fix can change password check in case of encryption is enabled by schiessle · Pull Request #13172 · nextcloud/server

schiessle · 2018-12-20T10:34:50Z

Admin should not be able to change password when:

if an encryption module is loaded and it uses per-user keys
if encryption is enabled but no encryption modules are loaded

Admin should be able to change the password when:

no encryption module is loaded and encryption is disabled
encryption module is loaded but it doesn't require per user keys

skjnldsv · 2018-12-20T10:41:35Z

+ $isEncryptionModuleLoaded = false;
+ }
+
 // If masterKey enabled, then you can change password. This is to avoid data loss!


Are the comments still accurate?

more or less yes, but let me update the comment and add some more details

schiessle · 2018-12-20T10:42:36Z

This makes it easier for people to disable encryption completely and be able to change passwords again as a admin. Also for example, if they just enabled the "default encryption module" app by accident but never really turned on server side encryption.

Of course this carries one (small) risk:
You could imagine a installation where encryption was enabled and files are encrypted with per user keys. Now the admin disables both SSE and the default encryption modules, changes passwords and now realize that they have to enable the default encryption module again to let the user still decrypt old encrypted files. In this case the user can still adjust the private key password in the personal settings if they remember the old password so maybe this is acceptable.

schiessle · 2018-12-20T10:51:21Z

I will move this check to a separate function so that we can write some tests for it... done ✔️

Admin should _not_ be able to change password when: - if an encryption module is loaded and it uses per-user keys - if encryption is enabled but no encryption modules are loaded Admin should be able to change the password when: - no encryption module is loaded and encryption is disabled - encryption module is loaded but it doesn't require per user keys Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>

rullzer · 2019-01-04T08:53:46Z

/backport to stable15

rullzer · 2019-01-04T08:53:55Z

/backport to stable14

backportbot-nextcloud · 2019-01-04T08:54:46Z

backport to stable15 in #13349

backportbot-nextcloud · 2019-01-04T08:54:52Z

backport to stable14 in #13350

laurentiu2 · 2019-01-13T10:15:44Z

Does not work for me. I updated from 13.0.8 to 14.0.5 after this was merged and the issue is still there.

In 13.0.8 I have the master key enabled and as admin I can change the user's password. In 14.0.5 the field for master key is gone.

jkoopmann · 2019-04-18T13:24:53Z

Is it possible this came back with 15.0.7? I have not touched my encryption settings for years and now with 15.0.7 (maybe started with 15.0.x) I suddenly get the warning/error I cannot change passwords:

./occ encryption:status

enabled: false
defaultModule: OC_DEFAULT_MODULE

Jockelchen · 2019-07-01T15:47:06Z

I've got a more disturbing question but related.
I cant change my users Password since upgrading to nextcloud 16 (16.0.1.1). I can change the Masterkey, but it doesn't get recognized.

occ encryption:status

enabled: true
defaultModule: OC_DEFAULT_MODULE

how can i fix this? I was asked do change a users password soon.

Jockelchen · 2019-10-02T08:46:49Z

So, how can i fix this?

schiessle requested review from juliusknorr, rullzer and skjnldsv December 20, 2018 10:34

schiessle mentioned this pull request Dec 20, 2018
Upgrade 13->14: master key disabled #11212
Closed

skjnldsv reviewed Dec 20, 2018
View reviewed changes

skjnldsv added 3. to review Waiting for reviews feature: encryption (server-side) feature: users and groups bug labels Dec 20, 2018

skjnldsv modified the milestones: Nextcloud 16, Nextcloud 15.0.1, Nextcloud 14.0.5 Dec 20, 2018

schiessle added 2. developing Work in progress and removed 3. to review Waiting for reviews labels Dec 20, 2018

schiessle force-pushed the fix-can-change-password-check branch from b57253d to 8bf65b2Compare December 20, 2018 11:27

schiessle added 3. to review Waiting for reviews and removed 2. developing Work in progress labels Dec 20, 2018

schiessle force-pushed the fix-can-change-password-check branch from 8bf65b2 to 4b3308bCompare December 20, 2018 11:28

skjnldsv approved these changes Dec 20, 2018
View reviewed changes

MorrisJobke mentioned this pull request Jan 4, 2019
14.0.5 RC 1 #13347
Merged
3 tasks

rullzer approved these changes Jan 4, 2019
View reviewed changes

rullzer merged commit fe3d8ff into masterJan 4, 2019

rullzer deleted the fix-can-change-password-check branch January 4, 2019 08:53

backportbot-nextcloudBot added the backport-request label Jan 4, 2019

backportbot-nextcloudBot mentioned this pull request Jan 4, 2019
[stable15] fix can change password check in case of encryption is enabled #13349
Merged

backportbot-nextcloudBot removed the backport-request label Jan 4, 2019

backportbot-nextcloudBot mentioned this pull request Jan 4, 2019
[stable14] fix can change password check in case of encryption is enabled #13350
Merged

MorrisJobke modified the milestones: Nextcloud 14.0.5, Nextcloud 16 Jan 4, 2019

the-sane mentioned this pull request Aug 16, 2019
Update 15.0.4 -> 16.0 - admin cannot change user passwords #15239
Closed

Uh oh!

Uh oh!

Conversation

schiessle commented Dec 20, 2018

Uh oh!

skjnldsvDec 20, 2018

Choose a reason for hiding this comment

Uh oh!

schiessleDec 20, 2018

Choose a reason for hiding this comment

Uh oh!

schiessleDec 20, 2018

Choose a reason for hiding this comment

Uh oh!

schiessle commented Dec 20, 2018

Uh oh!

schiessle commented Dec 20, 2018• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rullzer commented Jan 4, 2019

Uh oh!

rullzer commented Jan 4, 2019

Uh oh!

backportbot-nextcloudBot commented Jan 4, 2019

Uh oh!

backportbot-nextcloudBot commented Jan 4, 2019

Uh oh!

laurentiu2 commented Jan 13, 2019

Uh oh!

jkoopmann commented Apr 18, 2019

Uh oh!

Jockelchen commented Jul 1, 2019• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Jockelchen commented Oct 2, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

schiessle commented Dec 20, 2018•
edited
Loading

Jockelchen commented Jul 1, 2019•
edited
Loading