migrate therinaldos.com data

wedding-pics/apps/encryption/lib/AppInfo/Application.php

@@ -0,0 +1,108 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\AppInfo;
+
+use OCA\Encryption\Crypto\Crypt;
+use OCA\Encryption\Crypto\DecryptAll;
+use OCA\Encryption\Crypto\EncryptAll;
+use OCA\Encryption\Crypto\Encryption;
+use OCA\Encryption\HookManager;
+use OCA\Encryption\Hooks\UserHooks;
+use OCA\Encryption\KeyManager;
+use OCA\Encryption\Recovery;
+use OCA\Encryption\Session;
+use OCA\Encryption\Users\Setup;
+use OCA\Encryption\Util;
+use OCP\Encryption\IManager;
+use OCP\IConfig;
+use Psr\Log\LoggerInterface;
+
+class Application extends \OCP\AppFramework\App {
+	/**
+	 * @param array $urlParams
+	 */
+	public function __construct($urlParams = []) {
+		parent::__construct('encryption', $urlParams);
+	}
+
+	public function setUp(IManager $encryptionManager) {
+		if ($encryptionManager->isEnabled()) {
+			/** @var Setup $setup */
+			$setup = $this->getContainer()->query(Setup::class);
+			$setup->setupSystem();
+		}
+	}
+
+	/**
+	 * register hooks
+	 */
+	public function registerHooks(IConfig $config) {
+		if (!$config->getSystemValueBool('maintenance')) {
+			$container = $this->getContainer();
+			$server = $container->getServer();
+			// Register our hooks and fire them.
+			$hookManager = new HookManager();
+
+			$hookManager->registerHook([
+				new UserHooks($container->query(KeyManager::class),
+					$server->getUserManager(),
+					$server->get(LoggerInterface::class),
+					$container->query(Setup::class),
+					$server->getUserSession(),
+					$container->query(Util::class),
+					$container->query(Session::class),
+					$container->query(Crypt::class),
+					$container->query(Recovery::class))
+			]);
+
+			$hookManager->fireHooks();
+		} else {
+			// Logout user if we are in maintenance to force re-login
+			$this->getContainer()->getServer()->getUserSession()->logout();
+		}
+	}
+
+	public function registerEncryptionModule(IManager $encryptionManager) {
+		$container = $this->getContainer();
+
+		$encryptionManager->registerEncryptionModule(
+			Encryption::ID,
+			Encryption::DISPLAY_NAME,
+			function () use ($container) {
+				return new Encryption(
+					$container->query(Crypt::class),
+					$container->query(KeyManager::class),
+					$container->query(Util::class),
+					$container->query(Session::class),
+					$container->query(EncryptAll::class),
+					$container->query(DecryptAll::class),
+					$container->getServer()->get(LoggerInterface::class),
+					$container->getServer()->getL10N($container->getAppName())
+				);
+			});
+	}
+}

wedding-pics/apps/encryption/lib/Command/DisableMasterKey.php

@@ -0,0 +1,88 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Bjoern Schiessle <bjoern@schiessle.org>
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Encryption\Command;
+
+use OCA\Encryption\Util;
+use OCP\IConfig;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Helper\QuestionHelper;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Question\ConfirmationQuestion;
+
+class DisableMasterKey extends Command {
+
+	/** @var Util */
+	protected $util;
+
+	/** @var IConfig */
+	protected $config;
+
+	/** @var  QuestionHelper */
+	protected $questionHelper;
+
+	/**
+	 * @param Util $util
+	 * @param IConfig $config
+	 * @param QuestionHelper $questionHelper
+	 */
+	public function __construct(Util $util,
+		IConfig $config,
+		QuestionHelper $questionHelper) {
+		$this->util = $util;
+		$this->config = $config;
+		$this->questionHelper = $questionHelper;
+		parent::__construct();
+	}
+
+	protected function configure() {
+		$this
+			->setName('encryption:disable-master-key')
+			->setDescription('Disable the master key and use per-user keys instead. Only available for fresh installations with no existing encrypted data! There is no way to enable it again.');
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$isMasterKeyEnabled = $this->util->isMasterKeyEnabled();
+
+		if (!$isMasterKeyEnabled) {
+			$output->writeln('Master key already disabled');
+		} else {
+			$question = new ConfirmationQuestion(
+				'Warning: Only perform this operation for a fresh installations with no existing encrypted data! '
+				. 'There is no way to enable the master key again. '
+				. 'We strongly recommend to keep the master key, it provides significant performance improvements '
+				. 'and is easier to handle for both, users and administrators. '
+				. 'Do you really want to switch to per-user keys? (y/n) ', false);
+			if ($this->questionHelper->ask($input, $output, $question)) {
+				$this->config->setAppValue('encryption', 'useMasterKey', '0');
+				$output->writeln('Master key successfully disabled.');
+			} else {
+				$output->writeln('aborted.');
+				return 1;
+			}
+		}
+		return 0;
+	}
+}

wedding-pics/apps/encryption/lib/Command/DropLegacyFileKey.php

@@ -0,0 +1,167 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023, Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Encryption\Command;
+
+use OC\Encryption\Exceptions\DecryptionFailedException;
+use OC\Files\FileInfo;
+use OC\Files\View;
+use OCA\Encryption\KeyManager;
+use OCP\Encryption\Exceptions\GenericEncryptionException;
+use OCP\IUserManager;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class DropLegacyFileKey extends Command {
+	private View $rootView;
+
+	public function __construct(
+		private IUserManager $userManager,
+		private KeyManager $keyManager,
+	) {
+		parent::__construct();
+
+		$this->rootView = new View();
+	}
+
+	protected function configure(): void {
+		$this
+			->setName('encryption:drop-legacy-filekey')
+			->setDescription('Scan the files for the legacy filekey format using RC4 and get rid of it (if master key is enabled)');
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$result = true;
+
+		$output->writeln('<info>Scanning all files for legacy filekey</info>');
+
+		foreach ($this->userManager->getBackends() as $backend) {
+			$limit = 500;
+			$offset = 0;
+			do {
+				$users = $backend->getUsers('', $limit, $offset);
+				foreach ($users as $user) {
+					$output->writeln('Scanning all files for ' . $user);
+					$this->setupUserFS($user);
+					$result = $result && $this->scanFolder($output, '/' . $user);
+				}
+				$offset += $limit;
+			} while (count($users) >= $limit);
+		}
+
+		if ($result) {
+			$output->writeln('All scanned files are properly encrypted.');
+			return 0;
+		}
+
+		return 1;
+	}
+
+	private function scanFolder(OutputInterface $output, string $folder): bool {
+		$clean = true;
+
+		foreach ($this->rootView->getDirectoryContent($folder) as $item) {
+			$path = $folder . '/' . $item['name'];
+			if ($this->rootView->is_dir($path)) {
+				if ($this->scanFolder($output, $path) === false) {
+					$clean = false;
+				}
+			} else {
+				if (!$item->isEncrypted()) {
+					// ignore
+					continue;
+				}
+
+				$stats = $this->rootView->stat($path);
+				if (!isset($stats['hasHeader']) || $stats['hasHeader'] === false) {
+					$clean = false;
+					$output->writeln('<error>' . $path . ' does not have a proper header</error>');
+				} else {
+					try {
+						$legacyFileKey = $this->keyManager->getFileKey($path, null, true);
+						if ($legacyFileKey === '') {
+							$output->writeln('Got an empty legacy filekey for ' . $path . ', continuing', OutputInterface::VERBOSITY_VERBOSE);
+							continue;
+						}
+					} catch (GenericEncryptionException $e) {
+						$output->writeln('Got a decryption error for legacy filekey for ' . $path . ', continuing', OutputInterface::VERBOSITY_VERBOSE);
+						continue;
+					}
+					/* If that did not throw and filekey is not empty, a legacy filekey is used */
+					$clean = false;
+					$output->writeln($path . ' is using a legacy filekey, migrating');
+					$this->migrateSinglefile($path, $item, $output);
+				}
+			}
+		}
+
+		return $clean;
+	}
+
+	private function migrateSinglefile(string $path, FileInfo $fileInfo, OutputInterface $output): void {
+		$source = $path;
+		$target = $path . '.reencrypted.' . time();
+
+		try {
+			$this->rootView->copy($source, $target);
+			$copyResource = $this->rootView->fopen($target, 'r');
+			$sourceResource = $this->rootView->fopen($source, 'w');
+			if ($copyResource === false || $sourceResource === false) {
+				throw new DecryptionFailedException('Failed to open '.$source.' or '.$target);
+			}
+			if (stream_copy_to_stream($copyResource, $sourceResource) === false) {
+				$output->writeln('<error>Failed to copy '.$target.' data into '.$source.'</error>');
+				$output->writeln('<error>Leaving both files in there to avoid data loss</error>');
+				return;
+			}
+			$this->rootView->touch($source, $fileInfo->getMTime());
+			$this->rootView->unlink($target);
+			$output->writeln('<info>Migrated ' . $source . '</info>', OutputInterface::VERBOSITY_VERBOSE);
+		} catch (DecryptionFailedException $e) {
+			if ($this->rootView->file_exists($target)) {
+				$this->rootView->unlink($target);
+			}
+			$output->writeln('<error>Failed to migrate ' . $path . '</error>');
+			$output->writeln('<error>' . $e . '</error>', OutputInterface::VERBOSITY_VERBOSE);
+		} finally {
+			if (is_resource($copyResource)) {
+				fclose($copyResource);
+			}
+			if (is_resource($sourceResource)) {
+				fclose($sourceResource);
+			}
+		}
+	}
+
+	/**
+	 * setup user file system
+	 */
+	protected function setupUserFS(string $uid): void {
+		\OC_Util::tearDownFS();
+		\OC_Util::setupFS($uid);
+	}
+}

wedding-pics/apps/encryption/lib/Command/EnableMasterKey.php

@@ -0,0 +1,84 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Command;
+
+use OCA\Encryption\Util;
+use OCP\IConfig;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Helper\QuestionHelper;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Question\ConfirmationQuestion;
+
+class EnableMasterKey extends Command {
+
+	/** @var Util */
+	protected $util;
+
+	/** @var IConfig */
+	protected $config;
+
+	/** @var  QuestionHelper */
+	protected $questionHelper;
+
+	/**
+	 * @param Util $util
+	 * @param IConfig $config
+	 * @param QuestionHelper $questionHelper
+	 */
+	public function __construct(Util $util,
+		IConfig $config,
+		QuestionHelper $questionHelper) {
+		$this->util = $util;
+		$this->config = $config;
+		$this->questionHelper = $questionHelper;
+		parent::__construct();
+	}
+
+	protected function configure() {
+		$this
+			->setName('encryption:enable-master-key')
+			->setDescription('Enable the master key. Only available for fresh installations with no existing encrypted data! There is also no way to disable it again.');
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$isAlreadyEnabled = $this->util->isMasterKeyEnabled();
+
+		if ($isAlreadyEnabled) {
+			$output->writeln('Master key already enabled');
+		} else {
+			$question = new ConfirmationQuestion(
+				'Warning: Only available for fresh installations with no existing encrypted data! '
+			. 'There is also no way to disable it again. Do you want to continue? (y/n) ', false);
+			if ($this->questionHelper->ask($input, $output, $question)) {
+				$this->config->setAppValue('encryption', 'useMasterKey', '1');
+				$output->writeln('Master key successfully enabled.');
+			} else {
+				$output->writeln('aborted.');
+				return 1;
+			}
+		}
+		return 0;
+	}
+}

wedding-pics/apps/encryption/lib/Command/FixEncryptedVersion.php

@@ -0,0 +1,329 @@
+<?php
+/**
+ * @author Sujith Haridasan <sharidasan@owncloud.com>
+ * @author Ilja Neumann <ineumann@owncloud.com>
+ *
+ * @copyright Copyright (c) 2019, ownCloud GmbH
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OCA\Encryption\Command;
+
+use OC\Files\Storage\Wrapper\Encryption;
+use OC\Files\View;
+use OC\ServerNotAvailableException;
+use OCA\Encryption\Util;
+use OCP\Files\IRootFolder;
+use OCP\HintException;
+use OCP\IConfig;
+use OCP\IUser;
+use OCP\IUserManager;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class FixEncryptedVersion extends Command {
+	private bool $supportLegacy;
+
+	public function __construct(
+		private IConfig $config,
+		private LoggerInterface $logger,
+		private IRootFolder $rootFolder,
+		private IUserManager $userManager,
+		private Util $util,
+		private View $view,
+	) {
+		$this->supportLegacy = false;
+
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		parent::configure();
+
+		$this
+			->setName('encryption:fix-encrypted-version')
+			->setDescription('Fix the encrypted version if the encrypted file(s) are not downloadable.')
+			->addArgument(
+				'user',
+				InputArgument::OPTIONAL,
+				'The id of the user whose files need fixing'
+			)->addOption(
+				'path',
+				'p',
+				InputOption::VALUE_REQUIRED,
+				'Limit files to fix with path, e.g., --path="/Music/Artist". If path indicates a directory, all the files inside directory will be fixed.'
+			)->addOption(
+				'all',
+				null,
+				InputOption::VALUE_NONE,
+				'Run the fix for all users on the system, mutually exclusive with specifying a user id.'
+			);
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$skipSignatureCheck = $this->config->getSystemValueBool('encryption_skip_signature_check', false);
+		$this->supportLegacy = $this->config->getSystemValueBool('encryption.legacy_format_support', false);
+
+		if ($skipSignatureCheck) {
+			$output->writeln("<error>Repairing is not possible when \"encryption_skip_signature_check\" is set. Please disable this flag in the configuration.</error>\n");
+			return 1;
+		}
+
+		if (!$this->util->isMasterKeyEnabled()) {
+			$output->writeln("<error>Repairing only works with master key encryption.</error>\n");
+			return 1;
+		}
+
+		$user = $input->getArgument('user');
+		$all = $input->getOption('all');
+		$pathOption = \trim(($input->getOption('path') ?? ''), '/');
+
+		if ($user) {
+			if ($all) {
+				$output->writeln("Specifying a user id and --all are mutually exclusive");
+				return 1;
+			}
+
+			if ($this->userManager->get($user) === null) {
+				$output->writeln("<error>User id $user does not exist. Please provide a valid user id</error>");
+				return 1;
+			}
+
+			return $this->runForUser($user, $pathOption, $output);
+		} elseif ($all) {
+			$result = 0;
+			$this->userManager->callForSeenUsers(function (IUser $user) use ($pathOption, $output, &$result) {
+				$output->writeln("Processing files for " . $user->getUID());
+				$result = $this->runForUser($user->getUID(), $pathOption, $output);
+				return $result === 0;
+			});
+			return $result;
+		} else {
+			$output->writeln("Either a user id or --all needs to be provided");
+			return 1;
+		}
+	}
+
+	private function runForUser(string $user, string $pathOption, OutputInterface $output): int {
+		$pathToWalk = "/$user/files";
+		if ($pathOption !== "") {
+			$pathToWalk = "$pathToWalk/$pathOption";
+		}
+		return $this->walkPathOfUser($user, $pathToWalk, $output);
+	}
+
+	/**
+	 * @return int 0 for success, 1 for error
+	 */
+	private function walkPathOfUser(string $user, string $path, OutputInterface $output): int {
+		$this->setupUserFs($user);
+		if (!$this->view->file_exists($path)) {
+			$output->writeln("<error>Path \"$path\" does not exist. Please provide a valid path.</error>");
+			return 1;
+		}
+
+		if ($this->view->is_file($path)) {
+			$output->writeln("Verifying the content of file \"$path\"");
+			$this->verifyFileContent($path, $output);
+			return 0;
+		}
+		$directories = [];
+		$directories[] = $path;
+		while ($root = \array_pop($directories)) {
+			$directoryContent = $this->view->getDirectoryContent($root);
+			foreach ($directoryContent as $file) {
+				$path = $root . '/' . $file['name'];
+				if ($this->view->is_dir($path)) {
+					$directories[] = $path;
+				} else {
+					$output->writeln("Verifying the content of file \"$path\"");
+					$this->verifyFileContent($path, $output);
+				}
+			}
+		}
+		return 0;
+	}
+
+	/**
+	 * @param bool $ignoreCorrectEncVersionCall, setting this variable to false avoids recursion
+	 */
+	private function verifyFileContent(string $path, OutputInterface $output, bool $ignoreCorrectEncVersionCall = true): bool {
+		try {
+			// since we're manually poking around the encrypted state we need to ensure that this isn't cached in the encryption wrapper
+			$mount = $this->view->getMount($path);
+			$storage = $mount->getStorage();
+			if ($storage && $storage->instanceOfStorage(Encryption::class)) {
+				$storage->clearIsEncryptedCache();
+			}
+
+			/**
+			 * In encryption, the files are read in a block size of 8192 bytes
+			 * Read block size of 8192 and a bit more (808 bytes)
+			 * If there is any problem, the first block should throw the signature
+			 * mismatch error. Which as of now, is enough to proceed ahead to
+			 * correct the encrypted version.
+			 */
+			$handle = $this->view->fopen($path, 'rb');
+
+			if ($handle === false) {
+				$output->writeln("<warning>Failed to open file: \"$path\" skipping</warning>");
+				return true;
+			}
+
+			if (\fread($handle, 9001) !== false) {
+				$fileInfo = $this->view->getFileInfo($path);
+				if (!$fileInfo) {
+					$output->writeln("<warning>File info not found for file: \"$path\"</warning>");
+					return true;
+				}
+				$encryptedVersion = $fileInfo->getEncryptedVersion();
+				$stat = $this->view->stat($path);
+				if (($encryptedVersion == 0) && isset($stat['hasHeader']) && ($stat['hasHeader'] == true)) {
+					// The file has encrypted to false but has an encryption header
+					if ($ignoreCorrectEncVersionCall === true) {
+						// Lets rectify the file by correcting encrypted version
+						$output->writeln("<info>Attempting to fix the path: \"$path\"</info>");
+						return $this->correctEncryptedVersion($path, $output);
+					}
+					return false;
+				}
+				$output->writeln("<info>The file \"$path\" is: OK</info>");
+			}
+
+			\fclose($handle);
+
+			return true;
+		} catch (ServerNotAvailableException $e) {
+			// not a "bad signature" error and likely "legacy cipher" exception
+			// this could mean that the file is maybe not encrypted but the encrypted version is set
+			if (!$this->supportLegacy && $ignoreCorrectEncVersionCall === true) {
+				$output->writeln("<info>Attempting to fix the path: \"$path\"</info>");
+				return $this->correctEncryptedVersion($path, $output, true);
+			}
+			return false;
+		} catch (HintException $e) {
+			$this->logger->warning("Issue: " . $e->getMessage());
+			// If allowOnce is set to false, this becomes recursive.
+			if ($ignoreCorrectEncVersionCall === true) {
+				// Lets rectify the file by correcting encrypted version
+				$output->writeln("<info>Attempting to fix the path: \"$path\"</info>");
+				return $this->correctEncryptedVersion($path, $output);
+			}
+			return false;
+		}
+	}
+
+	/**
+	 * @param bool $includeZero whether to try zero version for unencrypted file
+	 */
+	private function correctEncryptedVersion(string $path, OutputInterface $output, bool $includeZero = false): bool {
+		$fileInfo = $this->view->getFileInfo($path);
+		if (!$fileInfo) {
+			$output->writeln("<warning>File info not found for file: \"$path\"</warning>");
+			return true;
+		}
+		$fileId = $fileInfo->getId();
+		if ($fileId === null) {
+			$output->writeln("<warning>File info contains no id for file: \"$path\"</warning>");
+			return true;
+		}
+		$encryptedVersion = $fileInfo->getEncryptedVersion();
+		$wrongEncryptedVersion = $encryptedVersion;
+
+		$storage = $fileInfo->getStorage();
+
+		$cache = $storage->getCache();
+		$fileCache = $cache->get($fileId);
+		if (!$fileCache) {
+			$output->writeln("<warning>File cache entry not found for file: \"$path\"</warning>");
+			return true;
+		}
+
+		if ($storage->instanceOfStorage('OCA\Files_Sharing\ISharedStorage')) {
+			$output->writeln("<info>The file: \"$path\" is a share. Please also run the script for the owner of the share</info>");
+			return true;
+		}
+
+		// Save original encrypted version so we can restore it if decryption fails with all version
+		$originalEncryptedVersion = $encryptedVersion;
+		if ($encryptedVersion >= 0) {
+			if ($includeZero) {
+				// try with zero first
+				$cacheInfo = ['encryptedVersion' => 0, 'encrypted' => 0];
+				$cache->put($fileCache->getPath(), $cacheInfo);
+				$output->writeln("<info>Set the encrypted version to 0 (unencrypted)</info>");
+				if ($this->verifyFileContent($path, $output, false) === true) {
+					$output->writeln("<info>Fixed the file: \"$path\" with version 0 (unencrypted)</info>");
+					return true;
+				}
+			}
+
+			// Test by decrementing the value till 1 and if nothing works try incrementing
+			$encryptedVersion--;
+			while ($encryptedVersion > 0) {
+				$cacheInfo = ['encryptedVersion' => $encryptedVersion, 'encrypted' => $encryptedVersion];
+				$cache->put($fileCache->getPath(), $cacheInfo);
+				$output->writeln("<info>Decrement the encrypted version to $encryptedVersion</info>");
+				if ($this->verifyFileContent($path, $output, false) === true) {
+					$output->writeln("<info>Fixed the file: \"$path\" with version " . $encryptedVersion . "</info>");
+					return true;
+				}
+				$encryptedVersion--;
+			}
+
+			// So decrementing did not work. Now lets increment. Max increment is till 5
+			$increment = 1;
+			while ($increment <= 5) {
+				/**
+				 * The wrongEncryptedVersion would not be incremented so nothing to worry about here.
+				 * Only the newEncryptedVersion is incremented.
+				 * For example if the wrong encrypted version is 4 then
+				 * cycle1 -> newEncryptedVersion = 5 ( 4 + 1)
+				 * cycle2 -> newEncryptedVersion = 6 ( 4 + 2)
+				 * cycle3 -> newEncryptedVersion = 7 ( 4 + 3)
+				 */
+				$newEncryptedVersion = $wrongEncryptedVersion + $increment;
+
+				$cacheInfo = ['encryptedVersion' => $newEncryptedVersion, 'encrypted' => $newEncryptedVersion];
+				$cache->put($fileCache->getPath(), $cacheInfo);
+				$output->writeln("<info>Increment the encrypted version to $newEncryptedVersion</info>");
+				if ($this->verifyFileContent($path, $output, false) === true) {
+					$output->writeln("<info>Fixed the file: \"$path\" with version " . $newEncryptedVersion . "</info>");
+					return true;
+				}
+				$increment++;
+			}
+		}
+
+		$cacheInfo = ['encryptedVersion' => $originalEncryptedVersion, 'encrypted' => $originalEncryptedVersion];
+		$cache->put($fileCache->getPath(), $cacheInfo);
+		$output->writeln("<info>No fix found for \"$path\", restored version to original: $originalEncryptedVersion</info>");
+
+		return false;
+	}
+
+	/**
+	 * Setup user file system
+	 */
+	private function setupUserFs(string $uid): void {
+		\OC_Util::tearDownFS();
+		\OC_Util::setupFS($uid);
+	}
+}

