diff options
author | Daniel Calviño Sánchez <danxuliu@gmail.com> | 2017-04-23 19:04:06 +0200 |
---|---|---|
committer | Daniel Calviño Sánchez <danxuliu@gmail.com> | 2017-04-24 11:33:07 +0200 |
commit | dcc8cce28b3c47dd7f6c1684fdb0793102164fb2 (patch) | |
tree | 1369d64b21d755ec6554e13b659194665fa5973a | |
parent | 153d053ee7872fd6669ff082a8c651c5d389a5b0 (diff) | |
download | nextcloud-server-dcc8cce28b3c47dd7f6c1684fdb0793102164fb2.tar.gz nextcloud-server-dcc8cce28b3c47dd7f6c1684fdb0793102164fb2.zip |
Fix double hashing of shared link passwords
The plain text password for a shared links was hashed and, then, the
hashed password was hashed again and set as the final password. Due to
this the password introduced in the "Authenticate" page for the shared
link was always a wrong password, and thus the file could not be
accessed.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
-rw-r--r-- | lib/private/Share20/Manager.php | 2 | ||||
-rw-r--r-- | tests/lib/Share20/ManagerTest.php | 6 |
2 files changed, 7 insertions, 1 deletions
diff --git a/lib/private/Share20/Manager.php b/lib/private/Share20/Manager.php index 3afd38c579f..7bed012fe8f 100644 --- a/lib/private/Share20/Manager.php +++ b/lib/private/Share20/Manager.php @@ -734,7 +734,7 @@ class Manager implements IManager { } $plainTextPassword = null; - if ($share->getShareType() === \OCP\Share::SHARE_TYPE_LINK || $share->getShareType() === \OCP\Share::SHARE_TYPE_EMAIL) { + if ($share->getShareType() === \OCP\Share::SHARE_TYPE_EMAIL) { // Password updated. if ($share->getPassword() !== $originalShare->getPassword()) { //Verify the password diff --git a/tests/lib/Share20/ManagerTest.php b/tests/lib/Share20/ManagerTest.php index 7de73421d3e..6a389fcdf9a 100644 --- a/tests/lib/Share20/ManagerTest.php +++ b/tests/lib/Share20/ManagerTest.php @@ -2520,6 +2520,12 @@ class ManagerTest extends \Test\TestCase { $manager->expects($this->once())->method('canShare')->willReturn(true); $manager->expects($this->once())->method('getShareById')->with('foo:42')->willReturn($originalShare); $manager->expects($this->once())->method('validateExpirationDate')->with($share); + $manager->expects($this->once())->method('verifyPassword')->with('password'); + + $this->hasher->expects($this->once()) + ->method('hash') + ->with('password') + ->willReturn('hashed'); $this->defaultProvider->expects($this->once()) ->method('update') |