diff --git a/apps/files_encryption/hooks/hooks.php b/apps/files_encryption/hooks/hooks.php index d1b08a0b9788d9261b1a01decd384f5b917d6d86..c4b247da1edba153e2fcf41720626e89b1ae50c6 100644 --- a/apps/files_encryption/hooks/hooks.php +++ b/apps/files_encryption/hooks/hooks.php @@ -141,6 +141,15 @@ class Hooks { \OC_FileProxy::$enabled = $proxyStatus; } + /** + * @brief If the password can't be changed within ownCloud, than update the key password in advance. + */ + public static function preSetPassphrase($params) { + if ( ! \OC_User::canUserChangePassword($params['uid']) ) { + self::setPassphrase($params); + } + } + /** * @brief Change a user's encryption passphrase * @param array $params keys: uid, password diff --git a/apps/files_encryption/lib/helper.php b/apps/files_encryption/lib/helper.php index e078ab35541154fee450f6840dde17ba607e4e93..184e1782494912753cef197f2cbf998f6f401036 100755 --- a/apps/files_encryption/lib/helper.php +++ b/apps/files_encryption/lib/helper.php @@ -48,6 +48,7 @@ class Helper { \OCP\Util::connectHook('OC_User', 'post_login', 'OCA\Encryption\Hooks', 'login'); \OCP\Util::connectHook('OC_User', 'post_setPassword', 'OCA\Encryption\Hooks', 'setPassphrase'); + \OCP\Util::connectHook('OC_User', 'pre_setPassword', 'OCA\Encryption\Hooks', 'preSetPassphrase'); \OCP\Util::connectHook('OC_User', 'post_createUser', 'OCA\Encryption\Hooks', 'postCreateUser'); \OCP\Util::connectHook('OC_User', 'post_deleteUser', 'OCA\Encryption\Hooks', 'postDeleteUser'); } diff --git a/lib/user/user.php b/lib/user/user.php index f9466b71499ff638e8d10e9293839b8d8bc77983..55d7848a979c80e8b229cb41949e22f979709ad3 100644 --- a/lib/user/user.php +++ b/lib/user/user.php @@ -131,10 +131,10 @@ class User { * @return bool */ public function setPassword($password, $recoveryPassword) { + if ($this->emitter) { + $this->emitter->emit('\OC\User', 'preSetPassword', array($this, $password, $recoveryPassword)); + } if ($this->backend->implementsActions(\OC_USER_BACKEND_SET_PASSWORD)) { - if ($this->emitter) { - $this->emitter->emit('\OC\User', 'preSetPassword', array($this, $password, $recoveryPassword)); - } $result = $this->backend->setPassword($this->uid, $password); if ($this->emitter) { $this->emitter->emit('\OC\User', 'postSetPassword', array($this, $password, $recoveryPassword)); diff --git a/settings/ajax/changepassword.php b/settings/ajax/changepassword.php index cb66c57c743bcb9fc4fcb9bfb5bbff50a0b9753d..308778105503ec286a5e634936e4c10db0ef4d2b 100644 --- a/settings/ajax/changepassword.php +++ b/settings/ajax/changepassword.php @@ -28,17 +28,29 @@ if(is_null($userstatus)) { exit(); } -$util = new \OCA\Encryption\Util(new \OC_FilesystemView('/'), $username); $recoveryAdminEnabled = OC_Appconfig::getValue( 'files_encryption', 'recoveryAdminEnabled' ); -$recoveryEnabledForUser = $util->recoveryEnabledForUser(); -if ($recoveryAdminEnabled && $recoveryEnabledForUser && $recoveryPassword == '') { + +$validRecoveryPassword = false; +$recoveryPasswordSupported = false; + +if ($recoveryAdminEnabled) { + $util = new \OCA\Encryption\Util(new \OC_FilesystemView('/'), $username); + $validRecoveryPassword = $util->checkRecoveryPassword($recoveryPassword); + $recoveryPasswordSupported = $util->recoveryEnabledForUser(); +} + +if ($recoveryPasswordSupported && $recoveryPassword == '') { OC_JSON::error(array("data" => array( "message" => "Please provide a admin recovery password, otherwise all user data will be lost" ))); -}elseif ( $recoveryPassword && ! $util->checkRecoveryPassword($recoveryPassword) ) { +} elseif ( $recoveryPasswordSupported && ! $validRecoveryPassword) { OC_JSON::error(array("data" => array( "message" => "Wrong admin recovery password. Please check the password and try again." ))); -}elseif(!is_null($password) && OC_User::setPassword( $username, $password, $recoveryPassword )) { - OC_JSON::success(array("data" => array( "username" => $username ))); -} -else{ - OC_JSON::error(array("data" => array( "message" => "Unable to change password" ))); +} else { // now we know that everything is file regarding the recovery password, let's try to change the password + $result = OC_User::setPassword($username, $password, $recoveryPassword); + if (!$result && $recoveryPasswordSupported) { + OC_JSON::error(array("data" => array( "message" => "Back-end doesn't support password change, but the users encryption key was successfully updated." ))); + } elseif (!$result && !$recoveryPasswordSupported) { + OC_JSON::error(array("data" => array( "message" => "Unable to change password" ))); + } else { + OC_JSON::success(array("data" => array( "username" => $username ))); + } } diff --git a/settings/templates/users.php b/settings/templates/users.php index a6df85983dd6c52e7ac67c10ae93c3fce7bb0c11..b0637814f5de533df5b87f676b6e7df6fedb4eee 100644 --- a/settings/templates/users.php +++ b/settings/templates/users.php @@ -31,7 +31,11 @@ $_['subadmingroups'] = array_flip($items); </form> <?php if((bool)$_['recoveryAdminEnabled']): ?> <div class="recoveryPassword"> - <input id="recoveryPassword" type="password" placeholder="<?php p($l->t('Admin Recovery Password'))?>" /> + <input id="recoveryPassword" + type="password" + placeholder="<?php p($l->t('Admin Recovery Password'))?>" + title="<?php p($l->t('Enter the recovery password in order to recover the users files during password change'))?>" + alt="<?php p($l->t('Enter the recovery password in order to recover the users files during password change'))?>"/> </div> <?php endif; ?> <div class="quota">