wedding-pics/apps/encryption/lib/Command/FixKeyLocation.php

@@ -0,0 +1,447 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * @copyright Copyright (c) 2022 Robin Appelman <robin@icewind.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Encryption\Command;
+
+use OC\Encryption\Manager;
+use OC\Encryption\Util;
+use OC\Files\Storage\Wrapper\Encryption;
+use OC\Files\View;
+use OCP\Encryption\IManager;
+use OCP\Files\Config\ICachedMountInfo;
+use OCP\Files\Config\IUserMountCache;
+use OCP\Files\File;
+use OCP\Files\Folder;
+use OCP\Files\IRootFolder;
+use OCP\Files\Node;
+use OCP\IUser;
+use OCP\IUserManager;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class FixKeyLocation extends Command {
+	private IUserManager $userManager;
+	private IUserMountCache $userMountCache;
+	private Util $encryptionUtil;
+	private IRootFolder $rootFolder;
+	private string $keyRootDirectory;
+	private View $rootView;
+	private Manager $encryptionManager;
+
+	public function __construct(
+		IUserManager $userManager,
+		IUserMountCache $userMountCache,
+		Util $encryptionUtil,
+		IRootFolder $rootFolder,
+		IManager $encryptionManager
+	) {
+		$this->userManager = $userManager;
+		$this->userMountCache = $userMountCache;
+		$this->encryptionUtil = $encryptionUtil;
+		$this->rootFolder = $rootFolder;
+		$this->keyRootDirectory = rtrim($this->encryptionUtil->getKeyStorageRoot(), '/');
+		$this->rootView = new View();
+		if (!$encryptionManager instanceof Manager) {
+			throw new \Exception("Wrong encryption manager");
+		}
+		$this->encryptionManager = $encryptionManager;
+
+		parent::__construct();
+	}
+
+
+	protected function configure(): void {
+		parent::configure();
+
+		$this
+			->setName('encryption:fix-key-location')
+			->setDescription('Fix the location of encryption keys for external storage')
+			->addOption('dry-run', null, InputOption::VALUE_NONE, "Only list files that require key migration, don't try to perform any migration")
+			->addArgument('user', InputArgument::REQUIRED, "User id to fix the key locations for");
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$dryRun = $input->getOption('dry-run');
+		$userId = $input->getArgument('user');
+		$user = $this->userManager->get($userId);
+		if (!$user) {
+			$output->writeln("<error>User $userId not found</error>");
+			return 1;
+		}
+
+		\OC_Util::setupFS($user->getUID());
+
+		$mounts = $this->getSystemMountsForUser($user);
+		foreach ($mounts as $mount) {
+			$mountRootFolder = $this->rootFolder->get($mount->getMountPoint());
+			if (!$mountRootFolder instanceof Folder) {
+				$output->writeln("<error>System wide mount point is not a directory, skipping: " . $mount->getMountPoint() . "</error>");
+				continue;
+			}
+
+			$files = $this->getAllEncryptedFiles($mountRootFolder);
+			foreach ($files as $file) {
+				/** @var File $file */
+				$hasSystemKey = $this->hasSystemKey($file);
+				$hasUserKey = $this->hasUserKey($user, $file);
+				if (!$hasSystemKey) {
+					if ($hasUserKey) {
+						// key was stored incorrectly as user key, migrate
+
+						if ($dryRun) {
+							$output->writeln("<info>" . $file->getPath() . "</info> needs migration");
+						} else {
+							$output->write("Migrating key for <info>" . $file->getPath() . "</info> ");
+							if ($this->copyUserKeyToSystemAndValidate($user, $file)) {
+								$output->writeln("<info>✓</info>");
+							} else {
+								$output->writeln("<fg=red>❌</>");
+								$output->writeln("  Failed to validate key for <error>" . $file->getPath() . "</error>, key will not be migrated");
+							}
+						}
+					} else {
+						// no matching key, probably from a broken cross-storage move
+
+						$shouldBeEncrypted = $file->getStorage()->instanceOfStorage(Encryption::class);
+						$isActuallyEncrypted = $this->isDataEncrypted($file);
+						if ($isActuallyEncrypted) {
+							if ($dryRun) {
+								if ($shouldBeEncrypted) {
+									$output->write("<info>" . $file->getPath() . "</info> needs migration");
+								} else {
+									$output->write("<info>" . $file->getPath() . "</info> needs decryption");
+								}
+								$foundKey = $this->findUserKeyForSystemFile($user, $file);
+								if ($foundKey) {
+									$output->writeln(", valid key found at <info>" . $foundKey . "</info>");
+								} else {
+									$output->writeln(" <error>❌ No key found</error>");
+								}
+							} else {
+								if ($shouldBeEncrypted) {
+									$output->write("<info>Migrating key for " . $file->getPath() . "</info>");
+								} else {
+									$output->write("<info>Decrypting " . $file->getPath() . "</info>");
+								}
+								$foundKey = $this->findUserKeyForSystemFile($user, $file);
+								if ($foundKey) {
+									if ($shouldBeEncrypted) {
+										$systemKeyPath = $this->getSystemKeyPath($file);
+										$this->rootView->copy($foundKey, $systemKeyPath);
+										$output->writeln("  Migrated key from <info>" . $foundKey . "</info>");
+									} else {
+										$this->decryptWithSystemKey($file, $foundKey);
+										$output->writeln("  Decrypted with key from <info>" . $foundKey . "</info>");
+									}
+								} else {
+									$output->writeln(" <error>❌ No key found</error>");
+								}
+							}
+						} else {
+							if ($dryRun) {
+								$output->writeln("<info>" . $file->getPath() . " needs to be marked as not encrypted</info>");
+							} else {
+								$this->markAsUnEncrypted($file);
+								$output->writeln("<info>" . $file->getPath() . " marked as not encrypted</info>");
+							}
+						}
+					}
+				}
+			}
+		}
+
+		return 0;
+	}
+
+	private function getUserRelativePath(string $path): string {
+		$parts = explode('/', $path, 3);
+		if (count($parts) >= 3) {
+			return '/' . $parts[2];
+		} else {
+			return '';
+		}
+	}
+
+	/**
+	 * @param IUser $user
+	 * @return ICachedMountInfo[]
+	 */
+	private function getSystemMountsForUser(IUser $user): array {
+		return array_filter($this->userMountCache->getMountsForUser($user), function (ICachedMountInfo $mount) use (
+			$user
+		) {
+			$mountPoint = substr($mount->getMountPoint(), strlen($user->getUID() . '/'));
+			return $this->encryptionUtil->isSystemWideMountPoint($mountPoint, $user->getUID());
+		});
+	}
+
+	/**
+	 * Get all files in a folder which are marked as encrypted
+	 *
+	 * @param Folder $folder
+	 * @return \Generator<File>
+	 */
+	private function getAllEncryptedFiles(Folder $folder) {
+		foreach ($folder->getDirectoryListing() as $child) {
+			if ($child instanceof Folder) {
+				yield from $this->getAllEncryptedFiles($child);
+			} else {
+				if (substr($child->getName(), -4) !== '.bak' && $child->isEncrypted()) {
+					yield $child;
+				}
+			}
+		}
+	}
+
+	private function getSystemKeyPath(Node $node): string {
+		$path = $this->getUserRelativePath($node->getPath());
+		return $this->keyRootDirectory . '/files_encryption/keys/' . $path . '/';
+	}
+
+	private function getUserBaseKeyPath(IUser $user): string {
+		return $this->keyRootDirectory . '/' . $user->getUID() . '/files_encryption/keys';
+	}
+
+	private function getUserKeyPath(IUser $user, Node $node): string {
+		$path = $this->getUserRelativePath($node->getPath());
+		return $this->getUserBaseKeyPath($user) . '/' . $path . '/';
+	}
+
+	private function hasSystemKey(Node $node): bool {
+		// this uses View instead of the RootFolder because the keys might not be in the cache
+		return $this->rootView->file_exists($this->getSystemKeyPath($node));
+	}
+
+	private function hasUserKey(IUser $user, Node $node): bool {
+		// this uses View instead of the RootFolder because the keys might not be in the cache
+		return $this->rootView->file_exists($this->getUserKeyPath($user, $node));
+	}
+
+	/**
+	 * Check that the user key stored for a file can decrypt the file
+	 *
+	 * @param IUser $user
+	 * @param File $node
+	 * @return bool
+	 */
+	private function copyUserKeyToSystemAndValidate(IUser $user, File $node): bool {
+		$path = trim(substr($node->getPath(), strlen($user->getUID()) + 1), '/');
+		$systemKeyPath = $this->keyRootDirectory . '/files_encryption/keys/' . $path . '/';
+		$userKeyPath = $this->keyRootDirectory . '/' . $user->getUID() . '/files_encryption/keys/' . $path . '/';
+
+		$this->rootView->copy($userKeyPath, $systemKeyPath);
+		if ($this->tryReadFile($node)) {
+			// cleanup wrong key location
+			$this->rootView->rmdir($userKeyPath);
+			return true;
+		} else {
+			// remove the copied key if we know it's invalid
+			$this->rootView->rmdir($systemKeyPath);
+			return false;
+		}
+	}
+
+	private function tryReadFile(File $node): bool {
+		try {
+			$fh = $node->fopen('r');
+			// read a single chunk
+			$data = fread($fh, 8192);
+			if ($data === false) {
+				return false;
+			} else {
+				return true;
+			}
+		} catch (\Exception $e) {
+			return false;
+		}
+	}
+
+	/**
+	 * Get the contents of a file without decrypting it
+	 *
+	 * @param File $node
+	 * @return resource
+	 */
+	private function openWithoutDecryption(File $node, string $mode) {
+		$storage = $node->getStorage();
+		$internalPath = $node->getInternalPath();
+		if ($storage->instanceOfStorage(Encryption::class)) {
+			/** @var Encryption $storage */
+			try {
+				$storage->setEnabled(false);
+				$handle = $storage->fopen($internalPath, 'r');
+				$storage->setEnabled(true);
+			} catch (\Exception $e) {
+				$storage->setEnabled(true);
+				throw $e;
+			}
+		} else {
+			$handle = $storage->fopen($internalPath, $mode);
+		}
+		/** @var resource|false $handle */
+		if ($handle === false) {
+			throw new \Exception("Failed to open " . $node->getPath());
+		}
+		return $handle;
+	}
+
+	/**
+	 * Check if the data stored for a file is encrypted, regardless of it's metadata
+	 *
+	 * @param File $node
+	 * @return bool
+	 */
+	private function isDataEncrypted(File $node): bool {
+		$handle = $this->openWithoutDecryption($node, 'r');
+		$firstBlock = fread($handle, $this->encryptionUtil->getHeaderSize());
+		fclose($handle);
+
+		$header = $this->encryptionUtil->parseRawHeader($firstBlock);
+		return isset($header['oc_encryption_module']);
+	}
+
+	/**
+	 * Attempt to find a key (stored for user) for a file (that needs a system key) even when it's not stored in the expected location
+	 *
+	 * @param File $node
+	 * @return string
+	 */
+	private function findUserKeyForSystemFile(IUser $user, File $node): ?string {
+		$userKeyPath = $this->getUserBaseKeyPath($user);
+		$possibleKeys = $this->findKeysByFileName($userKeyPath, $node->getName());
+		foreach ($possibleKeys as $possibleKey) {
+			if ($this->testSystemKey($user, $possibleKey, $node)) {
+				return $possibleKey;
+			}
+		}
+		return null;
+	}
+
+	/**
+	 * Attempt to find a key for a file even when it's not stored in the expected location
+	 *
+	 * @param string $basePath
+	 * @param string $name
+	 * @return \Generator<string>
+	 */
+	private function findKeysByFileName(string $basePath, string $name) {
+		if ($this->rootView->is_dir($basePath . '/' . $name . '/OC_DEFAULT_MODULE')) {
+			yield $basePath . '/' . $name;
+		} else {
+			/** @var false|resource $dh */
+			$dh = $this->rootView->opendir($basePath);
+			if (!$dh) {
+				throw new \Exception("Invalid base path " . $basePath);
+			}
+			while ($child = readdir($dh)) {
+				if ($child != '..' && $child != '.') {
+					$childPath = $basePath . '/' . $child;
+
+					// recurse if the child is not a key folder
+					if ($this->rootView->is_dir($childPath) && !is_dir($childPath . '/OC_DEFAULT_MODULE')) {
+						yield from $this->findKeysByFileName($childPath, $name);
+					}
+				}
+			}
+		}
+	}
+
+	/**
+	 * Test if the provided key is valid as a system key for the file
+	 *
+	 * @param IUser $user
+	 * @param string $key
+	 * @param File $node
+	 * @return bool
+	 */
+	private function testSystemKey(IUser $user, string $key, File $node): bool {
+		$systemKeyPath = $this->getSystemKeyPath($node);
+
+		if ($this->rootView->file_exists($systemKeyPath)) {
+			// already has a key, reject new key
+			return false;
+		}
+
+		$this->rootView->copy($key, $systemKeyPath);
+		$isValid = $this->tryReadFile($node);
+		$this->rootView->rmdir($systemKeyPath);
+		return $isValid;
+	}
+
+	/**
+	 * Decrypt a file with the specified system key and mark the key as not-encrypted
+	 *
+	 * @param File $node
+	 * @param string $key
+	 * @return void
+	 */
+	private function decryptWithSystemKey(File $node, string $key): void {
+		$storage = $node->getStorage();
+		$name = $node->getName();
+
+		$node->move($node->getPath() . '.bak');
+		$systemKeyPath = $this->getSystemKeyPath($node);
+		$this->rootView->copy($key, $systemKeyPath);
+
+		try {
+			if (!$storage->instanceOfStorage(Encryption::class)) {
+				$storage = $this->encryptionManager->forceWrapStorage($node->getMountPoint(), $storage);
+			}
+			/** @var false|resource $source */
+			$source = $storage->fopen($node->getInternalPath(), 'r');
+			if (!$source) {
+				throw new \Exception("Failed to open " . $node->getPath() . " with " . $key);
+			}
+			$decryptedNode = $node->getParent()->newFile($name);
+
+			$target = $this->openWithoutDecryption($decryptedNode, 'w');
+			stream_copy_to_stream($source, $target);
+			fclose($target);
+			fclose($source);
+
+			$decryptedNode->getStorage()->getScanner()->scan($decryptedNode->getInternalPath());
+		} catch (\Exception $e) {
+			$this->rootView->rmdir($systemKeyPath);
+
+			// remove the .bak
+			$node->move(substr($node->getPath(), 0, -4));
+
+			throw $e;
+		}
+
+		if ($this->isDataEncrypted($decryptedNode)) {
+			throw new \Exception($node->getPath() . " still encrypted after attempting to decrypt with " . $key);
+		}
+
+		$this->markAsUnEncrypted($decryptedNode);
+
+		$this->rootView->rmdir($systemKeyPath);
+	}
+
+	private function markAsUnEncrypted(Node $node): void {
+		$node->getStorage()->getCache()->update($node->getId(), ['encrypted' => 0]);
+	}
+}

