	}
-
-	private function decryptPassword(string $encryptedPassword, string $privateKey): string {
-		$encryptedPassword = base64_decode($encryptedPassword);
-		openssl_private_decrypt($encryptedPassword, $password, $privateKey, OPENSSL_PKCS1_OAEP_PADDING);
-
-		return $password;
-	}
-
-	private function hashToken(string $token): string {
-		$secret = $this->config->getSystemValue('secret');
-		return hash('sha512', $token . $secret);
-	}
-
-	/**
-	 * @deprecated Fallback for instances where the secret might not have been set by accident
-	 */
-	private function hashTokenWithEmptySecret(string $token): string {
-		return hash('sha512', $token);
-	}
-
-	/**
-	 * @throws \RuntimeException when OpenSSL reports a problem
-	 */
-	private function newToken(string $token,
-							  string $uid,
-							  string $loginName,
-							  $password,
-							  string $name,
-							  int $type,
-							  int $remember): PublicKeyToken {
-		$dbToken = new PublicKeyToken();
-		$dbToken->setUid($uid);
-		$dbToken->setLoginName($loginName);
-
-		$config = array_merge([
-			'digest_alg' => 'sha512',
-			'private_key_bits' => $password !== null && strlen($password) > 250 ? 4096 : 2048,
-		], $this->config->getSystemValue('openssl', []));
-
-		// Generate new key
-		$res = openssl_pkey_new($config);
-		if ($res === false) {
-			$this->logOpensslError();
-			throw new \RuntimeException('OpenSSL reported a problem');
-		}
-
-		if (openssl_pkey_export($res, $privateKey, null, $config) === false) {
-			$this->logOpensslError();
-			throw new \RuntimeException('OpenSSL reported a problem');
-		}
-
-		// Extract the public key from $res to $pubKey
-		$publicKey = openssl_pkey_get_details($res);
-		$publicKey = $publicKey['key'];
-
-		$dbToken->setPublicKey($publicKey);
-		$dbToken->setPrivateKey($this->encrypt($privateKey, $token));
-
-		if (!is_null($password) && $this->config->getSystemValueBool('auth.storeCryptedPassword', true)) {
-			if (strlen($password) > IUserManager::MAX_PASSWORD_LENGTH) {
-				throw new \RuntimeException('Trying to save a password with more than 469 characters is not supported. If you want to use big passwords, disable the auth.storeCryptedPassword option in config.php');
-			}
-			$dbToken->setPassword($this->encryptPassword($password, $publicKey));
-			$dbToken->setPasswordHash($this->hashPassword($password));
-		}
-
-		$dbToken->setName($name);
-		$dbToken->setToken($this->hashToken($token));
-		$dbToken->setType($type);
-		$dbToken->setRemember($remember);
-		$dbToken->setLastActivity($this->time->getTime());
-		$dbToken->setLastCheck($this->time->getTime());
-		$dbToken->setVersion(PublicKeyToken::VERSION);
-
-		return $dbToken;
-	}
-
-	public function markPasswordInvalid(IToken $token, string $tokenId) {
-		$this->cache->clear();
-
-		if (!($token instanceof PublicKeyToken)) {
-			throw new InvalidTokenException("Invalid token type");
-		}
-
-		$token->setPasswordInvalid(true);
-		$this->mapper->update($token);
-	}
-
-	public function updatePasswords(string $uid, string $password) {
-		$this->cache->clear();
-
-		// prevent setting an empty pw as result of pw-less-login
-		if ($password === '' || !$this->config->getSystemValueBool('auth.storeCryptedPassword', true)) {
-			return;
-		}
-
-		// Update the password for all tokens
-		$tokens = $this->mapper->getTokenByUser($uid);
-		$passwordHash = $this->hashPassword($password);
-		foreach ($tokens as $t) {
-			$publicKey = $t->getPublicKey();
-			if ($t->getPasswordHash() === null || $this->hasher->verify(sha1($password) . $password, $t->getPasswordHash())) {
-				$t->setPassword($this->encryptPassword($password, $publicKey));
-				$t->setPasswordHash($passwordHash);
-				$t->setPasswordInvalid(false);
-				$this->updateToken($t);
-			}
-		}
-	}
-
-	private function logOpensslError() {
-		$errors = [];
-		while ($error = openssl_error_string()) {
-			$errors[] = $error;
-		}
-		$this->logger->critical('Something is wrong with your openssl setup: ' . implode(', ', $errors));
-	}
+    use TTransactional;
+
+    /** @var PublicKeyTokenMapper */
+    private $mapper;
+
+    /** @var ICrypto */
+    private $crypto;
+
+    /** @var IConfig */
+    private $config;
+
+    private IDBConnection $db;
