Merge pull request #3610 from owncloud/encryption_recovery_for_ldap

recover encryption keys if ownCloud can't change the log-in password

5 files changed, 39 insertions, 13 deletions

diff --git a/apps/files_encryption/hooks/hooks.php b/apps/files_encryption/hooks/hooks.php
index d1b08a0b978..c4b247da1ed 100644
--- a/apps/files_encryption/hooks/hooks.php
+++ b/apps/files_encryption/hooks/hooks.php
@@ -142,6 +142,15 @@ class Hooks {
 	}

 

 	/**

+	 * @brief If the password can't be changed within ownCloud, than update the key password in advance.

+	 */

+	public static function preSetPassphrase($params) {

+		if ( ! \OC_User::canUserChangePassword($params['uid']) ) {

+			self::setPassphrase($params);

+		}

+	}

+

+	/**

 	 * @brief Change a user's encryption passphrase

 	 * @param array $params keys: uid, password

 	 */

diff --git a/apps/files_encryption/lib/helper.php b/apps/files_encryption/lib/helper.php
index e078ab35541..184e1782494 100755
--- a/apps/files_encryption/lib/helper.php
+++ b/apps/files_encryption/lib/helper.php
@@ -48,6 +48,7 @@ class Helper {
 
 		\OCP\Util::connectHook('OC_User', 'post_login', 'OCA\Encryption\Hooks', 'login');
 		\OCP\Util::connectHook('OC_User', 'post_setPassword', 'OCA\Encryption\Hooks', 'setPassphrase');
+		\OCP\Util::connectHook('OC_User', 'pre_setPassword', 'OCA\Encryption\Hooks', 'preSetPassphrase');
 		\OCP\Util::connectHook('OC_User', 'post_createUser', 'OCA\Encryption\Hooks', 'postCreateUser');
 		\OCP\Util::connectHook('OC_User', 'post_deleteUser', 'OCA\Encryption\Hooks', 'postDeleteUser');
 	}
diff --git a/lib/user/user.php b/lib/user/user.php
index f9466b71499..55d7848a979 100644
--- a/lib/user/user.php
+++ b/lib/user/user.php
@@ -131,10 +131,10 @@ class User {
 	 * @return bool
 	 */
 	public function setPassword($password, $recoveryPassword) {
+		if ($this->emitter) {
+			$this->emitter->emit('\OC\User', 'preSetPassword', array($this, $password, $recoveryPassword));
+		}
 		if ($this->backend->implementsActions(\OC_USER_BACKEND_SET_PASSWORD)) {
-			if ($this->emitter) {
-				$this->emitter->emit('\OC\User', 'preSetPassword', array($this, $password, $recoveryPassword));
-			}
 			$result = $this->backend->setPassword($this->uid, $password);
 			if ($this->emitter) {
 				$this->emitter->emit('\OC\User', 'postSetPassword', array($this, $password, $recoveryPassword));
diff --git a/settings/ajax/changepassword.php b/settings/ajax/changepassword.php
index cb66c57c743..30877810550 100644
--- a/settings/ajax/changepassword.php
+++ b/settings/ajax/changepassword.php
@@ -28,17 +28,29 @@ if(is_null($userstatus)) {
 	exit();
 }
 
-$util = new \OCA\Encryption\Util(new \OC_FilesystemView('/'), $username);
 $recoveryAdminEnabled = OC_Appconfig::getValue( 'files_encryption', 'recoveryAdminEnabled' );
-$recoveryEnabledForUser = $util->recoveryEnabledForUser();
 
-if ($recoveryAdminEnabled && $recoveryEnabledForUser && $recoveryPassword == '') {
+
+$validRecoveryPassword = false;
+$recoveryPasswordSupported = false;
+
+if ($recoveryAdminEnabled) {
+	$util = new \OCA\Encryption\Util(new \OC_FilesystemView('/'), $username);
+	$validRecoveryPassword = $util->checkRecoveryPassword($recoveryPassword);
+	$recoveryPasswordSupported = $util->recoveryEnabledForUser();
+}
+
+if ($recoveryPasswordSupported && $recoveryPassword == '') {
 	OC_JSON::error(array("data" => array( "message" => "Please provide a admin recovery password, otherwise all user data will be lost" )));
-}elseif ( $recoveryPassword && ! $util->checkRecoveryPassword($recoveryPassword) ) {
+} elseif ( $recoveryPasswordSupported && ! $validRecoveryPassword) {
 	OC_JSON::error(array("data" => array( "message" => "Wrong admin recovery password. Please check the password and try again." )));
-}elseif(!is_null($password) && OC_User::setPassword( $username, $password, $recoveryPassword )) {
-	OC_JSON::success(array("data" => array( "username" => $username )));
-}
-else{
-	OC_JSON::error(array("data" => array( "message" => "Unable to change password" )));
+} else { // now we know that everything is file regarding the recovery password, let's try to change the password
+	$result = OC_User::setPassword($username, $password, $recoveryPassword);
+	if (!$result && $recoveryPasswordSupported) {
+		OC_JSON::error(array("data" => array( "message" => "Back-end doesn't support password change, but the users encryption key was successfully updated." )));
+	} elseif (!$result && !$recoveryPasswordSupported) {
+		OC_JSON::error(array("data" => array( "message" => "Unable to change password" )));
+	} else {
+		OC_JSON::success(array("data" => array( "username" => $username )));
+	}
 }
diff --git a/settings/templates/users.php b/settings/templates/users.php
index a6df85983dd..b0637814f5d 100644
--- a/settings/templates/users.php
+++ b/settings/templates/users.php
@@ -31,7 +31,11 @@ $_['subadmingroups'] = array_flip($items);
 	</form>
 	<?php if((bool)$_['recoveryAdminEnabled']): ?>
 	<div class="recoveryPassword">
-	<input id="recoveryPassword" type="password" placeholder="<?php p($l->t('Admin Recovery Password'))?>" />
+	<input id="recoveryPassword"
+		   type="password"
+		   placeholder="<?php p($l->t('Admin Recovery Password'))?>"
+		   title="<?php p($l->t('Enter the recovery password in order to recover the users files during password change'))?>"
+		   alt="<?php p($l->t('Enter the recovery password in order to recover the users files during password change'))?>"/>
 	</div>
 	<?php endif; ?>
 	<div class="quota">