wedding-pics/apps/encryption/lib/Command/RecoverUser.php

@@ -0,0 +1,112 @@
+<?php
+/**
+ * @copyright Copyright (c) 2018 Bjoern Schiessle <bjoern@schiessle.org>
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Encryption\Command;
+
+use OCA\Encryption\Util;
+use OCP\IConfig;
+use OCP\IUserManager;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Helper\QuestionHelper;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Question\Question;
+
+class RecoverUser extends Command {
+
+	/** @var Util */
+	protected $util;
+
+	/** @var IUserManager */
+	protected $userManager;
+
+	/** @var  QuestionHelper */
+	protected $questionHelper;
+
+	/**
+	 * @param Util $util
+	 * @param IConfig $config
+	 * @param IUserManager $userManager
+	 * @param QuestionHelper $questionHelper
+	 */
+	public function __construct(Util $util,
+		IConfig $config,
+		IUserManager $userManager,
+		QuestionHelper $questionHelper) {
+		$this->util = $util;
+		$this->questionHelper = $questionHelper;
+		$this->userManager = $userManager;
+		parent::__construct();
+	}
+
+	protected function configure() {
+		$this
+			->setName('encryption:recover-user')
+			->setDescription('Recover user data in case of password lost. This only works if the user enabled the recovery key.');
+
+		$this->addArgument(
+			'user',
+			InputArgument::REQUIRED,
+			'user which should be recovered'
+		);
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$isMasterKeyEnabled = $this->util->isMasterKeyEnabled();
+
+		if ($isMasterKeyEnabled) {
+			$output->writeln('You use the master key, no individual user recovery needed.');
+			return 0;
+		}
+
+		$uid = $input->getArgument('user');
+		$userExists = $this->userManager->userExists($uid);
+		if ($userExists === false) {
+			$output->writeln('User "' . $uid . '" unknown.');
+			return 1;
+		}
+
+		$recoveryKeyEnabled = $this->util->isRecoveryEnabledForUser($uid);
+		if ($recoveryKeyEnabled === false) {
+			$output->writeln('Recovery key is not enabled for: ' . $uid);
+			return 1;
+		}
+
+		$question = new Question('Please enter the recovery key password: ');
+		$question->setHidden(true);
+		$question->setHiddenFallback(false);
+		$recoveryPassword = $this->questionHelper->ask($input, $output, $question);
+
+		$question = new Question('Please enter the new login password for the user: ');
+		$question->setHidden(true);
+		$question->setHiddenFallback(false);
+		$newLoginPassword = $this->questionHelper->ask($input, $output, $question);
+
+		$output->write('Start to recover users files... This can take some time...');
+		$this->userManager->get($uid)->setPassword($newLoginPassword, $recoveryPassword);
+		$output->writeln('Done.');
+		return 0;
+	}
+}

wedding-pics/apps/encryption/lib/Command/ScanLegacyFormat.php

@@ -0,0 +1,140 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author essys <essys@users.noreply.github.com>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Encryption\Command;
+
+use OC\Files\View;
+use OCA\Encryption\Util;
+use OCP\IConfig;
+use OCP\IUserManager;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Helper\QuestionHelper;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class ScanLegacyFormat extends Command {
+	/** @var Util */
+	protected $util;
+
+	/** @var IConfig */
+	protected $config;
+
+	/** @var  QuestionHelper */
+	protected $questionHelper;
+
+	/** @var IUserManager */
+	private $userManager;
+
+	/** @var View */
+	private $rootView;
+
+	/**
+	 * @param Util $util
+	 * @param IConfig $config
+	 * @param QuestionHelper $questionHelper
+	 */
+	public function __construct(Util $util,
+		IConfig $config,
+		QuestionHelper $questionHelper,
+		IUserManager $userManager) {
+		parent::__construct();
+
+		$this->util = $util;
+		$this->config = $config;
+		$this->questionHelper = $questionHelper;
+		$this->userManager = $userManager;
+		$this->rootView = new View();
+	}
+
+	protected function configure() {
+		$this
+			->setName('encryption:scan:legacy-format')
+			->setDescription('Scan the files for the legacy format');
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$result = true;
+
+		$output->writeln('Scanning all files for legacy encryption');
+
+		foreach ($this->userManager->getBackends() as $backend) {
+			$limit = 500;
+			$offset = 0;
+			do {
+				$users = $backend->getUsers('', $limit, $offset);
+				foreach ($users as $user) {
+					$output->writeln('Scanning all files for ' . $user);
+					$this->setupUserFS($user);
+					$result = $result && $this->scanFolder($output, '/' . $user);
+				}
+				$offset += $limit;
+			} while (count($users) >= $limit);
+		}
+
+		if ($result) {
+			$output->writeln('All scanned files are properly encrypted. You can disable the legacy compatibility mode.');
+			return 0;
+		}
+
+		return 1;
+	}
+
+	private function scanFolder(OutputInterface $output, string $folder): bool {
+		$clean = true;
+
+		foreach ($this->rootView->getDirectoryContent($folder) as $item) {
+			$path = $folder . '/' . $item['name'];
+			if ($this->rootView->is_dir($path)) {
+				if ($this->scanFolder($output, $path) === false) {
+					$clean = false;
+				}
+			} else {
+				if (!$item->isEncrypted()) {
+					// ignore
+					continue;
+				}
+
+				$stats = $this->rootView->stat($path);
+				if (!isset($stats['hasHeader']) || $stats['hasHeader'] === false) {
+					$clean = false;
+					$output->writeln($path . ' does not have a proper header');
+				}
+			}
+		}
+
+		return $clean;
+	}
+
+	/**
+	 * setup user file system
+	 *
+	 * @param string $uid
+	 */
+	protected function setupUserFS($uid) {
+		\OC_Util::tearDownFS();
+		\OC_Util::setupFS($uid);
+	}
+}

wedding-pics/apps/encryption/lib/Controller/RecoveryController.php

@@ -0,0 +1,191 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Controller;
+
+use OCA\Encryption\Recovery;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IRequest;
+
+class RecoveryController extends Controller {
+	/**
+	 * @var IConfig
+	 */
+	private $config;
+	/**
+	 * @var IL10N
+	 */
+	private $l;
+	/**
+	 * @var Recovery
+	 */
+	private $recovery;
+
+	/**
+	 * @param string $AppName
+	 * @param IRequest $request
+	 * @param IConfig $config
+	 * @param IL10N $l10n
+	 * @param Recovery $recovery
+	 */
+	public function __construct($AppName,
+		IRequest $request,
+		IConfig $config,
+		IL10N $l10n,
+		Recovery $recovery) {
+		parent::__construct($AppName, $request);
+		$this->config = $config;
+		$this->l = $l10n;
+		$this->recovery = $recovery;
+	}
+
+	/**
+	 * @param string $recoveryPassword
+	 * @param string $confirmPassword
+	 * @param string $adminEnableRecovery
+	 * @return DataResponse
+	 */
+	public function adminRecovery($recoveryPassword, $confirmPassword, $adminEnableRecovery) {
+		// Check if both passwords are the same
+		if (empty($recoveryPassword)) {
+			$errorMessage = $this->l->t('Missing recovery key password');
+			return new DataResponse(['data' => ['message' => $errorMessage]],
+				Http::STATUS_BAD_REQUEST);
+		}
+
+		if (empty($confirmPassword)) {
+			$errorMessage = $this->l->t('Please repeat the recovery key password');
+			return new DataResponse(['data' => ['message' => $errorMessage]],
+				Http::STATUS_BAD_REQUEST);
+		}
+
+		if ($recoveryPassword !== $confirmPassword) {
+			$errorMessage = $this->l->t('Repeated recovery key password does not match the provided recovery key password');
+			return new DataResponse(['data' => ['message' => $errorMessage]],
+				Http::STATUS_BAD_REQUEST);
+		}
+
+		if (isset($adminEnableRecovery) && $adminEnableRecovery === '1') {
+			if ($this->recovery->enableAdminRecovery($recoveryPassword)) {
+				return new DataResponse(['data' => ['message' => $this->l->t('Recovery key successfully enabled')]]);
+			}
+			return new DataResponse(['data' => ['message' => $this->l->t('Could not enable recovery key. Please check your recovery key password!')]], Http::STATUS_BAD_REQUEST);
+		} elseif (isset($adminEnableRecovery) && $adminEnableRecovery === '0') {
+			if ($this->recovery->disableAdminRecovery($recoveryPassword)) {
+				return new DataResponse(['data' => ['message' => $this->l->t('Recovery key successfully disabled')]]);
+			}
+			return new DataResponse(['data' => ['message' => $this->l->t('Could not disable recovery key. Please check your recovery key password!')]], Http::STATUS_BAD_REQUEST);
+		}
+		// this response should never be sent but just in case.
+		return new DataResponse(['data' => ['message' => $this->l->t('Missing parameters')]], Http::STATUS_BAD_REQUEST);
+	}
+
+	/**
+	 * @param string $newPassword
+	 * @param string $oldPassword
+	 * @param string $confirmPassword
+	 * @return DataResponse
+	 */
+	public function changeRecoveryPassword($newPassword, $oldPassword, $confirmPassword) {
+		//check if both passwords are the same
+		if (empty($oldPassword)) {
+			$errorMessage = $this->l->t('Please provide the old recovery password');
+			return new DataResponse(['data' => ['message' => $errorMessage]], Http::STATUS_BAD_REQUEST);
+		}
+
+		if (empty($newPassword)) {
+			$errorMessage = $this->l->t('Please provide a new recovery password');
+			return new DataResponse(['data' => ['message' => $errorMessage]], Http::STATUS_BAD_REQUEST);
+		}
+
+		if (empty($confirmPassword)) {
+			$errorMessage = $this->l->t('Please repeat the new recovery password');
+			return new DataResponse(['data' => ['message' => $errorMessage]], Http::STATUS_BAD_REQUEST);
+		}
+
+		if ($newPassword !== $confirmPassword) {
+			$errorMessage = $this->l->t('Repeated recovery key password does not match the provided recovery key password');
+			return new DataResponse(['data' => ['message' => $errorMessage]], Http::STATUS_BAD_REQUEST);
+		}
+
+		$result = $this->recovery->changeRecoveryKeyPassword($newPassword,
+			$oldPassword);
+
+		if ($result) {
+			return new DataResponse(
+				[
+					'data' => [
+						'message' => $this->l->t('Password successfully changed.')]
+				]
+			);
+		}
+		return new DataResponse(
+			[
+				'data' => [
+					'message' => $this->l->t('Could not change the password. Maybe the old password was not correct.')
+				]
+			], Http::STATUS_BAD_REQUEST);
+	}
+
+	/**
+	 * @NoAdminRequired
+	 *
+	 * @param string $userEnableRecovery
+	 * @return DataResponse
+	 */
+	public function userSetRecovery($userEnableRecovery) {
+		if ($userEnableRecovery === '0' || $userEnableRecovery === '1') {
+			$result = $this->recovery->setRecoveryForUser($userEnableRecovery);
+
+			if ($result) {
+				if ($userEnableRecovery === '0') {
+					return new DataResponse(
+						[
+							'data' => [
+								'message' => $this->l->t('Recovery Key disabled')]
+						]
+					);
+				}
+				return new DataResponse(
+					[
+						'data' => [
+							'message' => $this->l->t('Recovery Key enabled')]
+					]
+				);
+			}
+		}
+		return new DataResponse(
+			[
+				'data' => [
+					'message' => $this->l->t('Could not enable the recovery key, please try again or contact your administrator')
+				]
+			], Http::STATUS_BAD_REQUEST);
+	}
+}

wedding-pics/apps/encryption/lib/Controller/SettingsController.php

@@ -0,0 +1,165 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Controller;
+
+use OCA\Encryption\Crypto\Crypt;
+use OCA\Encryption\KeyManager;
+use OCA\Encryption\Session;
+use OCA\Encryption\Util;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\ISession;
+use OCP\IUserManager;
+use OCP\IUserSession;
+
+class SettingsController extends Controller {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IUserManager */
+	private $userManager;
+
+	/** @var IUserSession */
+	private $userSession;
+
+	/** @var KeyManager */
+	private $keyManager;
+
+	/** @var Crypt */
+	private $crypt;
+
+	/** @var Session */
+	private $session;
+
+	/** @var ISession  */
+	private $ocSession;
+
+	/** @var  Util */
+	private $util;
+
+	/**
+	 * @param string $AppName
+	 * @param IRequest $request
+	 * @param IL10N $l10n
+	 * @param IUserManager $userManager
+	 * @param IUserSession $userSession
+	 * @param KeyManager $keyManager
+	 * @param Crypt $crypt
+	 * @param Session $session
+	 * @param ISession $ocSession
+	 * @param Util $util
+	 */
+	public function __construct($AppName,
+		IRequest $request,
+		IL10N $l10n,
+		IUserManager $userManager,
+		IUserSession $userSession,
+		KeyManager $keyManager,
+		Crypt $crypt,
+		Session $session,
+		ISession $ocSession,
+		Util $util
+	) {
+		parent::__construct($AppName, $request);
+		$this->l = $l10n;
+		$this->userSession = $userSession;
+		$this->userManager = $userManager;
+		$this->keyManager = $keyManager;
+		$this->crypt = $crypt;
+		$this->session = $session;
+		$this->ocSession = $ocSession;
+		$this->util = $util;
+	}
+
+
+	/**
+	 * @NoAdminRequired
+	 * @UseSession
+	 *
+	 * @param string $oldPassword
+	 * @param string $newPassword
+	 * @return DataResponse
+	 */
+	public function updatePrivateKeyPassword($oldPassword, $newPassword) {
+		$result = false;
+		$uid = $this->userSession->getUser()->getUID();
+		$errorMessage = $this->l->t('Could not update the private key password.');
+
+		//check if password is correct
+		$passwordCorrect = $this->userManager->checkPassword($uid, $newPassword);
+		if ($passwordCorrect === false) {
+			// if check with uid fails we need to check the password with the login name
+			// e.g. in the ldap case. For local user we need to check the password with
+			// the uid because in this case the login name is case insensitive
+			$loginName = $this->ocSession->get('loginname');
+			$passwordCorrect = $this->userManager->checkPassword($loginName, $newPassword);
+		}
+
+		if ($passwordCorrect !== false) {
+			$encryptedKey = $this->keyManager->getPrivateKey($uid);
+			$decryptedKey = $this->crypt->decryptPrivateKey($encryptedKey, $oldPassword, $uid);
+
+			if ($decryptedKey) {
+				$encryptedKey = $this->crypt->encryptPrivateKey($decryptedKey, $newPassword, $uid);
+				$header = $this->crypt->generateHeader();
+				if ($encryptedKey) {
+					$this->keyManager->setPrivateKey($uid, $header . $encryptedKey);
+					$this->session->setPrivateKey($decryptedKey);
+					$result = true;
+				}
+			} else {
+				$errorMessage = $this->l->t('The old password was not correct, please try again.');
+			}
+		} else {
+			$errorMessage = $this->l->t('The current log-in password was not correct, please try again.');
+		}
+
+		if ($result === true) {
+			$this->session->setStatus(Session::INIT_SUCCESSFUL);
+			return new DataResponse(
+				['message' => $this->l->t('Private key password successfully updated.')]
+			);
+		} else {
+			return new DataResponse(
+				['message' => $errorMessage],
+				Http::STATUS_BAD_REQUEST
+			);
+		}
+	}
+
+	/**
+	 * @UseSession
+	 *
+	 * @param bool $encryptHomeStorage
+	 * @return DataResponse
+	 */
+	public function setEncryptHomeStorage($encryptHomeStorage) {
+		$this->util->setEncryptHomeStorage($encryptHomeStorage);
+		return new DataResponse();
+	}
+}

wedding-pics/apps/encryption/lib/Controller/StatusController.php

@@ -0,0 +1,105 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Controller;
+
+use OCA\Encryption\Session;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\Encryption\IManager;
+use OCP\IL10N;
+use OCP\IRequest;
+
+class StatusController extends Controller {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var Session */
+	private $session;
+
+	/** @var IManager */
+	private $encryptionManager;
+
+	/**
+	 * @param string $AppName
+	 * @param IRequest $request
+	 * @param IL10N $l10n
+	 * @param Session $session
+	 * @param IManager $encryptionManager
+	 */
+	public function __construct($AppName,
+		IRequest $request,
+		IL10N $l10n,
+		Session $session,
+		IManager $encryptionManager
+	) {
+		parent::__construct($AppName, $request);
+		$this->l = $l10n;
+		$this->session = $session;
+		$this->encryptionManager = $encryptionManager;
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @return DataResponse
+	 */
+	public function getStatus() {
+		$status = 'error';
+		$message = 'no valid init status';
+		switch ($this->session->getStatus()) {
+			case Session::INIT_EXECUTED:
+				$status = 'interactionNeeded';
+				$message = $this->l->t(
+					'Invalid private key for encryption app. Please update your private key password in your personal settings to recover access to your encrypted files.'
+				);
+				break;
+			case Session::NOT_INITIALIZED:
+				$status = 'interactionNeeded';
+				if ($this->encryptionManager->isEnabled()) {
+					$message = $this->l->t(
+						'Encryption App is enabled, but your keys are not initialized. Please log-out and log-in again.'
+					);
+				} else {
+					$message = $this->l->t(
+						'Please enable server side encryption in the admin settings in order to use the encryption module.'
+					);
+				}
+				break;
+			case Session::INIT_SUCCESSFUL:
+				$status = 'success';
+				$message = $this->l->t('Encryption app is enabled and ready');
+		}
+
+		return new DataResponse(
+			[
+				'status' => $status,
+				'data' => [
+					'message' => $message]
+			]
+		);
+	}
+}