+
+    /** @var LoggerInterface */
+    private $logger;
+
+    /** @var ITimeFactory */
+    private $time;
+
+    /** @var CappedMemoryCache */
+    private $cache;
+
+    private IHasher $hasher;
+
+    public function __construct(PublicKeyTokenMapper $mapper,
+                                ICrypto $crypto,
+                                IConfig $config,
+                                IDBConnection $db,
+                                LoggerInterface $logger,
+                                ITimeFactory $time,
+                                IHasher $hasher) {
+        $this->mapper = $mapper;
+        $this->crypto = $crypto;
+        $this->config = $config;
+        $this->db = $db;
+        $this->logger = $logger;
+        $this->time = $time;
+
+        $this->cache = new CappedMemoryCache();
+        $this->hasher = $hasher;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function generateToken(string $token,
+                                    string $uid,
+                                    string $loginName,
+                                  ?string $password,
+                                    string $name,
+                                    int $type = IToken::TEMPORARY_TOKEN,
+                                    int $remember = IToken::DO_NOT_REMEMBER): IToken {
+        if (mb_strlen($name) > 128) {
+            $name = mb_substr($name, 0, 120) . '…';
+        }
+
+        $dbToken = $this->newToken($token, $uid, $loginName, $password, $name, $type, $remember);
+        $this->mapper->insert($dbToken);
+
+        // Add the token to the cache
+        $this->cache[$dbToken->getToken()] = $dbToken;
+
+        return $dbToken;
+    }
+
+    public function getToken(string $tokenId): IToken {
+        $tokenHash = $this->hashToken($tokenId);
+
+        if (isset($this->cache[$tokenHash])) {
+            if ($this->cache[$tokenHash] instanceof DoesNotExistException) {
+                $ex = $this->cache[$tokenHash];
+                throw new InvalidTokenException("Token does not exist: " . $ex->getMessage(), 0, $ex);
+            }
+            $token = $this->cache[$tokenHash];
+        } else {
+            try {
+                $token = $this->mapper->getToken($this->hashToken($tokenId));
+                $this->cache[$token->getToken()] = $token;
+            } catch (DoesNotExistException $ex) {
+                try {
+                    $token = $this->mapper->getToken($this->hashTokenWithEmptySecret($tokenId));
+                    $this->cache[$token->getToken()] = $token;
+                    $this->rotate($token, $tokenId, $tokenId);
+                } catch (DoesNotExistException $ex2) {
+                    $this->cache[$tokenHash] = $ex2;
+                    throw new InvalidTokenException("Token does not exist: " . $ex->getMessage(), 0, $ex);
+                }
+            }
+        }
+
+        if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
+            throw new ExpiredTokenException($token);
+        }
+
+        if ($token->getType() === IToken::WIPE_TOKEN) {
+            throw new WipeTokenException($token);
+        }
+
+        if ($token->getPasswordInvalid() === true) {
+            //The password is invalid we should throw an TokenPasswordExpiredException
+            throw new TokenPasswordExpiredException($token);
+        }
+
+        return $token;
+    }
+
+    public function getTokenById(int $tokenId): IToken {
+        try {
+            $token = $this->mapper->getTokenById($tokenId);
+        } catch (DoesNotExistException $ex) {
+            throw new InvalidTokenException("Token with ID $tokenId does not exist: " . $ex->getMessage(), 0, $ex);
+        }
+
+        if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
+            throw new ExpiredTokenException($token);
+        }
+
+        if ($token->getType() === IToken::WIPE_TOKEN) {
+            throw new WipeTokenException($token);
+        }
+
+        if ($token->getPasswordInvalid() === true) {
+            //The password is invalid we should throw an TokenPasswordExpiredException
+            throw new TokenPasswordExpiredException($token);
+        }
+
+        return $token;
+    }
+
