예제 #1
0
파일: hooks.php 프로젝트: hjimmy/owncloud
 /**
  * @brief Change a user's encryption passphrase
  * @param array $params keys: uid, password
  */
 public static function setPassphrase($params)
 {
     if (\OCP\App::isEnabled('files_encryption') === false) {
         return true;
     }
     // Only attempt to change passphrase if server-side encryption
     // is in use (client-side encryption does not have access to
     // the necessary keys)
     if (Crypt::mode() === 'server') {
         $view = new \OC_FilesystemView('/');
         $session = new \OCA\Encryption\Session($view);
         // Get existing decrypted private key
         $privateKey = $session->getPrivateKey();
         if ($params['uid'] === \OCP\User::getUser() && $privateKey) {
             // Encrypt private key with new user pwd as passphrase
             $encryptedPrivateKey = Crypt::symmetricEncryptFileContent($privateKey, $params['password']);
             // Save private key
             if ($encryptedPrivateKey) {
                 Keymanager::setPrivateKey($encryptedPrivateKey);
             } else {
                 \OCP\Util::writeLog('files_encryption', 'Could not update users encryption password', \OCP\Util::ERROR);
             }
             // NOTE: Session does not need to be updated as the
             // private key has not changed, only the passphrase
             // used to decrypt it has changed
         } else {
             // admin changed the password for a different user, create new keys and reencrypt file keys
             $user = $params['uid'];
             $util = new Util($view, $user);
             $recoveryPassword = isset($params['recoveryPassword']) ? $params['recoveryPassword'] : null;
             // we generate new keys if...
             // ...we have a recovery password and the user enabled the recovery key
             // ...encryption was activated for the first time (no keys exists)
             // ...the user doesn't have any files
             if ($util->recoveryEnabledForUser() && $recoveryPassword || !$util->userKeysExists() || !$view->file_exists($user . '/files')) {
                 // backup old keys
                 $util->backupAllKeys('recovery');
                 $newUserPassword = $params['password'];
                 // make sure that the users home is mounted
                 \OC\Files\Filesystem::initMountPoints($user);
                 $keypair = Crypt::createKeypair();
                 // Disable encryption proxy to prevent recursive calls
                 $proxyStatus = \OC_FileProxy::$enabled;
                 \OC_FileProxy::$enabled = false;
                 // Save public key
                 $view->file_put_contents('/public-keys/' . $user . '.public.key', $keypair['publicKey']);
                 // Encrypt private key empty passphrase
                 $encryptedPrivateKey = Crypt::symmetricEncryptFileContent($keypair['privateKey'], $newUserPassword);
                 // Save private key
                 $view->file_put_contents('/' . $user . '/files_encryption/' . $user . '.private.key', $encryptedPrivateKey);
                 if ($recoveryPassword) {
                     // if recovery key is set we can re-encrypt the key files
                     $util = new Util($view, $user);
                     $util->recoverUsersFiles($recoveryPassword);
                 }
                 \OC_FileProxy::$enabled = $proxyStatus;
             }
         }
     }
 }
예제 #2
0
파일: util.php 프로젝트: hjimmy/owncloud
 /**
  * @medium
  */
 function testRecoveryEnabledForUser()
 {
     $util = new Encryption\Util($this->view, $this->userId);
     // Record the value so we can return it to it's original state later
     $enabled = $util->recoveryEnabledForUser();
     $this->assertTrue($util->setRecoveryForUser(1));
     $this->assertEquals(1, $util->recoveryEnabledForUser());
     $this->assertTrue($util->setRecoveryForUser(0));
     $this->assertEquals(0, $util->recoveryEnabledForUser());
     // Return the setting to it's previous state
     $this->assertTrue($util->setRecoveryForUser($enabled));
 }