wedding-pics/apps/encryption/lib/Crypto/Crypt.php

@@ -0,0 +1,840 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Kevin Niehage <kevin@niehage.name>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Stefan Weiberg <sweiberg@suse.com>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Crypto;
+
+use OC\Encryption\Exceptions\DecryptionFailedException;
+use OC\Encryption\Exceptions\EncryptionFailedException;
+use OC\ServerNotAvailableException;
+use OCA\Encryption\Exceptions\MultiKeyDecryptException;
+use OCA\Encryption\Exceptions\MultiKeyEncryptException;
+use OCP\Encryption\Exceptions\GenericEncryptionException;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IUserSession;
+use phpseclib\Crypt\RC4;
+use Psr\Log\LoggerInterface;
+
+/**
+ * Class Crypt provides the encryption implementation of the default Nextcloud
+ * encryption module. As default AES-256-CTR is used, it does however offer support
+ * for the following modes:
+ *
+ * - AES-256-CTR
+ * - AES-128-CTR
+ * - AES-256-CFB
+ * - AES-128-CFB
+ *
+ * For integrity protection Encrypt-Then-MAC using HMAC-SHA256 is used.
+ *
+ * @package OCA\Encryption\Crypto
+ */
+class Crypt {
+	public const SUPPORTED_CIPHERS_AND_KEY_SIZE = [
+		'AES-256-CTR' => 32,
+		'AES-128-CTR' => 16,
+		'AES-256-CFB' => 32,
+		'AES-128-CFB' => 16,
+	];
+	// one out of SUPPORTED_CIPHERS_AND_KEY_SIZE
+	public const DEFAULT_CIPHER = 'AES-256-CTR';
+	// default cipher from old Nextcloud versions
+	public const LEGACY_CIPHER = 'AES-128-CFB';
+
+	public const SUPPORTED_KEY_FORMATS = ['hash2', 'hash', 'password'];
+	// one out of SUPPORTED_KEY_FORMATS
+	public const DEFAULT_KEY_FORMAT = 'hash2';
+	// default key format, old Nextcloud version encrypted the private key directly
+	// with the user password
+	public const LEGACY_KEY_FORMAT = 'password';
+
+	public const HEADER_START = 'HBEGIN';
+	public const HEADER_END = 'HEND';
+
+	// default encoding format, old Nextcloud versions used base64
+	public const BINARY_ENCODING_FORMAT = 'binary';
+
+	private string $user;
+
+	private ?string $currentCipher = null;
+
+	private bool $supportLegacy;
+
+	/**
+	 * Use the legacy base64 encoding instead of the more space-efficient binary encoding.
+	 */
+	private bool $useLegacyBase64Encoding;
+
+	public function __construct(
+		private LoggerInterface $logger,
+		IUserSession $userSession,
+		private IConfig $config,
+		private IL10N $l,
+	) {
+		$this->user = $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : '"no user given"';
+		$this->supportLegacy = $this->config->getSystemValueBool('encryption.legacy_format_support', false);
+		$this->useLegacyBase64Encoding = $this->config->getSystemValueBool('encryption.use_legacy_base64_encoding', false);
+	}
+
+	/**
+	 * create new private/public key-pair for user
+	 *
+	 * @return array|bool
+	 */
+	public function createKeyPair() {
+		$res = $this->getOpenSSLPKey();
+
+		if (!$res) {
+			$this->logger->error("Encryption Library couldn't generate users key-pair for {$this->user}",
+				['app' => 'encryption']);
+
+			if (openssl_error_string()) {
+				$this->logger->error('Encryption library openssl_pkey_new() fails: ' . openssl_error_string(),
+					['app' => 'encryption']);
+			}
+		} elseif (openssl_pkey_export($res,
+			$privateKey,
+			null,
+			$this->getOpenSSLConfig())) {
+			$keyDetails = openssl_pkey_get_details($res);
+			$publicKey = $keyDetails['key'];
+
+			return [
+				'publicKey' => $publicKey,
+				'privateKey' => $privateKey
+			];
+		}
+		$this->logger->error('Encryption library couldn\'t export users private key, please check your servers OpenSSL configuration.' . $this->user,
+			['app' => 'encryption']);
+		if (openssl_error_string()) {
+			$this->logger->error('Encryption Library:' . openssl_error_string(),
+				['app' => 'encryption']);
+		}
+
+		return false;
+	}
+
+	/**
+	 * Generates a new private key
+	 *
+	 * @return \OpenSSLAsymmetricKey|false
+	 */
+	public function getOpenSSLPKey() {
+		$config = $this->getOpenSSLConfig();
+		return openssl_pkey_new($config);
+	}
+
+	private function getOpenSSLConfig(): array {
+		$config = ['private_key_bits' => 4096];
+		$config = array_merge(
+			$config,
+			$this->config->getSystemValue('openssl', [])
+		);
+		return $config;
+	}
+
+	/**
+	 * @throws EncryptionFailedException
+	 */
+	public function symmetricEncryptFileContent(string $plainContent, string $passPhrase, int $version, string $position): string|false {
+		if (!$plainContent) {
+			$this->logger->error('Encryption Library, symmetrical encryption failed no content given',
+				['app' => 'encryption']);
+			return false;
+		}
+
+		$iv = $this->generateIv();
+
+		$encryptedContent = $this->encrypt($plainContent,
+			$iv,
+			$passPhrase,
+			$this->getCipher());
+
+		// Create a signature based on the key as well as the current version
+		$sig = $this->createSignature($encryptedContent, $passPhrase.'_'.$version.'_'.$position);
+
+		// combine content to encrypt the IV identifier and actual IV
+		$catFile = $this->concatIV($encryptedContent, $iv);
+		$catFile = $this->concatSig($catFile, $sig);
+		return $this->addPadding($catFile);
+	}
+
+	/**
+	 * generate header for encrypted file
+	 *
+	 * @param string $keyFormat see SUPPORTED_KEY_FORMATS
+	 * @return string
+	 * @throws \InvalidArgumentException
+	 */
+	public function generateHeader($keyFormat = self::DEFAULT_KEY_FORMAT) {
+		if (in_array($keyFormat, self::SUPPORTED_KEY_FORMATS, true) === false) {
+			throw new \InvalidArgumentException('key format "' . $keyFormat . '" is not supported');
+		}
+
+		$header = self::HEADER_START
+			. ':cipher:' . $this->getCipher()
+			. ':keyFormat:' . $keyFormat;
+
+		if ($this->useLegacyBase64Encoding !== true) {
+			$header .= ':encoding:' . self::BINARY_ENCODING_FORMAT;
+		}
+
+		$header .= ':' . self::HEADER_END;
+
+		return $header;
+	}
+
+	/**
+	 * @throws EncryptionFailedException
+	 */
+	private function encrypt(string $plainContent, string $iv, string $passPhrase = '', string $cipher = self::DEFAULT_CIPHER): string {
+		$options = $this->useLegacyBase64Encoding ? 0 : OPENSSL_RAW_DATA;
+		$encryptedContent = openssl_encrypt($plainContent,
+			$cipher,
+			$passPhrase,
+			$options,
+			$iv);
+
+		if (!$encryptedContent) {
+			$error = 'Encryption (symmetric) of content failed';
+			$this->logger->error($error . openssl_error_string(),
+				['app' => 'encryption']);
+			throw new EncryptionFailedException($error);
+		}
+
+		return $encryptedContent;
+	}
+
+	/**
+	 * return cipher either from config.php or the default cipher defined in
+	 * this class
+	 */
+	private function getCachedCipher(): string {
+		if (isset($this->currentCipher)) {
+			return $this->currentCipher;
+		}
+
+		// Get cipher either from config.php or the default cipher defined in this class
+		$cipher = $this->config->getSystemValueString('cipher', self::DEFAULT_CIPHER);
+		if (!isset(self::SUPPORTED_CIPHERS_AND_KEY_SIZE[$cipher])) {
+			$this->logger->warning(
+				sprintf(
+					'Unsupported cipher (%s) defined in config.php supported. Falling back to %s',
+					$cipher,
+					self::DEFAULT_CIPHER
+				),
+				['app' => 'encryption']
+			);
+			$cipher = self::DEFAULT_CIPHER;
+		}
+
+		// Remember current cipher to avoid frequent lookups
+		$this->currentCipher = $cipher;
+		return $this->currentCipher;
+	}
+
+	/**
+	 * return current encryption cipher
+	 *
+	 * @return string
+	 */
+	public function getCipher() {
+		return $this->getCachedCipher();
+	}
+
+	/**
+	 * get key size depending on the cipher
+	 *
+	 * @param string $cipher
+	 * @return int
+	 * @throws \InvalidArgumentException
+	 */
+	protected function getKeySize($cipher) {
+		if (isset(self::SUPPORTED_CIPHERS_AND_KEY_SIZE[$cipher])) {
+			return self::SUPPORTED_CIPHERS_AND_KEY_SIZE[$cipher];
+		}
+
+		throw new \InvalidArgumentException(
+			sprintf(
+				'Unsupported cipher (%s) defined.',
+				$cipher
+			)
+		);
+	}
+
+	/**
+	 * get legacy cipher
+	 *
+	 * @return string
+	 */
+	public function getLegacyCipher() {
+		if (!$this->supportLegacy) {
+			throw new ServerNotAvailableException('Legacy cipher is no longer supported!');
+		}
+
+		return self::LEGACY_CIPHER;
+	}
+
+	private function concatIV(string $encryptedContent, string $iv): string {
+		return $encryptedContent . '00iv00' . $iv;
+	}
+
+	private function concatSig(string $encryptedContent, string $signature): string {
+		return $encryptedContent . '00sig00' . $signature;
+	}
+
+	/**
+	 * Note: This is _NOT_ a padding used for encryption purposes. It is solely
+	 * used to achieve the PHP stream size. It has _NOTHING_ to do with the
+	 * encrypted content and is not used in any crypto primitive.
+	 */
+	private function addPadding(string $data): string {
+		return $data . 'xxx';
+	}
+
+	/**
+	 * generate password hash used to encrypt the users private key
+	 *
+	 * @param string $uid only used for user keys
+	 */
+	protected function generatePasswordHash(string $password, string $cipher, string $uid = '', int $iterations = 600000): string {
+		$instanceId = $this->config->getSystemValue('instanceid');
+		$instanceSecret = $this->config->getSystemValue('secret');
+		$salt = hash('sha256', $uid . $instanceId . $instanceSecret, true);
+		$keySize = $this->getKeySize($cipher);
+
+		return hash_pbkdf2(
+			'sha256',
+			$password,
+			$salt,
+			$iterations,
+			$keySize,
+			true
+		);
+	}
+
+	/**
+	 * encrypt private key
+	 *
+	 * @param string $privateKey
+	 * @param string $password
+	 * @param string $uid for regular users, empty for system keys
+	 * @return false|string
+	 */
+	public function encryptPrivateKey($privateKey, $password, $uid = '') {
+		$cipher = $this->getCipher();
+		$hash = $this->generatePasswordHash($password, $cipher, $uid);
+		$encryptedKey = $this->symmetricEncryptFileContent(
+			$privateKey,
+			$hash,
+			0,
+			'0'
+		);
+
+		return $encryptedKey;
+	}
+
+	/**
+	 * @param string $privateKey
+	 * @param string $password
+	 * @param string $uid for regular users, empty for system keys
+	 * @return false|string
+	 */
+	public function decryptPrivateKey($privateKey, $password = '', $uid = '') {
+		$header = $this->parseHeader($privateKey);
+
+		if (isset($header['cipher'])) {
+			$cipher = $header['cipher'];
+		} else {
+			$cipher = $this->getLegacyCipher();
+		}
+
+		if (isset($header['keyFormat'])) {
+			$keyFormat = $header['keyFormat'];
+		} else {
+			$keyFormat = self::LEGACY_KEY_FORMAT;
+		}
+
+		if ($keyFormat === 'hash') {
+			$password = $this->generatePasswordHash($password, $cipher, $uid, 100000);
+		} elseif ($keyFormat === 'hash2') {
+			$password = $this->generatePasswordHash($password, $cipher, $uid, 600000);
+		}
+
+		$binaryEncoding = isset($header['encoding']) && $header['encoding'] === self::BINARY_ENCODING_FORMAT;
+
+		// If we found a header we need to remove it from the key we want to decrypt
+		if (!empty($header)) {
+			$privateKey = substr($privateKey,
+				strpos($privateKey,
+					self::HEADER_END) + strlen(self::HEADER_END));
+		}
+
+		$plainKey = $this->symmetricDecryptFileContent(
+			$privateKey,
+			$password,
+			$cipher,
+			0,
+			0,
+			$binaryEncoding
+		);
+
+		if ($this->isValidPrivateKey($plainKey) === false) {
+			return false;
+		}
+
+		return $plainKey;
+	}
+
+	/**
+	 * check if it is a valid private key
+	 *
+	 * @param string $plainKey
+	 * @return bool
+	 */
+	protected function isValidPrivateKey($plainKey) {
+		$res = openssl_get_privatekey($plainKey);
+		if (is_object($res) && get_class($res) === 'OpenSSLAsymmetricKey') {
+			$sslInfo = openssl_pkey_get_details($res);
+			if (isset($sslInfo['key'])) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * @param string $keyFileContents
+	 * @param string $passPhrase
+	 * @param string $cipher
+	 * @param int $version
+	 * @param int|string $position
+	 * @param boolean $binaryEncoding
+	 * @return string
+	 * @throws DecryptionFailedException
+	 */
+	public function symmetricDecryptFileContent($keyFileContents, $passPhrase, $cipher = self::DEFAULT_CIPHER, $version = 0, $position = 0, bool $binaryEncoding = false) {
+		if ($keyFileContents == '') {
+			return '';
+		}
+
+		$catFile = $this->splitMetaData($keyFileContents, $cipher);
+
+		if ($catFile['signature'] !== false) {
+			try {
+				// First try the new format
+				$this->checkSignature($catFile['encrypted'], $passPhrase . '_' . $version . '_' . $position, $catFile['signature']);
+			} catch (GenericEncryptionException $e) {
+				// For compatibility with old files check the version without _
+				$this->checkSignature($catFile['encrypted'], $passPhrase . $version . $position, $catFile['signature']);
+			}
+		}
+
+		return $this->decrypt($catFile['encrypted'],
+			$catFile['iv'],
+			$passPhrase,
+			$cipher,
+			$binaryEncoding);
+	}
+
+	/**
+	 * check for valid signature
+	 *
+	 * @throws GenericEncryptionException
+	 */
+	private function checkSignature(string $data, string $passPhrase, string $expectedSignature): void {
+		$enforceSignature = !$this->config->getSystemValueBool('encryption_skip_signature_check', false);
+
+		$signature = $this->createSignature($data, $passPhrase);
+		$isCorrectHash = hash_equals($expectedSignature, $signature);
+
+		if (!$isCorrectHash) {
+			if ($enforceSignature) {
+				throw new GenericEncryptionException('Bad Signature', $this->l->t('Bad Signature'));
+			} else {
+				$this->logger->info("Signature check skipped", ['app' => 'encryption']);
+			}
+		}
+	}
+
+	/**
+	 * create signature
+	 */
+	private function createSignature(string $data, string $passPhrase): string {
+		$passPhrase = hash('sha512', $passPhrase . 'a', true);
+		return hash_hmac('sha256', $data, $passPhrase);
+	}
+
+
+	/**
+	 * @param bool $hasSignature did the block contain a signature, in this case we use a different padding
+	 */
+	private function removePadding(string $padded, bool $hasSignature = false): string|false {
+		if ($hasSignature === false && substr($padded, -2) === 'xx') {
+			return substr($padded, 0, -2);
+		} elseif ($hasSignature === true && substr($padded, -3) === 'xxx') {
+			return substr($padded, 0, -3);
+		}
+		return false;
+	}
+
+	/**
+	 * split meta data from encrypted file
+	 * Note: for now, we assume that the meta data always start with the iv
+	 *       followed by the signature, if available
+	 */
+	private function splitMetaData(string $catFile, string $cipher): array {
+		if ($this->hasSignature($catFile, $cipher)) {
+			$catFile = $this->removePadding($catFile, true);
+			$meta = substr($catFile, -93);
+			$iv = substr($meta, strlen('00iv00'), 16);
+			$sig = substr($meta, 22 + strlen('00sig00'));
+			$encrypted = substr($catFile, 0, -93);
+		} else {
+			$catFile = $this->removePadding($catFile);
+			$meta = substr($catFile, -22);
+			$iv = substr($meta, -16);
+			$sig = false;
+			$encrypted = substr($catFile, 0, -22);
+		}
+
+		return [
+			'encrypted' => $encrypted,
+			'iv' => $iv,
+			'signature' => $sig
+		];
+	}
+
+	/**
+	 * check if encrypted block is signed
+	 *
+	 * @throws GenericEncryptionException
+	 */
+	private function hasSignature(string $catFile, string $cipher): bool {
+		$skipSignatureCheck = $this->config->getSystemValueBool('encryption_skip_signature_check', false);
+
+		$meta = substr($catFile, -93);
+		$signaturePosition = strpos($meta, '00sig00');
+
+		// If we no longer support the legacy format then everything needs a signature
+		if (!$skipSignatureCheck && !$this->supportLegacy && $signaturePosition === false) {
+			throw new GenericEncryptionException('Missing Signature', $this->l->t('Missing Signature'));
+		}
+
+		// Enforce signature for the new 'CTR' ciphers
+		if (!$skipSignatureCheck && $signaturePosition === false && stripos($cipher, 'ctr') !== false) {
+			throw new GenericEncryptionException('Missing Signature', $this->l->t('Missing Signature'));
+		}
+
+		return ($signaturePosition !== false);
+	}
+
+
+	/**
+	 * @throws DecryptionFailedException
+	 */
+	private function decrypt(string $encryptedContent, string $iv, string $passPhrase = '', string $cipher = self::DEFAULT_CIPHER, bool $binaryEncoding = false): string {
+		$options = $binaryEncoding === true ? OPENSSL_RAW_DATA : 0;
+		$plainContent = openssl_decrypt($encryptedContent,
+			$cipher,
+			$passPhrase,
+			$options,
+			$iv);
+
+		if ($plainContent) {
+			return $plainContent;
+		} else {
+			throw new DecryptionFailedException('Encryption library: Decryption (symmetric) of content failed: ' . openssl_error_string());
+		}
+	}
+
+	/**
+	 * @param string $data
+	 * @return array
+	 */
+	protected function parseHeader($data) {
+		$result = [];
+
+		if (substr($data, 0, strlen(self::HEADER_START)) === self::HEADER_START) {
+			$endAt = strpos($data, self::HEADER_END);
+			$header = substr($data, 0, $endAt + strlen(self::HEADER_END));
+
+			// +1 not to start with an ':' which would result in empty element at the beginning
+			$exploded = explode(':',
+				substr($header, strlen(self::HEADER_START) + 1));
+
+			$element = array_shift($exploded);
+
+			while ($element !== self::HEADER_END) {
+				$result[$element] = array_shift($exploded);
+				$element = array_shift($exploded);
+			}
+		}
+
+		return $result;
+	}
+
+	/**
+	 * generate initialization vector
+	 *
+	 * @throws GenericEncryptionException
+	 */
+	private function generateIv(): string {
+		return random_bytes(16);
+	}
+
+	/**
+	 * Generate a cryptographically secure pseudo-random 256-bit ASCII key, used
+	 * as file key
+	 *
+	 * @return string
+	 * @throws \Exception
+	 */
+	public function generateFileKey() {
+		return random_bytes(32);
+	}
+
+	/**
+	 * @param \OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string $privateKey
+	 * @throws MultiKeyDecryptException
+	 */
+	public function multiKeyDecrypt(string $shareKey, $privateKey): string {
+		$plainContent = '';
+
+		// decrypt the intermediate key with RSA
+		if (openssl_private_decrypt($shareKey, $intermediate, $privateKey, OPENSSL_PKCS1_OAEP_PADDING)) {
+			return $intermediate;
+		} else {
+			throw new MultiKeyDecryptException('multikeydecrypt with share key failed:' . openssl_error_string());
+		}
+	}
+
+	/**
+	 * @param \OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string $privateKey
+	 * @throws MultiKeyDecryptException
+	 */
+	public function multiKeyDecryptLegacy(string $encKeyFile, string $shareKey, $privateKey): string {
+		if (!$encKeyFile) {
+			throw new MultiKeyDecryptException('Cannot multikey decrypt empty plain content');
+		}
+
+		$plainContent = '';
+		if ($this->opensslOpen($encKeyFile, $plainContent, $shareKey, $privateKey, 'RC4')) {
+			return $plainContent;
+		} else {
+			throw new MultiKeyDecryptException('multikeydecrypt with share key failed:' . openssl_error_string());
+		}
+	}
+
+	/**
+	 * @param array<string,\OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string> $keyFiles
+	 * @throws MultiKeyEncryptException
+	 */
+	public function multiKeyEncrypt(string $plainContent, array $keyFiles): array {
+		if (empty($plainContent)) {
+			throw new MultiKeyEncryptException('Cannot multikeyencrypt empty plain content');
+		}
+
+		// Set empty vars to be set by openssl by reference
+		$shareKeys = [];
+		$mappedShareKeys = [];
+
+		// make sure that there is at least one public key to use
+		if (count($keyFiles) >= 1) {
+			// prepare the encrypted keys
+			$shareKeys = [];
+
+			// iterate over the public keys and encrypt the intermediate
+			// for each of them with RSA
+			foreach ($keyFiles as $tmp_key) {
+				if (openssl_public_encrypt($plainContent, $tmp_output, $tmp_key, OPENSSL_PKCS1_OAEP_PADDING)) {
+					$shareKeys[] = $tmp_output;
+				}
+			}
+
+			// set the result if everything worked fine
+			if (count($keyFiles) === count($shareKeys)) {
+				$i = 0;
+
+				// Ensure each shareKey is labelled with its corresponding key id
+				foreach ($keyFiles as $userId => $publicKey) {
+					$mappedShareKeys[$userId] = $shareKeys[$i];
+					$i++;
+				}
+
+				return $mappedShareKeys;
+			}
+		}
+		throw new MultiKeyEncryptException('multikeyencryption failed ' . openssl_error_string());
+	}
+
+	/**
+	 * @param string $plainContent
+	 * @param array $keyFiles
+	 * @return array
+	 * @throws MultiKeyEncryptException
+	 * @deprecated 27.0.0 use multiKeyEncrypt
+	 */
+	public function multiKeyEncryptLegacy($plainContent, array $keyFiles) {
+		// openssl_seal returns false without errors if plaincontent is empty
+		// so trigger our own error
+		if (empty($plainContent)) {
+			throw new MultiKeyEncryptException('Cannot multikeyencrypt empty plain content');
+		}
+
+		// Set empty vars to be set by openssl by reference
+		$sealed = '';
+		$shareKeys = [];
+		$mappedShareKeys = [];
+
+		if ($this->opensslSeal($plainContent, $sealed, $shareKeys, $keyFiles, 'RC4')) {
+			$i = 0;
+
+			// Ensure each shareKey is labelled with its corresponding key id
+			foreach ($keyFiles as $userId => $publicKey) {
+				$mappedShareKeys[$userId] = $shareKeys[$i];
+				$i++;
+			}
+
+			return [
+				'keys' => $mappedShareKeys,
+				'data' => $sealed
+			];
+		} else {
+			throw new MultiKeyEncryptException('multikeyencryption failed ' . openssl_error_string());
+		}
+	}
+
+	/**
+	 * returns the value of $useLegacyBase64Encoding
+	 *
+	 * @return bool
+	 */
+	public function useLegacyBase64Encoding(): bool {
+		return $this->useLegacyBase64Encoding;
+	}
+
+	/**
+	 * Uses phpseclib RC4 implementation
+	 */
+	private function rc4Decrypt(string $data, string $secret): string {
+		$rc4 = new RC4();
+		/** @psalm-suppress InternalMethod */
+		$rc4->setKey($secret);
+
+		return $rc4->decrypt($data);
+	}
+
+	/**
+	 * Uses phpseclib RC4 implementation
+	 */
+	private function rc4Encrypt(string $data, string $secret): string {
+		$rc4 = new RC4();
+		/** @psalm-suppress InternalMethod */
+		$rc4->setKey($secret);
+
+		return $rc4->encrypt($data);
+	}
+
+	/**
+	 * Custom implementation of openssl_open()
+	 *
+	 * @param \OpenSSLAsymmetricKey|\OpenSSLCertificate|array|string $private_key
+	 * @throws DecryptionFailedException
+	 */
+	private function opensslOpen(string $data, string &$output, string $encrypted_key, $private_key, string $cipher_algo): bool {
+		$result = false;
+
+		// check if RC4 is used
+		if (strcasecmp($cipher_algo, "rc4") === 0) {
+			// decrypt the intermediate key with RSA
+			if (openssl_private_decrypt($encrypted_key, $intermediate, $private_key, OPENSSL_PKCS1_PADDING)) {
+				// decrypt the file key with the intermediate key
+				// using our own RC4 implementation
+				$output = $this->rc4Decrypt($data, $intermediate);
+				$result = (strlen($output) === strlen($data));
+			}
+		} else {
+			throw new DecryptionFailedException('Unsupported cipher '.$cipher_algo);
+		}
+
+		return $result;
+	}
+
+	/**
+	 * Custom implementation of openssl_seal()
+	 *
+	 * @deprecated 27.0.0 use multiKeyEncrypt
+	 * @throws EncryptionFailedException
+	 */
+	private function opensslSeal(string $data, string &$sealed_data, array &$encrypted_keys, array $public_key, string $cipher_algo): int|false {
+		$result = false;
+
+		// check if RC4 is used
+		if (strcasecmp($cipher_algo, "rc4") === 0) {
+			// make sure that there is at least one public key to use
+			if (count($public_key) >= 1) {
+				// generate the intermediate key
+				$intermediate = openssl_random_pseudo_bytes(16, $strong_result);
+
+				// check if we got strong random data
+				if ($strong_result) {
+					// encrypt the file key with the intermediate key
+					// using our own RC4 implementation
+					$sealed_data = $this->rc4Encrypt($data, $intermediate);
+					if (strlen($sealed_data) === strlen($data)) {
+						// prepare the encrypted keys
+						$encrypted_keys = [];
+
+						// iterate over the public keys and encrypt the intermediate
+						// for each of them with RSA
+						foreach ($public_key as $tmp_key) {
+							if (openssl_public_encrypt($intermediate, $tmp_output, $tmp_key, OPENSSL_PKCS1_PADDING)) {
+								$encrypted_keys[] = $tmp_output;
+							}
+						}
+
+						// set the result if everything worked fine
+						if (count($public_key) === count($encrypted_keys)) {
+							$result = strlen($sealed_data);
+						}
+					}
+				}
+			}
+		} else {
+			throw new EncryptionFailedException('Unsupported cipher '.$cipher_algo);
+		}
+
+		return $result;
+	}
+}