+    public function renewSessionToken(string $oldSessionId, string $sessionId): IToken {
+        $this->cache->clear();
+
+        return $this->atomic(function () use ($oldSessionId, $sessionId) {
+            $token = $this->getToken($oldSessionId);
+
+            if (!($token instanceof PublicKeyToken)) {
+                throw new InvalidTokenException("Invalid token type");
+            }
+
+            $password = null;
+            if (!is_null($token->getPassword())) {
+                $privateKey = $this->decrypt($token->getPrivateKey(), $oldSessionId);
+                $password = $this->decryptPassword($token->getPassword(), $privateKey);
+            }
+            $newToken = $this->generateToken(
+                $sessionId,
+                $token->getUID(),
+                $token->getLoginName(),
+                $password,
+                $token->getName(),
+                IToken::TEMPORARY_TOKEN,
+                $token->getRemember()
+            );
+
+            $this->mapper->delete($token);
+
+            return $newToken;
+        }, $this->db);
+    }
+
+    public function invalidateToken(string $token) {
+        $this->cache->clear();
+
+        $this->mapper->invalidate($this->hashToken($token));
+        $this->mapper->invalidate($this->hashTokenWithEmptySecret($token));
+    }
+
+    public function invalidateTokenById(string $uid, int $id) {
+        $this->cache->clear();
+
+        $this->mapper->deleteById($uid, $id);
+    }
+
+    public function invalidateOldTokens() {
+        $this->cache->clear();
+
+        $olderThan = $this->time->getTime() - (int) $this->config->getSystemValue('session_lifetime', 60 * 60 * 24);
+        $this->logger->debug('Invalidating session tokens older than ' . date('c', $olderThan), ['app' => 'cron']);
+        $this->mapper->invalidateOld($olderThan, IToken::DO_NOT_REMEMBER);
+        $rememberThreshold = $this->time->getTime() - (int) $this->config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
+        $this->logger->debug('Invalidating remembered session tokens older than ' . date('c', $rememberThreshold), ['app' => 'cron']);
+        $this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
+    }
+
+    public function updateToken(IToken $token) {
+        $this->cache->clear();
+
+        if (!($token instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+        $this->mapper->update($token);
+    }
+
+    public function updateTokenActivity(IToken $token) {
+        $this->cache->clear();
+
+        if (!($token instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        $activityInterval = $this->config->getSystemValueInt('token_auth_activity_update', 60);
+        $activityInterval = min(max($activityInterval, 0), 300);
+
+        /** @var PublicKeyToken $token */
+        $now = $this->time->getTime();
+        if ($token->getLastActivity() < ($now - $activityInterval)) {
+            $token->setLastActivity($now);
+            $this->mapper->updateActivity($token, $now);
+        }
+    }
+
+    public function getTokenByUser(string $uid): array {
+        return $this->mapper->getTokenByUser($uid);
+    }
+
+    public function getPassword(IToken $savedToken, string $tokenId): string {
+        if (!($savedToken instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        if ($savedToken->getPassword() === null) {
+            throw new PasswordlessTokenException();
+        }
+
+        // Decrypt private key with tokenId
+        $privateKey = $this->decrypt($savedToken->getPrivateKey(), $tokenId);
+
+        // Decrypt password with private key
+        return $this->decryptPassword($savedToken->getPassword(), $privateKey);
+    }
+
+    public function setPassword(IToken $token, string $tokenId, string $password) {
+        $this->cache->clear();
+
+        if (!($token instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        // When changing passwords all temp tokens are deleted
+        $this->mapper->deleteTempToken($token);
+
+        // Update the password for all tokens
+        $tokens = $this->mapper->getTokenByUser($token->getUID());
+        foreach ($tokens as $t) {
+            $publicKey = $t->getPublicKey();
