check if the decrypted private key is valid on login and on read/write files

diff --git a/apps/files_encryption/hooks/hooks.php b/apps/files_encryption/hooks/hooks.php
index eb9a2600d70d1aaaf9849dd87e65fce545e01950..639d57691540752994e1c72d9c464163aa38ac5e 100644 (file)
--- a/apps/files_encryption/hooks/hooks.php
+++ b/apps/files_encryption/hooks/hooks.php
@@ -57,6 +57,21 @@ class Hooks {
 \r
                $privateKey = Crypt::symmetricDecryptFileContent($encryptedKey, $params['password']);\r
 \r
+               // check if this a valid private key\r
+               $res = openssl_pkey_get_private($privateKey);\r
+               if(is_resource($res)) {\r
+                       $sslInfo = openssl_pkey_get_details($res);\r
+                       if(!isset($sslInfo['key'])) {\r
+                               $privateKey = null;\r
+                       }\r
+               } else {\r
+                       $privateKey = null;\r
+               }\r
+\r
+               if($privateKey === null) {\r
+                       \OCP\Util::writeLog('Encryption library', 'Private key for user "' . $params['uid'] . '" is not valid! Maybe the user password was changed from outside if so please change it back to gain access', \OCP\Util::ERROR);\r
+               }\r
+\r
                $session = new \OCA\Encryption\Session($view);\r
 \r
                $session->setPrivateKey($privateKey, $params['uid']);\r
@@ -143,7 +158,7 @@ class Hooks {
        public static function setPassphrase($params) {\r
 \r
                // Only attempt to change passphrase if server-side encryption\r
-               // is in use (client-side encryption does not have access to \r
+               // is in use (client-side encryption does not have access to\r
                // the necessary keys)\r
                if (Crypt::mode() === 'server') {\r
 \r

diff --git a/apps/files_encryption/lib/stream.php b/apps/files_encryption/lib/stream.php
index 072c52866445e91f7157a739ca2e939ccdc846b7..56322c100ba70af5c98edeb173a014eddbeb5f53 100644 (file)
--- a/apps/files_encryption/lib/stream.php
+++ b/apps/files_encryption/lib/stream.php
@@ -118,7 +118,7 @@ class Stream {
 
                if (!is_resource($this->handle)) {
 
-                       \OCP\Util::writeLog('files_encryption', 'failed to open file "' . $this->rawPath . '"', \OCP\Util::ERROR);
+                       \OCP\Util::writeLog('Encryption library', 'failed to open file "' . $this->rawPath . '"', \OCP\Util::ERROR);
 
                } else {
 
@@ -156,7 +156,7 @@ class Stream {
 
                        // $count will always be 8192 https://bugs.php.net/bug.php?id=21641
                        // This makes this function a lot simpler, but will break this class if the above 'bug' gets 'fixed'
-                       \OCP\Util::writeLog('files_encryption', 'PHP "bug" 21641 no longer holds, decryption system requires refactoring', \OCP\Util::FATAL);
+                       \OCP\Util::writeLog('Encryption library', 'PHP "bug" 21641 no longer holds, decryption system requires refactoring', \OCP\Util::FATAL);
 
                        die();
 
@@ -165,7 +165,7 @@ class Stream {
                // Get the data from the file handle
                $data = fread($this->handle, 8192);
 
-               $result = '';
+               $result = null;
 
                if (strlen($data)) {
 
@@ -175,10 +175,11 @@ class Stream {
                                throw new \Exception(
                                        'Encryption key not found for "' . $this->rawPath . '" during attempted read via stream');
 
-                       }
+                       } else {
 
-                       // Decrypt data
-                       $result = Crypt::symmetricDecryptFileContent($data, $this->plainKey);
+                               // Decrypt data
+                               $result = Crypt::symmetricDecryptFileContent($data, $this->plainKey);
+                       }
 
                }
 
@@ -232,6 +233,14 @@ class Stream {
 
                        $privateKey = $session->getPrivateKey($this->userId);
 
+                       // if there is no valid private key return false
+                       if($privateKey === false) {
+
+                               \OCP\Util::writeLog('Encryption library', 'Private key for user "' . $this->userId . '" is not valid! Maybe the user password was changed from outside if so please change it back to gain access', \OCP\Util::ERROR);
+
+                               return false;
+                       }
+
                        $shareKey = Keymanager::getShareKey($this->rootView, $this->userId, $this->relPath);
 
                        $this->plainKey = Crypt::multiKeyDecrypt($this->encKeyfile, $shareKey, $privateKey);