wedding-pics/apps/encryption/lib/Crypto/DecryptAll.php

@@ -0,0 +1,158 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Crypto;
+
+use OCA\Encryption\KeyManager;
+use OCA\Encryption\Session;
+use OCA\Encryption\Util;
+use Symfony\Component\Console\Helper\QuestionHelper;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Question\ConfirmationQuestion;
+use Symfony\Component\Console\Question\Question;
+
+class DecryptAll {
+
+	/** @var Util  */
+	protected $util;
+
+	/** @var QuestionHelper  */
+	protected $questionHelper;
+
+	/** @var  Crypt */
+	protected $crypt;
+
+	/** @var  KeyManager */
+	protected $keyManager;
+
+	/** @var Session  */
+	protected $session;
+
+	/**
+	 * @param Util $util
+	 * @param KeyManager $keyManager
+	 * @param Crypt $crypt
+	 * @param Session $session
+	 * @param QuestionHelper $questionHelper
+	 */
+	public function __construct(
+		Util $util,
+		KeyManager $keyManager,
+		Crypt $crypt,
+		Session $session,
+		QuestionHelper $questionHelper
+	) {
+		$this->util = $util;
+		$this->keyManager = $keyManager;
+		$this->crypt = $crypt;
+		$this->session = $session;
+		$this->questionHelper = $questionHelper;
+	}
+
+	/**
+	 * prepare encryption module to decrypt all files
+	 *
+	 * @param InputInterface $input
+	 * @param OutputInterface $output
+	 * @param $user
+	 * @return bool
+	 */
+	public function prepare(InputInterface $input, OutputInterface $output, $user) {
+		$question = new Question('Please enter the recovery key password: ');
+
+		if ($this->util->isMasterKeyEnabled()) {
+			$output->writeln('Use master key to decrypt all files');
+			$user = $this->keyManager->getMasterKeyId();
+			$password = $this->keyManager->getMasterKeyPassword();
+		} else {
+			$recoveryKeyId = $this->keyManager->getRecoveryKeyId();
+			if (!empty($user)) {
+				$output->writeln('You can only decrypt the users files if you know');
+				$output->writeln('the users password or if he activated the recovery key.');
+				$output->writeln('');
+				$questionUseLoginPassword = new ConfirmationQuestion(
+					'Do you want to use the users login password to decrypt all files? (y/n) ',
+					false
+				);
+				$useLoginPassword = $this->questionHelper->ask($input, $output, $questionUseLoginPassword);
+				if ($useLoginPassword) {
+					$question = new Question('Please enter the user\'s login password: ');
+				} elseif ($this->util->isRecoveryEnabledForUser($user) === false) {
+					$output->writeln('No recovery key available for user ' . $user);
+					return false;
+				} else {
+					$user = $recoveryKeyId;
+				}
+			} else {
+				$output->writeln('You can only decrypt the files of all users if the');
+				$output->writeln('recovery key is enabled by the admin and activated by the users.');
+				$output->writeln('');
+				$user = $recoveryKeyId;
+			}
+
+			$question->setHidden(true);
+			$question->setHiddenFallback(false);
+			$password = $this->questionHelper->ask($input, $output, $question);
+		}
+
+		$privateKey = $this->getPrivateKey($user, $password);
+		if ($privateKey !== false) {
+			$this->updateSession($user, $privateKey);
+			return true;
+		} else {
+			$output->writeln('Could not decrypt private key, maybe you entered the wrong password?');
+		}
+
+
+		return false;
+	}
+
+	/**
+	 * get the private key which will be used to decrypt all files
+	 *
+	 * @param string $user
+	 * @param string $password
+	 * @return bool|string
+	 * @throws \OCA\Encryption\Exceptions\PrivateKeyMissingException
+	 */
+	protected function getPrivateKey($user, $password) {
+		$recoveryKeyId = $this->keyManager->getRecoveryKeyId();
+		$masterKeyId = $this->keyManager->getMasterKeyId();
+		if ($user === $recoveryKeyId) {
+			$recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId);
+			$privateKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
+		} elseif ($user === $masterKeyId) {
+			$masterKey = $this->keyManager->getSystemPrivateKey($masterKeyId);
+			$privateKey = $this->crypt->decryptPrivateKey($masterKey, $password, $masterKeyId);
+		} else {
+			$userKey = $this->keyManager->getPrivateKey($user);
+			$privateKey = $this->crypt->decryptPrivateKey($userKey, $password, $user);
+		}
+
+		return $privateKey;
+	}
+
+	protected function updateSession($user, $privateKey) {
+		$this->session->prepareDecryptAll($user, $privateKey);
+	}
+}

wedding-pics/apps/encryption/lib/Crypto/EncryptAll.php

@@ -0,0 +1,474 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Kenneth Newwood <kenneth@newwood.name>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Crypto;
+
+use OC\Encryption\Exceptions\DecryptionFailedException;
+use OC\Files\View;
+use OCA\Encryption\KeyManager;
+use OCA\Encryption\Users\Setup;
+use OCA\Encryption\Util;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\L10N\IFactory;
+use OCP\Mail\Headers\AutoSubmitted;
+use OCP\Mail\IMailer;
+use OCP\Security\ISecureRandom;
+use Symfony\Component\Console\Helper\ProgressBar;
+use Symfony\Component\Console\Helper\QuestionHelper;
+use Symfony\Component\Console\Helper\Table;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Question\ConfirmationQuestion;
+
+class EncryptAll {
+
+	/** @var Setup */
+	protected $userSetup;
+
+	/** @var IUserManager */
+	protected $userManager;
+
+	/** @var View */
+	protected $rootView;
+
+	/** @var KeyManager */
+	protected $keyManager;
+
+	/** @var Util */
+	protected $util;
+
+	/** @var array  */
+	protected $userPasswords;
+
+	/** @var  IConfig */
+	protected $config;
+
+	/** @var IMailer */
+	protected $mailer;
+
+	/** @var  IL10N */
+	protected $l;
+
+	/** @var  IFactory */
+	protected $l10nFactory;
+
+	/** @var  QuestionHelper */
+	protected $questionHelper;
+
+	/** @var  OutputInterface */
+	protected $output;
+
+	/** @var  InputInterface */
+	protected $input;
+
+	/** @var ISecureRandom */
+	protected $secureRandom;
+
+	public function __construct(
+		Setup $userSetup,
+		IUserManager $userManager,
+		View $rootView,
+		KeyManager $keyManager,
+		Util $util,
+		IConfig $config,
+		IMailer $mailer,
+		IL10N $l,
+		IFactory $l10nFactory,
+		QuestionHelper $questionHelper,
+		ISecureRandom $secureRandom
+	) {
+		$this->userSetup = $userSetup;
+		$this->userManager = $userManager;
+		$this->rootView = $rootView;
+		$this->keyManager = $keyManager;
+		$this->util = $util;
+		$this->config = $config;
+		$this->mailer = $mailer;
+		$this->l = $l;
+		$this->l10nFactory = $l10nFactory;
+		$this->questionHelper = $questionHelper;
+		$this->secureRandom = $secureRandom;
+		// store one time passwords for the users
+		$this->userPasswords = [];
+	}
+
+	/**
+	 * start to encrypt all files
+	 *
+	 * @param InputInterface $input
+	 * @param OutputInterface $output
+	 */
+	public function encryptAll(InputInterface $input, OutputInterface $output) {
+		$this->input = $input;
+		$this->output = $output;
+
+		$headline = 'Encrypt all files with the ' . Encryption::DISPLAY_NAME;
+		$this->output->writeln("\n");
+		$this->output->writeln($headline);
+		$this->output->writeln(str_pad('', strlen($headline), '='));
+		$this->output->writeln("\n");
+
+		if ($this->util->isMasterKeyEnabled()) {
+			$this->output->writeln('Use master key to encrypt all files.');
+			$this->keyManager->validateMasterKey();
+		} else {
+			//create private/public keys for each user and store the private key password
+			$this->output->writeln('Create key-pair for every user');
+			$this->output->writeln('------------------------------');
+			$this->output->writeln('');
+			$this->output->writeln('This module will encrypt all files in the users files folder initially.');
+			$this->output->writeln('Already existing versions and files in the trash bin will not be encrypted.');
+			$this->output->writeln('');
+			$this->createKeyPairs();
+		}
+
+
+		// output generated encryption key passwords
+		if ($this->util->isMasterKeyEnabled() === false) {
+			//send-out or display password list and write it to a file
+			$this->output->writeln("\n");
+			$this->output->writeln('Generated encryption key passwords');
+			$this->output->writeln('----------------------------------');
+			$this->output->writeln('');
+			$this->outputPasswords();
+		}
+
+		//setup users file system and encrypt all files one by one (take should encrypt setting of storage into account)
+		$this->output->writeln("\n");
+		$this->output->writeln('Start to encrypt users files');
+		$this->output->writeln('----------------------------');
+		$this->output->writeln('');
+		$this->encryptAllUsersFiles();
+		$this->output->writeln("\n");
+	}
+
+	/**
+	 * create key-pair for every user
+	 */
+	protected function createKeyPairs() {
+		$this->output->writeln("\n");
+		$progress = new ProgressBar($this->output);
+		$progress->setFormat(" %message% \n [%bar%]");
+		$progress->start();
+
+		foreach ($this->userManager->getBackends() as $backend) {
+			$limit = 500;
+			$offset = 0;
+			do {
+				$users = $backend->getUsers('', $limit, $offset);
+				foreach ($users as $user) {
+					if ($this->keyManager->userHasKeys($user) === false) {
+						$progress->setMessage('Create key-pair for ' . $user);
+						$progress->advance();
+						$this->setupUserFS($user);
+						$password = $this->generateOneTimePassword($user);
+						$this->userSetup->setupUser($user, $password);
+					} else {
+						// users which already have a key-pair will be stored with a
+						// empty password and filtered out later
+						$this->userPasswords[$user] = '';
+					}
+				}
+				$offset += $limit;
+			} while (count($users) >= $limit);
+		}
+
+		$progress->setMessage('Key-pair created for all users');
+		$progress->finish();
+	}
+
+	/**
+	 * iterate over all user and encrypt their files
+	 */
+	protected function encryptAllUsersFiles() {
+		$this->output->writeln("\n");
+		$progress = new ProgressBar($this->output);
+		$progress->setFormat(" %message% \n [%bar%]");
+		$progress->start();
+		$numberOfUsers = count($this->userPasswords);
+		$userNo = 1;
+		if ($this->util->isMasterKeyEnabled()) {
+			$this->encryptAllUserFilesWithMasterKey($progress);
+		} else {
+			foreach ($this->userPasswords as $uid => $password) {
+				$userCount = "$uid ($userNo of $numberOfUsers)";
+				$this->encryptUsersFiles($uid, $progress, $userCount);
+				$userNo++;
+			}
+		}
+		$progress->setMessage("all files encrypted");
+		$progress->finish();
+	}
+
+	/**
+	 * encrypt all user files with the master key
+	 *
+	 * @param ProgressBar $progress
+	 */
+	protected function encryptAllUserFilesWithMasterKey(ProgressBar $progress) {
+		$userNo = 1;
+		foreach ($this->userManager->getBackends() as $backend) {
+			$limit = 500;
+			$offset = 0;
+			do {
+				$users = $backend->getUsers('', $limit, $offset);
+				foreach ($users as $user) {
+					$userCount = "$user ($userNo)";
+					$this->encryptUsersFiles($user, $progress, $userCount);
+					$userNo++;
+				}
+				$offset += $limit;
+			} while (count($users) >= $limit);
+		}
+	}
+
+	/**
+	 * encrypt files from the given user
+	 *
+	 * @param string $uid
+	 * @param ProgressBar $progress
+	 * @param string $userCount
+	 */
+	protected function encryptUsersFiles($uid, ProgressBar $progress, $userCount) {
+		$this->setupUserFS($uid);
+		$directories = [];
+		$directories[] = '/' . $uid . '/files';
+
+		while ($root = array_pop($directories)) {
+			$content = $this->rootView->getDirectoryContent($root);
+			foreach ($content as $file) {
+				$path = $root . '/' . $file['name'];
+				if ($this->rootView->is_dir($path)) {
+					$directories[] = $path;
+					continue;
+				} else {
+					$progress->setMessage("encrypt files for user $userCount: $path");
+					$progress->advance();
+					if ($this->encryptFile($path) === false) {
+						$progress->setMessage("encrypt files for user $userCount: $path (already encrypted)");
+						$progress->advance();
+					}
+				}
+			}
+		}
+	}
+
+	/**
+	 * encrypt file
+	 *
+	 * @param string $path
+	 * @return bool
+	 */
+	protected function encryptFile($path) {
+
+		// skip already encrypted files
+		$fileInfo = $this->rootView->getFileInfo($path);
+		if ($fileInfo !== false && $fileInfo->isEncrypted()) {
+			return true;
+		}
+
+		$source = $path;
+		$target = $path . '.encrypted.' . time();
+
+		try {
+			$this->rootView->copy($source, $target);
+			$this->rootView->rename($target, $source);
+		} catch (DecryptionFailedException $e) {
+			if ($this->rootView->file_exists($target)) {
+				$this->rootView->unlink($target);
+			}
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * output one-time encryption passwords
+	 */
+	protected function outputPasswords() {
+		$table = new Table($this->output);
+		$table->setHeaders(['Username', 'Private key password']);
+
+		//create rows
+		$newPasswords = [];
+		$unchangedPasswords = [];
+		foreach ($this->userPasswords as $uid => $password) {
+			if (empty($password)) {
+				$unchangedPasswords[] = $uid;
+			} else {
+				$newPasswords[] = [$uid, $password];
+			}
+		}
+
+		if (empty($newPasswords)) {
+			$this->output->writeln("\nAll users already had a key-pair, no further action needed.\n");
+			return;
+		}
+
+		$table->setRows($newPasswords);
+		$table->render();
+
+		if (!empty($unchangedPasswords)) {
+			$this->output->writeln("\nThe following users already had a key-pair which was reused without setting a new password:\n");
+			foreach ($unchangedPasswords as $uid) {
+				$this->output->writeln("    $uid");
+			}
+		}
+
+		$this->writePasswordsToFile($newPasswords);
+
+		$this->output->writeln('');
+		$question = new ConfirmationQuestion('Do you want to send the passwords directly to the users by mail? (y/n) ', false);
+		if ($this->questionHelper->ask($this->input, $this->output, $question)) {
+			$this->sendPasswordsByMail();
+		}
+	}
+
+	/**
+	 * write one-time encryption passwords to a csv file
+	 *
+	 * @param array $passwords
+	 */
+	protected function writePasswordsToFile(array $passwords) {
+		$fp = $this->rootView->fopen('oneTimeEncryptionPasswords.csv', 'w');
+		foreach ($passwords as $pwd) {
+			fputcsv($fp, $pwd);
+		}
+		fclose($fp);
+		$this->output->writeln("\n");
+		$this->output->writeln('A list of all newly created passwords was written to data/oneTimeEncryptionPasswords.csv');
+		$this->output->writeln('');
+		$this->output->writeln('Each of these users need to login to the web interface, go to the');
+		$this->output->writeln('personal settings section "basic encryption module" and');
+		$this->output->writeln('update the private key password to match the login password again by');
+		$this->output->writeln('entering the one-time password into the "old log-in password" field');
+		$this->output->writeln('and their current login password');
+	}
+
+	/**
+	 * setup user file system
+	 *
+	 * @param string $uid
+	 */
+	protected function setupUserFS($uid) {
+		\OC_Util::tearDownFS();
+		\OC_Util::setupFS($uid);
+	}
+
+	/**
+	 * generate one time password for the user and store it in a array
+	 *
+	 * @param string $uid
+	 * @return string password
+	 */
+	protected function generateOneTimePassword($uid) {
+		$password = $this->secureRandom->generate(16, ISecureRandom::CHAR_HUMAN_READABLE);
+		$this->userPasswords[$uid] = $password;
+		return $password;
+	}
+
+	/**
+	 * send encryption key passwords to the users by mail
+	 */
+	protected function sendPasswordsByMail() {
+		$noMail = [];
+
+		$this->output->writeln('');
+		$progress = new ProgressBar($this->output, count($this->userPasswords));
+		$progress->start();
+
+		foreach ($this->userPasswords as $uid => $password) {
+			$progress->advance();
+			if (!empty($password)) {
+				$recipient = $this->userManager->get($uid);
+				if (!$recipient instanceof IUser) {
+					continue;
+				}
+
+				$recipientDisplayName = $recipient->getDisplayName();
+				$to = $recipient->getEMailAddress();
+
+				if ($to === '' || $to === null) {
+					$noMail[] = $uid;
+					continue;
+				}
+
+				$l = $this->l10nFactory->get('encryption', $this->l10nFactory->getUserLanguage($recipient));
+
+				$template = $this->mailer->createEMailTemplate('encryption.encryptAllPassword', [
+					'user' => $recipient->getUID(),
+					'password' => $password,
+				]);
+
+				$template->setSubject($l->t('one-time password for server-side-encryption'));
+				// 'Hey there,<br><br>The administration enabled server-side-encryption. Your files were encrypted using the password <strong>%s</strong>.<br><br>
+				// Please login to the web interface, go to the section "Basic encryption module" of your personal settings and update your encryption password by entering this password into the "Old log-in password" field and your current login-password.<br><br>'
+				$template->addHeader();
+				$template->addHeading($l->t('Encryption password'));
+				$template->addBodyText(
+					$l->t('The administration enabled server-side-encryption. Your files were encrypted using the password <strong>%s</strong>.', [htmlspecialchars($password)]),
+					$l->t('The administration enabled server-side-encryption. Your files were encrypted using the password "%s".', $password)
+				);
+				$template->addBodyText(
+					$l->t('Please login to the web interface, go to the "Security" section of your personal settings and update your encryption password by entering this password into the "Old login password" field and your current login password.')
+				);
+				$template->addFooter();
+
+				// send it out now
+				try {
+					$message = $this->mailer->createMessage();
+					$message->setTo([$to => $recipientDisplayName]);
+					$message->useTemplate($template);
+					$message->setAutoSubmitted(AutoSubmitted::VALUE_AUTO_GENERATED);
+					$this->mailer->send($message);
+				} catch (\Exception $e) {
+					$noMail[] = $uid;
+				}
+			}
+		}
+
+		$progress->finish();
+
+		if (empty($noMail)) {
+			$this->output->writeln("\n\nPassword successfully send to all users");
+		} else {
+			$table = new Table($this->output);
+			$table->setHeaders(['Username', 'Private key password']);
+			$this->output->writeln("\n\nCould not send password to following users:\n");
+			$rows = [];
+			foreach ($noMail as $uid) {
+				$rows[] = [$uid, $this->userPasswords[$uid]];
+			}
+			$table->setRows($rows);
+			$table->render();
+		}
+	}
+}