+            $t->setPassword($this->encryptPassword($password, $publicKey));
+            $t->setPasswordHash($this->hashPassword($password));
+            $this->updateToken($t);
+        }
+    }
+
+    private function hashPassword(string $password): string {
+        return $this->hasher->hash(sha1($password) . $password);
+    }
+
+    public function rotate(IToken $token, string $oldTokenId, string $newTokenId): IToken {
+        $this->cache->clear();
+
+        if (!($token instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        // Decrypt private key with oldTokenId
+        $privateKey = $this->decrypt($token->getPrivateKey(), $oldTokenId);
+        // Encrypt with the new token
+        $token->setPrivateKey($this->encrypt($privateKey, $newTokenId));
+
+        $token->setToken($this->hashToken($newTokenId));
+        $this->updateToken($token);
+
+        return $token;
+    }
+
+    private function encrypt(string $plaintext, string $token): string {
+        $secret = $this->config->getSystemValue('secret');
+        return $this->crypto->encrypt($plaintext, $token . $secret);
+    }
+
+    /**
+     * @throws InvalidTokenException
+     */
+    private function decrypt(string $cipherText, string $token): string {
+        $secret = $this->config->getSystemValue('secret');
+        try {
+            return $this->crypto->decrypt($cipherText, $token . $secret);
+        } catch (\Exception $ex) {
+            // Retry with empty secret as a fallback for instances where the secret might not have been set by accident
+            try {
+                return $this->crypto->decrypt($cipherText, $token);
+            } catch (\Exception $ex2) {
+                // Delete the invalid token
+                $this->invalidateToken($token);
+                throw new InvalidTokenException("Could not decrypt token password: " . $ex->getMessage(), 0, $ex2);
+            }
+        }
+    }
+
+    private function encryptPassword(string $password, string $publicKey): string {
+        openssl_public_encrypt($password, $encryptedPassword, $publicKey, OPENSSL_PKCS1_OAEP_PADDING);
+        $encryptedPassword = base64_encode($encryptedPassword);
+
+        return $encryptedPassword;
+    }
+
+    private function decryptPassword(string $encryptedPassword, string $privateKey): string {
+        $encryptedPassword = base64_decode($encryptedPassword);
+        openssl_private_decrypt($encryptedPassword, $password, $privateKey, OPENSSL_PKCS1_OAEP_PADDING);
+
+        return $password;
+    }
+
+    private function hashToken(string $token): string {
+        $secret = $this->config->getSystemValue('secret');
+        return hash('sha512', $token . $secret);
+    }
+
+    /**
+     * @deprecated Fallback for instances where the secret might not have been set by accident
+     */
+    private function hashTokenWithEmptySecret(string $token): string {
+        return hash('sha512', $token);
+    }
+
+    /**
+     * @throws \RuntimeException when OpenSSL reports a problem
+     */
+    private function newToken(string $token,
+                                string $uid,
+                                string $loginName,
+                                $password,
+                                string $name,
+                                int $type,
+                                int $remember): PublicKeyToken {
+        $dbToken = new PublicKeyToken();
+        $dbToken->setUid($uid);
+        $dbToken->setLoginName($loginName);
+
+        $config = array_merge([
+            'digest_alg' => 'sha512',
+            'private_key_bits' => $password !== null && strlen($password) > 250 ? 4096 : 2048,
+        ], $this->config->getSystemValue('openssl', []));
+
+        // Generate new key
+        $res = openssl_pkey_new($config);
+        if ($res === false) {
+            $this->logOpensslError();
+            throw new \RuntimeException('OpenSSL reported a problem');
+        }
+
+        if (openssl_pkey_export($res, $privateKey, null, $config) === false) {
+            $this->logOpensslError();
+            throw new \RuntimeException('OpenSSL reported a problem');
+        }
+
+        // Extract the public key from $res to $pubKey
+        $publicKey = openssl_pkey_get_details($res);
+        $publicKey = $publicKey['key'];
+
+        $dbToken->setPublicKey($publicKey);
+        $dbToken->setPrivateKey($this->encrypt($privateKey, $token));
+
+        if (!is_null($password) && $this->config->getSystemValueBool('auth.storeCryptedPassword', true)) {
+            if (strlen($password) > IUserManager::MAX_PASSWORD_LENGTH) {
+                throw new \RuntimeException('Trying to save a password with more than 469 characters is not supported. If you want to use big passwords, disable the auth.storeCryptedPassword option in config.php');
+            }
+            $dbToken->setPassword($this->encryptPassword($password, $publicKey));
+            $dbToken->setPasswordHash($this->hashPassword($password));
+        }
+
+        $dbToken->setName($name);
+        $dbToken->setToken($this->hashToken($token));
+        $dbToken->setType($type);
+        $dbToken->setRemember($remember);
+        $dbToken->setLastActivity($this->time->getTime());
+        $dbToken->setLastCheck($this->time->getTime());
+        $dbToken->setVersion(PublicKeyToken::VERSION);
+
+        return $dbToken;
+    }
+
+    public function markPasswordInvalid(IToken $token, string $tokenId) {
+        $this->cache->clear();
+
+        if (!($token instanceof PublicKeyToken)) {
+            throw new InvalidTokenException("Invalid token type");
+        }
+
+        $token->setPasswordInvalid(true);
+        $this->mapper->update($token);
+    }
+
+    public function updatePasswords(string $uid, string $password) {
+        $this->cache->clear();
+
+        // prevent setting an empty pw as result of pw-less-login
+        if ($password === '' || !$this->config->getSystemValueBool('auth.storeCryptedPassword', true)) {
+            return;
+        }
+
+        // Update the password for all tokens
+        $tokens = $this->mapper->getTokenByUser($uid);
+        $passwordHash = $this->hashPassword($password);
+        foreach ($tokens as $t) {
+            $publicKey = $t->getPublicKey();
+            if ($t->getPasswordHash() === null || $this->hasher->verify(sha1($password) . $password, $t->getPasswordHash())) {
+                $t->setPassword($this->encryptPassword($password, $publicKey));
+                $t->setPasswordHash($passwordHash);
+                $t->setPasswordInvalid(false);
+                $this->updateToken($t);
+            }
+        }
+    }
+
+    private function logOpensslError() {
+        $errors = [];
+        while ($error = openssl_error_string()) {
+            $errors[] = $error;
+        }
+        $this->logger->critical('Something is wrong with your openssl setup: ' . implode(', ', $errors));
+    }
 }

lib/private/Authentication/Token/PublicKeyToken.php

Indentation +188 added lines, -188 removed lines

@@ -49,192 +49,192 @@
  * @method setPasswordHash(string $hash)
  */
 class PublicKeyToken extends Entity implements INamedToken, IWipeableToken {
-	public const VERSION = 2;
-
-	/** @var string user UID */
-	protected $uid;
-
-	/** @var string login name used for generating the token */
-	protected $loginName;
-
-	/** @var string encrypted user password */
-	protected $password;
-
-	/** @var string hashed user password */
-	protected $passwordHash;
-
-	/** @var string token name (e.g. browser/OS) */
-	protected $name;
-
-	/** @var string */
-	protected $token;
-
-	/** @var int */
-	protected $type;
-
-	/** @var int */
-	protected $remember;
-
-	/** @var int */
-	protected $lastActivity;
-
-	/** @var int */
-	protected $lastCheck;
-
-	/** @var string */
-	protected $scope;
-
-	/** @var int */
-	protected $expires;
-
-	/** @var string */
-	protected $privateKey;
-
-	/** @var string */
-	protected $publicKey;
-
-	/** @var int */
-	protected $version;
-
-	/** @var bool */
-	protected $passwordInvalid;
-
-	public function __construct() {
-		$this->addType('uid', 'string');
-		$this->addType('loginName', 'string');
-		$this->addType('password', 'string');
-		$this->addType('passwordHash', 'string');
-		$this->addType('name', 'string');
-		$this->addType('token', 'string');
-		$this->addType('type', 'int');
-		$this->addType('remember', 'int');
-		$this->addType('lastActivity', 'int');