wedding-pics/apps/encryption/lib/Crypto/Encryption.php

@@ -0,0 +1,591 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Jan-Christoph Borchardt <hey@jancborchardt.net>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Robin Appelman <robin@icewind.nl>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ * @author Valdnet <47037905+Valdnet@users.noreply.github.com>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Crypto;
+
+use OC\Encryption\Exceptions\DecryptionFailedException;
+use OC\Files\Cache\Scanner;
+use OC\Files\View;
+use OCA\Encryption\Exceptions\PublicKeyMissingException;
+use OCA\Encryption\KeyManager;
+use OCA\Encryption\Session;
+use OCA\Encryption\Util;
+use OCP\Encryption\IEncryptionModule;
+use OCP\IL10N;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class Encryption implements IEncryptionModule {
+	public const ID = 'OC_DEFAULT_MODULE';
+	public const DISPLAY_NAME = 'Default encryption module';
+
+	/** @var string */
+	private $cipher;
+
+	/** @var string */
+	private $path;
+
+	/** @var string */
+	private $user;
+
+	private array $owner;
+
+	/** @var string */
+	private $fileKey;
+
+	/** @var string */
+	private $writeCache;
+
+	/** @var array */
+	private $accessList;
+
+	/** @var boolean */
+	private $isWriteOperation;
+
+	private bool $useMasterPassword;
+
+	private bool $useLegacyBase64Encoding = false;
+
+	/** @var int Current version of the file */
+	private int $version = 0;
+
+	private bool $useLegacyFileKey = true;
+
+	/** @var array remember encryption signature version */
+	private static $rememberVersion = [];
+
+	public function __construct(
+		private Crypt $crypt,
+		private KeyManager $keyManager,
+		private Util $util,
+		private Session $session,
+		private EncryptAll $encryptAll,
+		private DecryptAll $decryptAll,
+		private LoggerInterface $logger,
+		private IL10N $l,
+	) {
+		$this->owner = [];
+		$this->useMasterPassword = $this->util->isMasterKeyEnabled();
+	}
+
+	/**
+	 * @return string defining the technical unique id
+	 */
+	public function getId() {
+		return self::ID;
+	}
+
+	/**
+	 * In comparison to getKey() this function returns a human readable (maybe translated) name
+	 *
+	 * @return string
+	 */
+	public function getDisplayName() {
+		return self::DISPLAY_NAME;
+	}
+
+	/**
+	 * start receiving chunks from a file. This is the place where you can
+	 * perform some initial step before starting encrypting/decrypting the
+	 * chunks
+	 *
+	 * @param string $path to the file
+	 * @param string $user who read/write the file
+	 * @param string $mode php stream open mode
+	 * @param array $header contains the header data read from the file
+	 * @param array $accessList who has access to the file contains the key 'users' and 'public'
+	 *
+	 * @return array $header contain data as key-value pairs which should be
+	 *                       written to the header, in case of a write operation
+	 *                       or if no additional data is needed return a empty array
+	 */
+	public function begin($path, $user, $mode, array $header, array $accessList) {
+		$this->path = $this->getPathToRealFile($path);
+		$this->accessList = $accessList;
+		$this->user = $user;
+		$this->isWriteOperation = false;
+		$this->writeCache = '';
+		$this->useLegacyBase64Encoding = true;
+
+		$this->useLegacyFileKey = ($header['useLegacyFileKey'] ?? 'true') !== 'false';
+
+		if (isset($header['encoding'])) {
+			$this->useLegacyBase64Encoding = $header['encoding'] !== Crypt::BINARY_ENCODING_FORMAT;
+		}
+
+		if ($this->session->isReady() === false) {
+			// if the master key is enabled we can initialize encryption
+			// with a empty password and user name
+			if ($this->util->isMasterKeyEnabled()) {
+				$this->keyManager->init('', '');
+			}
+		}
+
+		if ($this->session->decryptAllModeActivated()) {
+			$shareKey = $this->keyManager->getShareKey($this->path, $this->session->getDecryptAllUid());
+			if ($this->useLegacyFileKey) {
+				$encryptedFileKey = $this->keyManager->getEncryptedFileKey($this->path);
+				$this->fileKey = $this->crypt->multiKeyDecryptLegacy($encryptedFileKey,
+					$shareKey,
+					$this->session->getDecryptAllKey());
+			} else {
+				$this->fileKey = $this->crypt->multiKeyDecrypt($shareKey, $this->session->getDecryptAllKey());
+			}
+		} else {
+			$this->fileKey = $this->keyManager->getFileKey($this->path, $this->user, $this->useLegacyFileKey);
+		}
+
+		// always use the version from the original file, also part files
+		// need to have a correct version number if they get moved over to the
+		// final location
+		$this->version = (int)$this->keyManager->getVersion($this->stripPartFileExtension($path), new View());
+
+		if (
+			$mode === 'w'
+			|| $mode === 'w+'
+			|| $mode === 'wb'
+			|| $mode === 'wb+'
+		) {
+			$this->isWriteOperation = true;
+			if (empty($this->fileKey)) {
+				$this->fileKey = $this->crypt->generateFileKey();
+			}
+		} else {
+			// if we read a part file we need to increase the version by 1
+			// because the version number was also increased by writing
+			// the part file
+			if (Scanner::isPartialFile($path)) {
+				$this->version = $this->version + 1;
+			}
+		}
+
+		if ($this->isWriteOperation) {
+			$this->cipher = $this->crypt->getCipher();
+			$this->useLegacyBase64Encoding = $this->crypt->useLegacyBase64Encoding();
+		} elseif (isset($header['cipher'])) {
+			$this->cipher = $header['cipher'];
+		} else {
+			// if we read a file without a header we fall-back to the legacy cipher
+			// which was used in <=oC6
+			$this->cipher = $this->crypt->getLegacyCipher();
+		}
+
+		$result = [
+			'cipher' => $this->cipher,
+			'signed' => 'true',
+			'useLegacyFileKey' => 'false',
+		];
+
+		if ($this->useLegacyBase64Encoding !== true) {
+			$result['encoding'] = Crypt::BINARY_ENCODING_FORMAT;
+		}
+
+		return $result;
+	}
+
+	/**
+	 * last chunk received. This is the place where you can perform some final
+	 * operation and return some remaining data if something is left in your
+	 * buffer.
+	 *
+	 * @param string $path to the file
+	 * @param string $position
+	 * @return string remained data which should be written to the file in case
+	 *                of a write operation
+	 * @throws PublicKeyMissingException
+	 * @throws \Exception
+	 * @throws \OCA\Encryption\Exceptions\MultiKeyEncryptException
+	 */
+	public function end($path, $position = '0') {
+		$result = '';
+		if ($this->isWriteOperation) {
+			// in case of a part file we remember the new signature versions
+			// the version will be set later on update.
+			// This way we make sure that other apps listening to the pre-hooks
+			// still get the old version which should be the correct value for them
+			if (Scanner::isPartialFile($path)) {
+				self::$rememberVersion[$this->stripPartFileExtension($path)] = $this->version + 1;
+			}
+			if (!empty($this->writeCache)) {
+				$result = $this->crypt->symmetricEncryptFileContent($this->writeCache, $this->fileKey, $this->version + 1, $position);
+				$this->writeCache = '';
+			}
+			$publicKeys = [];
+			if ($this->useMasterPassword === true) {
+				$publicKeys[$this->keyManager->getMasterKeyId()] = $this->keyManager->getPublicMasterKey();
+			} else {
+				foreach ($this->accessList['users'] as $uid) {
+					try {
+						$publicKeys[$uid] = $this->keyManager->getPublicKey($uid);
+					} catch (PublicKeyMissingException $e) {
+						$this->logger->warning(
+							'no public key found for user "{uid}", user will not be able to read the file',
+							['app' => 'encryption', 'uid' => $uid]
+						);
+						// if the public key of the owner is missing we should fail
+						if ($uid === $this->user) {
+							throw $e;
+						}
+					}
+				}
+			}
+
+			$publicKeys = $this->keyManager->addSystemKeys($this->accessList, $publicKeys, $this->getOwner($path));
+			$shareKeys = $this->crypt->multiKeyEncrypt($this->fileKey, $publicKeys);
+			if (!$this->keyManager->deleteLegacyFileKey($this->path)) {
+				$this->logger->warning(
+					'Failed to delete legacy filekey for {path}',
+					['app' => 'encryption', 'path' => $path]
+				);
+			}
+			foreach ($shareKeys as $uid => $keyFile) {
+				$this->keyManager->setShareKey($this->path, $uid, $keyFile);
+			}
+		}
+		return $result ?: '';
+	}
+
+
+
+	/**
+	 * encrypt data
+	 *
+	 * @param string $data you want to encrypt
+	 * @param int $position
+	 * @return string encrypted data
+	 */
+	public function encrypt($data, $position = 0) {
+		// If extra data is left over from the last round, make sure it
+		// is integrated into the next block
+		if ($this->writeCache) {
+			// Concat writeCache to start of $data
+			$data = $this->writeCache . $data;
+
+			// Clear the write cache, ready for reuse - it has been
+			// flushed and its old contents processed
+			$this->writeCache = '';
+		}
+
+		$encrypted = '';
+		// While there still remains some data to be processed & written
+		while (strlen($data) > 0) {
+			// Remaining length for this iteration, not of the
+			// entire file (may be greater than 8192 bytes)
+			$remainingLength = strlen($data);
+
+			// If data remaining to be written is less than the
+			// size of 1 unencrypted block
+			if ($remainingLength < $this->getUnencryptedBlockSize(true)) {
+				// Set writeCache to contents of $data
+				// The writeCache will be carried over to the
+				// next write round, and added to the start of
+				// $data to ensure that written blocks are
+				// always the correct length. If there is still
+				// data in writeCache after the writing round
+				// has finished, then the data will be written
+				// to disk by $this->flush().
+				$this->writeCache = $data;
+
+				// Clear $data ready for next round
+				$data = '';
+			} else {
+				// Read the chunk from the start of $data
+				$chunk = substr($data, 0, $this->getUnencryptedBlockSize(true));
+
+				$encrypted .= $this->crypt->symmetricEncryptFileContent($chunk, $this->fileKey, $this->version + 1, (string)$position);
+
+				// Remove the chunk we just processed from
+				// $data, leaving only unprocessed data in $data
+				// var, for handling on the next round
+				$data = substr($data, $this->getUnencryptedBlockSize(true));
+			}
+		}
+
+		return $encrypted;
+	}
+
+	/**
+	 * decrypt data
+	 *
+	 * @param string $data you want to decrypt
+	 * @param int|string $position
+	 * @return string decrypted data
+	 * @throws DecryptionFailedException
+	 */
+	public function decrypt($data, $position = 0) {
+		if (empty($this->fileKey)) {
+			$msg = 'Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.';
+			$hint = $this->l->t('Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.');
+			$this->logger->error($msg);
+
+			throw new DecryptionFailedException($msg, $hint);
+		}
+
+		return $this->crypt->symmetricDecryptFileContent($data, $this->fileKey, $this->cipher, $this->version, $position, !$this->useLegacyBase64Encoding);
+	}
+
+	/**
+	 * update encrypted file, e.g. give additional users access to the file
+	 *
+	 * @param string $path path to the file which should be updated
+	 * @param string $uid of the user who performs the operation
+	 * @param array $accessList who has access to the file contains the key 'users' and 'public'
+	 * @return bool
+	 */
+	public function update($path, $uid, array $accessList) {
+		if (empty($accessList)) {
+			if (isset(self::$rememberVersion[$path])) {
+				$this->keyManager->setVersion($path, self::$rememberVersion[$path], new View());
+				unset(self::$rememberVersion[$path]);
+			}
+			return false;
+		}
+
+		$fileKey = $this->keyManager->getFileKey($path, $uid, null);
+
+		if (!empty($fileKey)) {
+			$publicKeys = [];
+			if ($this->useMasterPassword === true) {
+				$publicKeys[$this->keyManager->getMasterKeyId()] = $this->keyManager->getPublicMasterKey();
+			} else {
+				foreach ($accessList['users'] as $user) {
+					try {
+						$publicKeys[$user] = $this->keyManager->getPublicKey($user);
+					} catch (PublicKeyMissingException $e) {
+						$this->logger->warning('Could not encrypt file for ' . $user . ': ' . $e->getMessage());
+					}
+				}
+			}
+
+			$publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $this->getOwner($path));
+
+			$shareKeys = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys);
+
+			$this->keyManager->deleteAllFileKeys($path);
+
+			foreach ($shareKeys as $uid => $keyFile) {
+				$this->keyManager->setShareKey($path, $uid, $keyFile);
+			}
+		} else {
+			$this->logger->debug('no file key found, we assume that the file "{file}" is not encrypted',
+				['file' => $path, 'app' => 'encryption']);
+
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * should the file be encrypted or not
+	 *
+	 * @param string $path
+	 * @return boolean
+	 */
+	public function shouldEncrypt($path) {
+		if ($this->util->shouldEncryptHomeStorage() === false) {
+			$storage = $this->util->getStorage($path);
+			if ($storage && $storage->instanceOfStorage('\OCP\Files\IHomeStorage')) {
+				return false;
+			}
+		}
+		$parts = explode('/', $path);
+		if (count($parts) < 4) {
+			return false;
+		}
+
+		if ($parts[2] === 'files') {
+			return true;
+		}
+		if ($parts[2] === 'files_versions') {
+			return true;
+		}
+		if ($parts[2] === 'files_trashbin') {
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * get size of the unencrypted payload per block.
+	 * Nextcloud read/write files with a block size of 8192 byte
+	 *
+	 * Encrypted blocks have a 22-byte IV and 2 bytes of padding, encrypted and
+	 * signed blocks have also a 71-byte signature and 1 more byte of padding,
+	 * resulting respectively in:
+	 *
+	 *  8192 - 22 - 2 = 8168 bytes in each unsigned unencrypted block
+	 *  8192 - 22 - 2 - 71 - 1 = 8096 bytes in each signed unencrypted block
+	 *
+	 * Legacy base64 encoding then reduces the available size by a 3/4 factor:
+	 *
+	 *  8168 * (3/4) = 6126 bytes in each base64-encoded unsigned unencrypted block
+	 *  8096 * (3/4) = 6072 bytes in each base64-encoded signed unencrypted block
+	 *
+	 * @param bool $signed
+	 * @return int
+	 */
+	public function getUnencryptedBlockSize($signed = false) {
+		if ($this->useLegacyBase64Encoding) {
+			return $signed ? 6072 : 6126;
+		} else {
+			return $signed ? 8096 : 8168;
+		}
+	}
+
+	/**
+	 * check if the encryption module is able to read the file,
+	 * e.g. if all encryption keys exists
+	 *
+	 * @param string $path
+	 * @param string $uid user for whom we want to check if he can read the file
+	 * @return bool
+	 * @throws DecryptionFailedException
+	 */
+	public function isReadable($path, $uid) {
+		$fileKey = $this->keyManager->getFileKey($path, $uid, null);
+		if (empty($fileKey)) {
+			$owner = $this->util->getOwner($path);
+			if ($owner !== $uid) {
+				// if it is a shared file we throw a exception with a useful
+				// error message because in this case it means that the file was
+				// shared with the user at a point where the user didn't had a
+				// valid private/public key
+				$msg = 'Encryption module "' . $this->getDisplayName() .
+					'" is not able to read ' . $path;
+				$hint = $this->l->t('Cannot read this file, probably this is a shared file. Please ask the file owner to reshare the file with you.');
+				$this->logger->warning($msg);
+				throw new DecryptionFailedException($msg, $hint);
+			}
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * Initial encryption of all files
+	 *
+	 * @param InputInterface $input
+	 * @param OutputInterface $output write some status information to the terminal during encryption
+	 */
+	public function encryptAll(InputInterface $input, OutputInterface $output) {
+		$this->encryptAll->encryptAll($input, $output);
+	}
+
+	/**
+	 * prepare module to perform decrypt all operation
+	 *
+	 * @param InputInterface $input
+	 * @param OutputInterface $output
+	 * @param string $user
+	 * @return bool
+	 */
+	public function prepareDecryptAll(InputInterface $input, OutputInterface $output, $user = '') {
+		return $this->decryptAll->prepare($input, $output, $user);
+	}
+
+
+	/**
+	 * @param string $path
+	 * @return string
+	 */
+	protected function getPathToRealFile($path) {
+		$realPath = $path;
+		$parts = explode('/', $path);
+		if ($parts[2] === 'files_versions') {
+			$realPath = '/' . $parts[1] . '/files/' . implode('/', array_slice($parts, 3));
+			$length = strrpos($realPath, '.');
+			$realPath = substr($realPath, 0, $length);
+		}
+
+		return $realPath;
+	}
+
+	/**
+	 * remove .part file extension and the ocTransferId from the file to get the
+	 * original file name
+	 *
+	 * @param string $path
+	 * @return string
+	 */
+	protected function stripPartFileExtension($path) {
+		if (pathinfo($path, PATHINFO_EXTENSION) === 'part') {
+			$pos = strrpos($path, '.', -6);
+			$path = substr($path, 0, $pos);
+		}
+
+		return $path;
+	}
+
+	/**
+	 * get owner of a file
+	 *
+	 * @param string $path
+	 * @return string
+	 */
+	protected function getOwner($path) {
+		if (!isset($this->owner[$path])) {
+			$this->owner[$path] = $this->util->getOwner($path);
+		}
+		return $this->owner[$path];
+	}
+
+	/**
+	 * Check if the module is ready to be used by that specific user.
+	 * In case a module is not ready - because e.g. key pairs have not been generated
+	 * upon login this method can return false before any operation starts and might
+	 * cause issues during operations.
+	 *
+	 * @param string $user
+	 * @return boolean
+	 * @since 9.1.0
+	 */
+	public function isReadyForUser($user) {
+		if ($this->util->isMasterKeyEnabled()) {
+			return true;
+		}
+		return $this->keyManager->userHasKeys($user);
+	}
+
+	/**
+	 * We only need a detailed access list if the master key is not enabled
+	 *
+	 * @return bool
+	 */
+	public function needDetailedAccessList() {
+		return !$this->util->isMasterKeyEnabled();
+	}
+}