-		$this->addType('lastCheck', 'int');
-		$this->addType('scope', 'string');
-		$this->addType('expires', 'int');
-		$this->addType('publicKey', 'string');
-		$this->addType('privateKey', 'string');
-		$this->addType('version', 'int');
-		$this->addType('passwordInvalid', 'bool');
-	}
-
-	public function getId(): int {
-		return $this->id;
-	}
-
-	public function getUID(): string {
-		return $this->uid;
-	}
-
-	/**
-	 * Get the login name used when generating the token
-	 *
-	 * @return string
-	 */
-	public function getLoginName(): string {
-		return parent::getLoginName();
-	}
-
-	/**
-	 * Get the (encrypted) login password
-	 *
-	 * @return string|null
-	 */
-	public function getPassword() {
-		return parent::getPassword();
-	}
-
-	public function jsonSerialize(): array {
-		return [
-			'id' => $this->id,
-			'name' => $this->name,
-			'lastActivity' => $this->lastActivity,
-			'type' => $this->type,
-			'scope' => $this->getScopeAsArray()
-		];
-	}
-
-	/**
-	 * Get the timestamp of the last password check
-	 *
-	 * @return int
-	 */
-	public function getLastCheck(): int {
-		return parent::getLastCheck();
-	}
-
-	/**
-	 * Get the timestamp of the last password check
-	 *
-	 * @param int $time
-	 */
-	public function setLastCheck(int $time) {
-		parent::setLastCheck($time);
-	}
-
-	public function getScope(): string {
-		$scope = parent::getScope();
-		if ($scope === null) {
-			return '';
-		}
-
-		return $scope;
-	}
-
-	public function getScopeAsArray(): array {
-		$scope = json_decode($this->getScope(), true);
-		if (!$scope) {
-			return [
-				'filesystem' => true
-			];
-		}
-		return $scope;
-	}
-
-	public function setScope($scope) {
-		if (is_array($scope)) {
-			parent::setScope(json_encode($scope));
-		} else {
-			parent::setScope((string)$scope);
-		}
-	}
-
-	public function getName(): string {
-		return parent::getName();
-	}
-
-	public function setName(string $name): void {
-		parent::setName($name);
-	}
-
-	public function getRemember(): int {
-		return parent::getRemember();
-	}
-
-	public function setToken(string $token) {
-		parent::setToken($token);
-	}
-
-	public function setPassword(string $password = null) {
-		parent::setPassword($password);
-	}
-
-	public function setExpires($expires) {
-		parent::setExpires($expires);
-	}
-
-	/**
-	 * @return int|null
-	 */
-	public function getExpires() {
-		return parent::getExpires();
-	}
-
-	public function setPasswordInvalid(bool $invalid) {
-		parent::setPasswordInvalid($invalid);
-	}
-
-	public function wipe(): void {
-		parent::setType(IToken::WIPE_TOKEN);
-	}
+    public const VERSION = 2;
+
+    /** @var string user UID */
+    protected $uid;
+
+    /** @var string login name used for generating the token */
+    protected $loginName;
+
+    /** @var string encrypted user password */
+    protected $password;
+
+    /** @var string hashed user password */
+    protected $passwordHash;
+
+    /** @var string token name (e.g. browser/OS) */
+    protected $name;
+
+    /** @var string */
+    protected $token;
+
+    /** @var int */
+    protected $type;
+
+    /** @var int */
+    protected $remember;
+
+    /** @var int */
+    protected $lastActivity;
+
+    /** @var int */
+    protected $lastCheck;
+
+    /** @var string */
+    protected $scope;
+
+    /** @var int */
+    protected $expires;
+
+    /** @var string */
+    protected $privateKey;
+
+    /** @var string */
+    protected $publicKey;
+
+    /** @var int */
+    protected $version;
+
+    /** @var bool */
+    protected $passwordInvalid;
+
+    public function __construct() {
+        $this->addType('uid', 'string');
+        $this->addType('loginName', 'string');
+        $this->addType('password', 'string');
+        $this->addType('passwordHash', 'string');
+        $this->addType('name', 'string');
+        $this->addType('token', 'string');
+        $this->addType('type', 'int');
+        $this->addType('remember', 'int');
+        $this->addType('lastActivity', 'int');
+        $this->addType('lastCheck', 'int');
+        $this->addType('scope', 'string');
+        $this->addType('expires', 'int');
+        $this->addType('publicKey', 'string');
+        $this->addType('privateKey', 'string');
+        $this->addType('version', 'int');
+        $this->addType('passwordInvalid', 'bool');
+    }
+
+    public function getId(): int {
+        return $this->id;
+    }
+
+    public function getUID(): string {
+        return $this->uid;
+    }
+
+    /**
+     * Get the login name used when generating the token
+     *
+     * @return string
+     */
+    public function getLoginName(): string {
+        return parent::getLoginName();
+    }
+
+    /**
+     * Get the (encrypted) login password
+     *
+     * @return string|null
+     */
+    public function getPassword() {
+        return parent::getPassword();
+    }
+
+    public function jsonSerialize(): array {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'lastActivity' => $this->lastActivity,
+            'type' => $this->type,
+            'scope' => $this->getScopeAsArray()
+        ];
+    }
+
+    /**
+     * Get the timestamp of the last password check
+     *
+     * @return int
+     */
+    public function getLastCheck(): int {
+        return parent::getLastCheck();
+    }
+
+    /**
+     * Get the timestamp of the last password check
+     *
+     * @param int $time
+     */
+    public function setLastCheck(int $time) {
+        parent::setLastCheck($time);
+    }
+
+    public function getScope(): string {
+        $scope = parent::getScope();
+        if ($scope === null) {
+            return '';
+        }
+
+        return $scope;
+    }
+
+    public function getScopeAsArray(): array {
+        $scope = json_decode($this->getScope(), true);
+        if (!$scope) {
+            return [
+                'filesystem' => true
+            ];
+        }
+        return $scope;
+    }
+
+    public function setScope($scope) {
+        if (is_array($scope)) {
+            parent::setScope(json_encode($scope));
+        } else {
+            parent::setScope((string)$scope);
+        }
+    }
+
+    public function getName(): string {
+        return parent::getName();
+    }
+
+    public function setName(string $name): void {
+        parent::setName($name);
+    }
+
+    public function getRemember(): int {
+        return parent::getRemember();
+    }
+
+    public function setToken(string $token) {
+        parent::setToken($token);
+    }
+
+    public function setPassword(string $password = null) {
+        parent::setPassword($password);
+    }
+
+    public function setExpires($expires) {
+        parent::setExpires($expires);
+    }
+
+    /**
+     * @return int|null
+     */
+    public function getExpires() {
+        return parent::getExpires();
+    }
+
+    public function setPasswordInvalid(bool $invalid) {
+        parent::setPasswordInvalid($invalid);
+    }
+
+    public function wipe(): void {
+        parent::setType(IToken::WIPE_TOKEN);
+    }
 }

core/Migrations/Version25000Date20220905140840.php

Indentation +19 added lines, -19 removed lines

@@ -34,24 +34,24 @@
 
 class Version25000Date20220905140840 extends SimpleMigrationStep {
 
-	/**
-	 * @param IOutput $output
-	 * @param Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
-	 * @param array $options
-	 * @return null|ISchemaWrapper
-	 */
-	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
-		/** @var ISchemaWrapper $schema */
-		$schema = $schemaClosure();
+    /**
+     * @param IOutput $output
+     * @param Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
+     * @param array $options
+     * @return null|ISchemaWrapper
+     */
+    public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+        /** @var ISchemaWrapper $schema */
+        $schema = $schemaClosure();
 
-		$authTokenTable = $schema->getTable('authtoken');
-		if (!$authTokenTable->hasColumn('password_hash')) {
-			$authTokenTable->addColumn('password_hash', Types::STRING, [
-				'notnull' => false,
-				'length' => 255,
-			]);
-			return $schema;
-		}
-		return null;
-	}
+        $authTokenTable = $schema->getTable('authtoken');
+        if (!$authTokenTable->hasColumn('password_hash')) {
+            $authTokenTable->addColumn('password_hash', Types::STRING, [
+                'notnull' => false,
+                'length' => 255,
+            ]);
+            return $schema;
+        }
+        return null;
+    }
 }