wedding-pics/apps/encryption/lib/Exceptions/MultiKeyDecryptException.php

@@ -0,0 +1,27 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Exceptions;
+
+use OCP\Encryption\Exceptions\GenericEncryptionException;
+
+class MultiKeyDecryptException extends GenericEncryptionException {
+}

wedding-pics/apps/encryption/lib/Exceptions/MultiKeyEncryptException.php

@@ -0,0 +1,27 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Exceptions;
+
+use OCP\Encryption\Exceptions\GenericEncryptionException;
+
+class MultiKeyEncryptException extends GenericEncryptionException {
+}

wedding-pics/apps/encryption/lib/Exceptions/PrivateKeyMissingException.php

@@ -0,0 +1,40 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Exceptions;
+
+use OCP\Encryption\Exceptions\GenericEncryptionException;
+
+class PrivateKeyMissingException extends GenericEncryptionException {
+
+	/**
+	 * @param string $userId
+	 */
+	public function __construct($userId) {
+		if (empty($userId)) {
+			$userId = "<no-user-id-given>";
+		}
+		parent::__construct("Private Key missing for user: $userId");
+	}
+}

wedding-pics/apps/encryption/lib/Exceptions/PublicKeyMissingException.php

@@ -0,0 +1,38 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Exceptions;
+
+use OCP\Encryption\Exceptions\GenericEncryptionException;
+
+class PublicKeyMissingException extends GenericEncryptionException {
+
+	/**
+	 * @param string $userId
+	 */
+	public function __construct($userId) {
+		if (empty($userId)) {
+			$userId = "<no-user-id-given>";
+		}
+		parent::__construct("Public Key missing for user: $userId");
+	}
+}

wedding-pics/apps/encryption/lib/HookManager.php

@@ -0,0 +1,59 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption;
+
+use OCA\Encryption\Hooks\Contracts\IHook;
+
+class HookManager {
+	/** @var IHook[] */
+	private $hookInstances = [];
+
+	/**
+	 * @param array|IHook $instances
+	 *        - This accepts either a single instance of IHook or an array of instances of IHook
+	 * @return bool
+	 */
+	public function registerHook($instances) {
+		if (is_array($instances)) {
+			foreach ($instances as $instance) {
+				if (!$instance instanceof IHook) {
+					return false;
+				}
+				$this->hookInstances[] = $instance;
+			}
+		} elseif ($instances instanceof IHook) {
+			$this->hookInstances[] = $instances;
+		}
+		return true;
+	}
+
+	public function fireHooks() {
+		foreach ($this->hookInstances as $instance) {
+			/**
+			 * Fire off the add hooks method of each instance stored in cache
+			 */
+			$instance->addHooks();
+		}
+	}
+}

wedding-pics/apps/encryption/lib/Hooks/Contracts/IHook.php

@@ -0,0 +1,31 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Hooks\Contracts;
+
+interface IHook {
+	/**
+	 * Connects Hooks
+	 *
+	 * @return null
+	 */
+	public function addHooks();
+}

wedding-pics/apps/encryption/lib/Hooks/UserHooks.php

@@ -0,0 +1,286 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Hooks;
+
+use OC\Files\Filesystem;
+use OCA\Encryption\Crypto\Crypt;
+use OCA\Encryption\Hooks\Contracts\IHook;
+use OCA\Encryption\KeyManager;
+use OCA\Encryption\Recovery;
+use OCA\Encryption\Session;
+use OCA\Encryption\Users\Setup;
+use OCA\Encryption\Util;
+use OCP\Encryption\Exceptions\GenericEncryptionException;
+use OCP\IUserManager;
+use OCP\IUserSession;
+use OCP\Util as OCUtil;
+use Psr\Log\LoggerInterface;
+
+class UserHooks implements IHook {
+	/**
+	 * list of user for which we perform a password reset
+	 * @var array<string, true>
+	 */
+	protected static array $passwordResetUsers = [];
+
+	public function __construct(
+		private KeyManager $keyManager,
+		private IUserManager $userManager,
+		private LoggerInterface $logger,
+		private Setup $userSetup,
+		private IUserSession $userSession,
+		private Util $util,
+		private Session $session,
+		private Crypt $crypt,
+		private Recovery $recovery,
+	) {
+	}
+
+	/**
+	 * Connects Hooks
+	 *
+	 * @return null
+	 */
+	public function addHooks() {
+		OCUtil::connectHook('OC_User', 'post_login', $this, 'login');
+		OCUtil::connectHook('OC_User', 'logout', $this, 'logout');
+
+		// this hooks only make sense if no master key is used
+		if ($this->util->isMasterKeyEnabled() === false) {
+			OCUtil::connectHook('OC_User',
+				'post_setPassword',
+				$this,
+				'setPassphrase');
+
+			OCUtil::connectHook('OC_User',
+				'pre_setPassword',
+				$this,
+				'preSetPassphrase');
+
+			OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
+				'post_passwordReset',
+				$this,
+				'postPasswordReset');
+
+			OCUtil::connectHook('\OC\Core\LostPassword\Controller\LostController',
+				'pre_passwordReset',
+				$this,
+				'prePasswordReset');
+
+			OCUtil::connectHook('OC_User',
+				'post_createUser',
+				$this,
+				'postCreateUser');
+
+			OCUtil::connectHook('OC_User',
+				'post_deleteUser',
+				$this,
+				'postDeleteUser');
+		}
+	}
+
+
+	/**
+	 * Startup encryption backend upon user login
+	 *
+	 * @note This method should never be called for users using client side encryption
+	 * @param array $params
+	 * @return boolean|null
+	 */
+	public function login($params) {
+		// ensure filesystem is loaded
+		if (!\OC\Files\Filesystem::$loaded) {
+			$this->setupFS($params['uid']);
+		}
+		if ($this->util->isMasterKeyEnabled() === false) {
+			$this->userSetup->setupUser($params['uid'], $params['password']);
+		}
+
+		$this->keyManager->init($params['uid'], $params['password']);
+	}
+
+	/**
+	 * remove keys from session during logout
+	 */
+	public function logout() {
+		$this->session->clear();
+	}
+
+	/**
+	 * setup encryption backend upon user created
+	 *
+	 * @note This method should never be called for users using client side encryption
+	 * @param array $params
+	 */
+	public function postCreateUser($params) {
+		$this->userSetup->setupUser($params['uid'], $params['password']);
+	}
+
+	/**
+	 * cleanup encryption backend upon user deleted
+	 *
+	 * @param array $params : uid, password
+	 * @note This method should never be called for users using client side encryption
+	 */
+	public function postDeleteUser($params) {
+		$this->keyManager->deletePublicKey($params['uid']);
+	}
+
+	public function prePasswordReset($params) {
+		$user = $params['uid'];
+		self::$passwordResetUsers[$user] = true;
+	}
+
+	public function postPasswordReset($params) {
+		$uid = $params['uid'];
+		$password = $params['password'];
+		$this->keyManager->backupUserKeys('passwordReset', $uid);
+		$this->keyManager->deleteUserKeys($uid);
+		$this->userSetup->setupUser($uid, $password);
+		unset(self::$passwordResetUsers[$uid]);
+	}
+
+	/**
+	 * If the password can't be changed within Nextcloud, than update the key password in advance.
+	 *
+	 * @param array $params : uid, password
+	 * @return boolean|null
+	 */
+	public function preSetPassphrase($params) {
+		$user = $this->userManager->get($params['uid']);
+
+		if ($user && !$user->canChangePassword()) {
+			$this->setPassphrase($params);
+		}
+	}
+
+	/**
+	 * Change a user's encryption passphrase
+	 *
+	 * @param array $params keys: uid, password
+	 * @return boolean|null
+	 */
+	public function setPassphrase($params) {
+		// if we are in the process to resetting a user password, we have nothing
+		// to do here
+		if (isset(self::$passwordResetUsers[$params['uid']])) {
+			return true;
+		}
+
+		// Get existing decrypted private key
+		$user = $this->userSession->getUser();
+
+		// current logged in user changes his own password
+		if ($user && $params['uid'] === $user->getUID()) {
+			$privateKey = $this->session->getPrivateKey();
+
+			// Encrypt private key with new user pwd as passphrase
+			$encryptedPrivateKey = $this->crypt->encryptPrivateKey($privateKey, $params['password'], $params['uid']);
+
+			// Save private key
+			if ($encryptedPrivateKey) {
+				$this->keyManager->setPrivateKey($user->getUID(),
+					$this->crypt->generateHeader() . $encryptedPrivateKey);
+			} else {
+				$this->logger->error('Encryption could not update users encryption password');
+			}
+
+		// NOTE: Session does not need to be updated as the
+		// private key has not changed, only the passphrase
+		// used to decrypt it has changed
+		} else { // admin changed the password for a different user, create new keys and re-encrypt file keys
+			$userId = $params['uid'];
+			$this->initMountPoints($userId);
+			$recoveryPassword = $params['recoveryPassword'] ?? null;
+
+			$recoveryKeyId = $this->keyManager->getRecoveryKeyId();
+			$recoveryKey = $this->keyManager->getSystemPrivateKey($recoveryKeyId);
+			try {
+				$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $recoveryPassword);
+			} catch (\Exception $e) {
+				$decryptedRecoveryKey = false;
+			}
+			if ($decryptedRecoveryKey === false) {
+				$message = 'Can not decrypt the recovery key. Maybe you provided the wrong password. Try again.';
+				throw new GenericEncryptionException($message, $message);
+			}
+
+			// we generate new keys if...
+			// ...we have a recovery password and the user enabled the recovery key
+			// ...encryption was activated for the first time (no keys exists)
+			// ...the user doesn't have any files
+			if (
+				($this->recovery->isRecoveryEnabledForUser($userId) && $recoveryPassword)
+				|| !$this->keyManager->userHasKeys($userId)
+				|| !$this->util->userHasFiles($userId)
+			) {
+				// backup old keys
+				//$this->backupAllKeys('recovery');
+
+				$newUserPassword = $params['password'];
+
+				$keyPair = $this->crypt->createKeyPair();
+
+				// Save public key
+				$this->keyManager->setPublicKey($userId, $keyPair['publicKey']);
+
+				// Encrypt private key with new password
+				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $newUserPassword, $userId);
+
+				if ($encryptedKey) {
+					$this->keyManager->setPrivateKey($userId, $this->crypt->generateHeader() . $encryptedKey);
+
+					if ($recoveryPassword) { // if recovery key is set we can re-encrypt the key files
+						$this->recovery->recoverUsersFiles($recoveryPassword, $userId);
+					}
+				} else {
+					$this->logger->error('Encryption Could not update users encryption password');
+				}
+			}
+		}
+	}
+
+	/**
+	 * init mount points for given user
+	 *
+	 * @param string $user
+	 * @throws \OC\User\NoUserException
+	 */
+	protected function initMountPoints($user) {
+		Filesystem::initMountPoints($user);
+	}
+
+	/**
+	 * setup file system for user
+	 *
+	 * @param string $uid user id
+	 */
+	protected function setupFS($uid) {
+		\OC_Util::setupFS($uid);
+	}
+}

wedding-pics/apps/encryption/lib/KeyManager.php

@@ -0,0 +1,708 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ * @author Vincent Petry <vincent@nextcloud.com>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption;
+
+use OC\Encryption\Exceptions\DecryptionFailedException;
+use OC\Files\View;
+use OCA\Encryption\Crypto\Crypt;
+use OCA\Encryption\Crypto\Encryption;
+use OCA\Encryption\Exceptions\PrivateKeyMissingException;
+use OCA\Encryption\Exceptions\PublicKeyMissingException;
+use OCP\Encryption\Keys\IStorage;
+use OCP\IConfig;
+use OCP\IUserSession;
+use OCP\Lock\ILockingProvider;
+use Psr\Log\LoggerInterface;
+
+class KeyManager {
+	private string $recoveryKeyId;
+	private string $publicShareKeyId;
+	private string $masterKeyId;
+	private string $keyId;
+	private string $publicKeyId = 'publicKey';
+	private string $privateKeyId = 'privateKey';
+	private string $shareKeyId = 'shareKey';
+	private string $fileKeyId = 'fileKey';
+
+	public function __construct(
+		private IStorage $keyStorage,
+		private Crypt $crypt,
+		private IConfig $config,
+		IUserSession $userSession,
+		private Session $session,
+		private LoggerInterface $logger,
+		private Util $util,
+		private ILockingProvider $lockingProvider,
+	) {
+		$this->recoveryKeyId = $this->config->getAppValue('encryption',
+			'recoveryKeyId');
+		if (empty($this->recoveryKeyId)) {
+			$this->recoveryKeyId = 'recoveryKey_' . substr(md5((string)time()), 0, 8);
+			$this->config->setAppValue('encryption',
+				'recoveryKeyId',
+				$this->recoveryKeyId);
+		}
+
+		$this->publicShareKeyId = $this->config->getAppValue('encryption',
+			'publicShareKeyId');
+		if (empty($this->publicShareKeyId)) {
+			$this->publicShareKeyId = 'pubShare_' . substr(md5((string)time()), 0, 8);
+			$this->config->setAppValue('encryption', 'publicShareKeyId', $this->publicShareKeyId);
+		}
+
+		$this->masterKeyId = $this->config->getAppValue('encryption',
+			'masterKeyId');
+		if (empty($this->masterKeyId)) {
+			$this->masterKeyId = 'master_' . substr(md5((string)time()), 0, 8);
+			$this->config->setAppValue('encryption', 'masterKeyId', $this->masterKeyId);
+		}
+
+		$this->keyId = $userSession->isLoggedIn() ? $userSession->getUser()->getUID() : false;
+	}
+
+	/**
+	 * check if key pair for public link shares exists, if not we create one
+	 */
+	public function validateShareKey() {
+		$shareKey = $this->getPublicShareKey();
+		if (empty($shareKey)) {
+			$this->lockingProvider->acquireLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE, 'Encryption: shared key generation');
+			try {
+				$keyPair = $this->crypt->createKeyPair();
+
+				// Save public key
+				$this->keyStorage->setSystemUserKey(
+					$this->publicShareKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
+					Encryption::ID);
+
+				// Encrypt private key empty passphrase
+				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], '');
+				$header = $this->crypt->generateHeader();
+				$this->setSystemPrivateKey($this->publicShareKeyId, $header . $encryptedKey);
+			} catch (\Throwable $e) {
+				$this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
+				throw $e;
+			}
+			$this->lockingProvider->releaseLock('encryption-generateSharedKey', ILockingProvider::LOCK_EXCLUSIVE);
+		}
+	}
+
+	/**
+	 * check if a key pair for the master key exists, if not we create one
+	 */
+	public function validateMasterKey() {
+		if ($this->util->isMasterKeyEnabled() === false) {
+			return;
+		}
+
+		$publicMasterKey = $this->getPublicMasterKey();
+		$privateMasterKey = $this->getPrivateMasterKey();
+
+		if (empty($publicMasterKey) && empty($privateMasterKey)) {
+			// There could be a race condition here if two requests would trigger
+			// the generation the second one would enter the key generation as long
+			// as the first one didn't write the key to the keystorage yet
+			$this->lockingProvider->acquireLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE, 'Encryption: master key generation');
+			try {
+				$keyPair = $this->crypt->createKeyPair();
+
+				// Save public key
+				$this->keyStorage->setSystemUserKey(
+					$this->masterKeyId . '.' . $this->publicKeyId, $keyPair['publicKey'],
+					Encryption::ID);
+
+				// Encrypt private key with system password
+				$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $this->getMasterKeyPassword(), $this->masterKeyId);
+				$header = $this->crypt->generateHeader();
+				$this->setSystemPrivateKey($this->masterKeyId, $header . $encryptedKey);
+			} catch (\Throwable $e) {
+				$this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
+				throw $e;
+			}
+			$this->lockingProvider->releaseLock('encryption-generateMasterKey', ILockingProvider::LOCK_EXCLUSIVE);
+		} elseif (empty($publicMasterKey)) {
+			$this->logger->error('A private master key is available but the public key could not be found. This should never happen.');
+			return;
+		} elseif (empty($privateMasterKey)) {
+			$this->logger->error('A public master key is available but the private key could not be found. This should never happen.');
+			return;
+		}
+
+		if (!$this->session->isPrivateKeySet()) {
+			$masterKey = $this->getSystemPrivateKey($this->masterKeyId);
+			$decryptedMasterKey = $this->crypt->decryptPrivateKey($masterKey, $this->getMasterKeyPassword(), $this->masterKeyId);
+			$this->session->setPrivateKey($decryptedMasterKey);
+		}
+
+		// after the encryption key is available we are ready to go
+		$this->session->setStatus(Session::INIT_SUCCESSFUL);
+	}
+
+	/**
+	 * @return bool
+	 */
+	public function recoveryKeyExists() {
+		$key = $this->getRecoveryKey();
+		return !empty($key);
+	}
+
+	/**
+	 * get recovery key
+	 *
+	 * @return string
+	 */
+	public function getRecoveryKey() {
+		return $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->publicKeyId, Encryption::ID);
+	}
+
+	/**
+	 * get recovery key ID
+	 *
+	 * @return string
+	 */
+	public function getRecoveryKeyId() {
+		return $this->recoveryKeyId;
+	}
+
+	/**
+	 * @param string $password
+	 * @return bool
+	 */
+	public function checkRecoveryPassword($password) {
+		$recoveryKey = $this->keyStorage->getSystemUserKey($this->recoveryKeyId . '.' . $this->privateKeyId, Encryption::ID);
+		$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $password);
+
+		if ($decryptedRecoveryKey) {
+			return true;
+		}
+		return false;
+	}
+
+	/**
+	 * @param string $uid
+	 * @param string $password
+	 * @param array $keyPair
+	 * @return bool
+	 */
+	public function storeKeyPair($uid, $password, $keyPair) {
+		// Save Public Key
+		$this->setPublicKey($uid, $keyPair['publicKey']);
+
+		$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password, $uid);
+
+		$header = $this->crypt->generateHeader();
+
+		if ($encryptedKey) {
+			$this->setPrivateKey($uid, $header . $encryptedKey);
+			return true;
+		}
+		return false;
+	}
+
+	/**
+	 * @param string $password
+	 * @param array $keyPair
+	 * @return bool
+	 */
+	public function setRecoveryKey($password, $keyPair) {
+		// Save Public Key
+		$this->keyStorage->setSystemUserKey($this->getRecoveryKeyId().
+			'.' . $this->publicKeyId,
+			$keyPair['publicKey'],
+			Encryption::ID);
+
+		$encryptedKey = $this->crypt->encryptPrivateKey($keyPair['privateKey'], $password);
+		$header = $this->crypt->generateHeader();
+
+		if ($encryptedKey) {
+			$this->setSystemPrivateKey($this->getRecoveryKeyId(), $header . $encryptedKey);
+			return true;
+		}
+		return false;
+	}
+
+	/**
+	 * @param $userId
+	 * @param $key
+	 * @return bool
+	 */
+	public function setPublicKey($userId, $key) {
+		return $this->keyStorage->setUserKey($userId, $this->publicKeyId, $key, Encryption::ID);
+	}
+
+	/**
+	 * @param $userId
+	 * @param string $key
+	 * @return bool
+	 */
+	public function setPrivateKey($userId, $key) {
+		return $this->keyStorage->setUserKey($userId,
+			$this->privateKeyId,
+			$key,
+			Encryption::ID);
+	}
+
+	/**
+	 * write file key to key storage
+	 *
+	 * @param string $path
+	 * @param string $key
+	 * @return boolean
+	 */
+	public function setFileKey($path, $key) {
+		return $this->keyStorage->setFileKey($path, $this->fileKeyId, $key, Encryption::ID);
+	}
+
+	/**
+	 * set all file keys (the file key and the corresponding share keys)
+	 *
+	 * @param string $path
+	 * @param array $keys
+	 */
+	public function setAllFileKeys($path, $keys) {
+		$this->setFileKey($path, $keys['data']);
+		foreach ($keys['keys'] as $uid => $keyFile) {
+			$this->setShareKey($path, $uid, $keyFile);
+		}
+	}
+
+	/**
+	 * write share key to the key storage
+	 *
+	 * @param string $path
+	 * @param string $uid
+	 * @param string $key
+	 * @return boolean
+	 */
+	public function setShareKey($path, $uid, $key) {
+		$keyId = $uid . '.' . $this->shareKeyId;
+		return $this->keyStorage->setFileKey($path, $keyId, $key, Encryption::ID);
+	}
+
+	/**
+	 * Decrypt private key and store it
+	 *
+	 * @param string $uid user id
+	 * @param string $passPhrase users password
+	 * @return boolean
+	 */
+	public function init($uid, $passPhrase) {
+		$this->session->setStatus(Session::INIT_EXECUTED);
+
+		try {
+			if ($this->util->isMasterKeyEnabled()) {
+				$uid = $this->getMasterKeyId();
+				$passPhrase = $this->getMasterKeyPassword();
+				$privateKey = $this->getSystemPrivateKey($uid);
+			} else {
+				$privateKey = $this->getPrivateKey($uid);
+			}
+			$privateKey = $this->crypt->decryptPrivateKey($privateKey, $passPhrase, $uid);
+		} catch (PrivateKeyMissingException $e) {
+			return false;
+		} catch (DecryptionFailedException $e) {
+			return false;
+		} catch (\Exception $e) {
+			$this->logger->warning(
+				'Could not decrypt the private key from user "' . $uid . '"" during login. Assume password change on the user back-end.',
+				[
+					'app' => 'encryption',
+					'exception' => $e,
+				]
+			);
+			return false;
+		}
+
+		if ($privateKey) {
+			$this->session->setPrivateKey($privateKey);
+			$this->session->setStatus(Session::INIT_SUCCESSFUL);
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * @param $userId
+	 * @return string
+	 * @throws PrivateKeyMissingException
+	 */
+	public function getPrivateKey($userId) {
+		$privateKey = $this->keyStorage->getUserKey($userId,
+			$this->privateKeyId, Encryption::ID);
+
+		if (strlen($privateKey) !== 0) {
+			return $privateKey;
+		}
+		throw new PrivateKeyMissingException($userId);
+	}
+
+	/**
+	 * @param string $path
+	 * @param $uid
+	 * @param ?bool $useLegacyFileKey null means try both
+	 * @return string
+	 */
+	public function getFileKey(string $path, ?string $uid, ?bool $useLegacyFileKey): string {
+		if ($uid === '') {
+			$uid = null;
+		}
+		$publicAccess = is_null($uid);
+		$encryptedFileKey = '';
+		if ($useLegacyFileKey ?? true) {
+			$encryptedFileKey = $this->keyStorage->getFileKey($path, $this->fileKeyId, Encryption::ID);
+
+			if (empty($encryptedFileKey) && $useLegacyFileKey) {
+				return '';
+			}
+		}
+
+		if ($this->util->isMasterKeyEnabled()) {
+			$uid = $this->getMasterKeyId();
+			$shareKey = $this->getShareKey($path, $uid);
+			if ($publicAccess) {
+				$privateKey = $this->getSystemPrivateKey($uid);
+				$privateKey = $this->crypt->decryptPrivateKey($privateKey, $this->getMasterKeyPassword(), $uid);
+			} else {
+				// when logged in, the master key is already decrypted in the session
+				$privateKey = $this->session->getPrivateKey();
+			}
+		} elseif ($publicAccess) {
+			// use public share key for public links
+			$uid = $this->getPublicShareKeyId();
+			$shareKey = $this->getShareKey($path, $uid);
+			$privateKey = $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->privateKeyId, Encryption::ID);
+			$privateKey = $this->crypt->decryptPrivateKey($privateKey);
+		} else {
+			$shareKey = $this->getShareKey($path, $uid);
+			$privateKey = $this->session->getPrivateKey();
+		}
+
+		if ($useLegacyFileKey ?? true) {
+			if ($encryptedFileKey && $shareKey && $privateKey) {
+				return $this->crypt->multiKeyDecryptLegacy($encryptedFileKey,
+					$shareKey,
+					$privateKey);
+			}
+		}
+		if (!($useLegacyFileKey ?? false)) {
+			if ($shareKey && $privateKey) {
+				return $this->crypt->multiKeyDecrypt($shareKey, $privateKey);
+			}
+		}
+
+		return '';
+	}
+
+	/**
+	 * Get the current version of a file
+	 *
+	 * @param string $path
+	 * @param View $view
+	 * @return int
+	 */
+	public function getVersion($path, View $view) {
+		$fileInfo = $view->getFileInfo($path);
+		if ($fileInfo === false) {
+			return 0;
+		}
+		return $fileInfo->getEncryptedVersion();
+	}
+
+	/**
+	 * Set the current version of a file
+	 *
+	 * @param string $path
+	 * @param int $version
+	 * @param View $view
+	 */
+	public function setVersion($path, $version, View $view) {
+		$fileInfo = $view->getFileInfo($path);
+
+		if ($fileInfo !== false) {
+			$cache = $fileInfo->getStorage()->getCache();
+			$cache->update($fileInfo->getId(), ['encrypted' => $version, 'encryptedVersion' => $version]);
+		}
+	}
+
+	/**
+	 * get the encrypted file key
+	 *
+	 * @param string $path
+	 * @return string
+	 */
+	public function getEncryptedFileKey($path) {
+		$encryptedFileKey = $this->keyStorage->getFileKey($path,
+			$this->fileKeyId, Encryption::ID);
+
+		return $encryptedFileKey;
+	}
+
+	/**
+	 * delete share key
+	 *
+	 * @param string $path
+	 * @param string $keyId
+	 * @return boolean
+	 */
+	public function deleteShareKey($path, $keyId) {
+		return $this->keyStorage->deleteFileKey(
+			$path,
+			$keyId . '.' . $this->shareKeyId,
+			Encryption::ID);
+	}
+
+
+	/**
+	 * @param $path
+	 * @param $uid
+	 * @return mixed
+	 */
+	public function getShareKey($path, $uid) {
+		$keyId = $uid . '.' . $this->shareKeyId;
+		return $this->keyStorage->getFileKey($path, $keyId, Encryption::ID);
+	}
+
+	/**
+	 * check if user has a private and a public key
+	 *
+	 * @param string $userId
+	 * @return bool
+	 * @throws PrivateKeyMissingException
+	 * @throws PublicKeyMissingException
+	 */
+	public function userHasKeys($userId) {
+		$privateKey = $publicKey = true;
+		$exception = null;
+
+		try {
+			$this->getPrivateKey($userId);
+		} catch (PrivateKeyMissingException $e) {
+			$privateKey = false;
+			$exception = $e;
+		}
+		try {
+			$this->getPublicKey($userId);
+		} catch (PublicKeyMissingException $e) {
+			$publicKey = false;
+			$exception = $e;
+		}
+
+		if ($privateKey && $publicKey) {
+			return true;
+		} elseif (!$privateKey && !$publicKey) {
+			return false;
+		} else {
+			throw $exception;
+		}
+	}
+
+	/**
+	 * @param $userId
+	 * @return mixed
+	 * @throws PublicKeyMissingException
+	 */
+	public function getPublicKey($userId) {
+		$publicKey = $this->keyStorage->getUserKey($userId, $this->publicKeyId, Encryption::ID);
+
+		if (strlen($publicKey) !== 0) {
+			return $publicKey;
+		}
+		throw new PublicKeyMissingException($userId);
+	}
+
+	public function getPublicShareKeyId() {
+		return $this->publicShareKeyId;
+	}
+
+	/**
+	 * get public key for public link shares
+	 *
+	 * @return string
+	 */
+	public function getPublicShareKey() {
+		return $this->keyStorage->getSystemUserKey($this->publicShareKeyId . '.' . $this->publicKeyId, Encryption::ID);
+	}
+
+	/**
+	 * @param string $purpose
+	 * @param string $uid
+	 */
+	public function backupUserKeys($purpose, $uid) {
+		$this->keyStorage->backupUserKeys(Encryption::ID, $purpose, $uid);
+	}
+
+	/**
+	 * create a backup of the users private and public key and then delete it
+	 *
+	 * @param string $uid
+	 */
+	public function deleteUserKeys($uid) {
+		$this->deletePublicKey($uid);
+		$this->deletePrivateKey($uid);
+	}
+
+	/**
+	 * @param $uid
+	 * @return bool
+	 */
+	public function deletePublicKey($uid) {
+		return $this->keyStorage->deleteUserKey($uid, $this->publicKeyId, Encryption::ID);
+	}
+
+	/**
+	 * @param string $uid
+	 * @return bool
+	 */
+	private function deletePrivateKey($uid) {
+		return $this->keyStorage->deleteUserKey($uid, $this->privateKeyId, Encryption::ID);
+	}
+
+	/**
+	 * @param string $path
+	 * @return bool
+	 */
+	public function deleteAllFileKeys($path) {
+		return $this->keyStorage->deleteAllFileKeys($path);
+	}
+
+	public function deleteLegacyFileKey(string $path): bool {
+		return $this->keyStorage->deleteFileKey($path, $this->fileKeyId, Encryption::ID);
+	}
+
+	/**
+	 * @param array $userIds
+	 * @return array
+	 * @throws PublicKeyMissingException
+	 */
+	public function getPublicKeys(array $userIds) {
+		$keys = [];
+
+		foreach ($userIds as $userId) {
+			try {
+				$keys[$userId] = $this->getPublicKey($userId);
+			} catch (PublicKeyMissingException $e) {
+				continue;
+			}
+		}
+
+		return $keys;
+	}
+
+	/**
+	 * @param string $keyId
+	 * @return string returns openssl key
+	 */
+	public function getSystemPrivateKey($keyId) {
+		return $this->keyStorage->getSystemUserKey($keyId . '.' . $this->privateKeyId, Encryption::ID);
+	}
+
+	/**
+	 * @param string $keyId
+	 * @param string $key
+	 * @return string returns openssl key
+	 */
+	public function setSystemPrivateKey($keyId, $key) {
+		return $this->keyStorage->setSystemUserKey(
+			$keyId . '.' . $this->privateKeyId,
+			$key,
+			Encryption::ID);
+	}
+
+	/**
+	 * add system keys such as the public share key and the recovery key
+	 *
+	 * @param array $accessList
+	 * @param array $publicKeys
+	 * @param string $uid
+	 * @return array
+	 * @throws PublicKeyMissingException
+	 */
+	public function addSystemKeys(array $accessList, array $publicKeys, $uid) {
+		if (!empty($accessList['public'])) {
+			$publicShareKey = $this->getPublicShareKey();
+			if (empty($publicShareKey)) {
+				throw new PublicKeyMissingException($this->getPublicShareKeyId());
+			}
+			$publicKeys[$this->getPublicShareKeyId()] = $publicShareKey;
+		}
+
+		if ($this->recoveryKeyExists() &&
+			$this->util->isRecoveryEnabledForUser($uid)) {
+			$publicKeys[$this->getRecoveryKeyId()] = $this->getRecoveryKey();
+		}
+
+		return $publicKeys;
+	}
+
+	/**
+	 * get master key password
+	 *
+	 * @return string
+	 * @throws \Exception
+	 */
+	public function getMasterKeyPassword() {
+		$password = $this->config->getSystemValue('secret');
+		if (empty($password)) {
+			throw new \Exception('Can not get secret from Nextcloud instance');
+		}
+
+		return $password;
+	}
+
+	/**
+	 * return master key id
+	 *
+	 * @return string
+	 */
+	public function getMasterKeyId() {
+		return $this->masterKeyId;
+	}
+
+	/**
+	 * get public master key
+	 *
+	 * @return string
+	 */
+	public function getPublicMasterKey() {
+		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->publicKeyId, Encryption::ID);
+	}
+
+	/**
+	 * get public master key
+	 *
+	 * @return string
+	 */
+	public function getPrivateMasterKey() {
+		return $this->keyStorage->getSystemUserKey($this->masterKeyId . '.' . $this->privateKeyId, Encryption::ID);
+	}
+}

wedding-pics/apps/encryption/lib/Migration/SetMasterKeyStatus.php

@@ -0,0 +1,75 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Bjoern Schiessle <bjoern@schiessle.org>
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Encryption\Migration;
+
+use OCP\IConfig;
+use OCP\Migration\IOutput;
+use OCP\Migration\IRepairStep;
+
+/**
+ * Class SetPasswordColumn
+ *
+ * @package OCA\Files_Sharing\Migration
+ */
+class SetMasterKeyStatus implements IRepairStep {
+
+
+	/** @var  IConfig */
+	private $config;
+
+
+	public function __construct(IConfig $config) {
+		$this->config = $config;
+	}
+
+	/**
+	 * Returns the step's name
+	 *
+	 * @return string
+	 * @since 9.1.0
+	 */
+	public function getName() {
+		return 'Write default encryption module configuration to the database';
+	}
+
+	/**
+	 * @param IOutput $output
+	 */
+	public function run(IOutput $output) {
+		if (!$this->shouldRun()) {
+			return;
+		}
+
+		// if no config for the master key is set we set it explicitly to '0' in
+		// order not to break old installations because the default changed to '1'.
+		$configAlreadySet = $this->config->getAppValue('encryption', 'useMasterKey', 'not-set');
+		if ($configAlreadySet === 'not-set') {
+			$this->config->setAppValue('encryption', 'useMasterKey', '0');
+		}
+	}
+
+	protected function shouldRun() {
+		$appVersion = $this->config->getAppValue('encryption', 'installed_version', '0.0.0');
+		return version_compare($appVersion, '2.0.0', '<');
+	}
+}

wedding-pics/apps/encryption/lib/Recovery.php

@@ -0,0 +1,303 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption;
+
+use OC\Files\View;
+use OCA\Encryption\Crypto\Crypt;
+use OCP\Encryption\IFile;
+use OCP\IConfig;
+use OCP\IUser;
+use OCP\IUserSession;
+use OCP\PreConditionNotMetException;
+
+class Recovery {
+	/**
+	 * @var null|IUser
+	 */
+	protected $user;
+	/**
+	 * @var Crypt
+	 */
+	protected $crypt;
+	/**
+	 * @var KeyManager
+	 */
+	private $keyManager;
+	/**
+	 * @var IConfig
+	 */
+	private $config;
+	/**
+	 * @var View
+	 */
+	private $view;
+	/**
+	 * @var IFile
+	 */
+	private $file;
+
+	/**
+	 * @param IUserSession $userSession
+	 * @param Crypt $crypt
+	 * @param KeyManager $keyManager
+	 * @param IConfig $config
+	 * @param IFile $file
+	 * @param View $view
+	 */
+	public function __construct(IUserSession $userSession,
+		Crypt $crypt,
+		KeyManager $keyManager,
+		IConfig $config,
+		IFile $file,
+		View $view) {
+		$this->user = ($userSession->isLoggedIn()) ? $userSession->getUser() : null;
+		$this->crypt = $crypt;
+		$this->keyManager = $keyManager;
+		$this->config = $config;
+		$this->view = $view;
+		$this->file = $file;
+	}
+
+	/**
+	 * @param string $password
+	 * @return bool
+	 */
+	public function enableAdminRecovery($password) {
+		$appConfig = $this->config;
+		$keyManager = $this->keyManager;
+
+		if (!$keyManager->recoveryKeyExists()) {
+			$keyPair = $this->crypt->createKeyPair();
+			if (!is_array($keyPair)) {
+				return false;
+			}
+
+			$this->keyManager->setRecoveryKey($password, $keyPair);
+		}
+
+		if ($keyManager->checkRecoveryPassword($password)) {
+			$appConfig->setAppValue('encryption', 'recoveryAdminEnabled', '1');
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * change recovery key id
+	 *
+	 * @param string $newPassword
+	 * @param string $oldPassword
+	 * @return bool
+	 */
+	public function changeRecoveryKeyPassword($newPassword, $oldPassword) {
+		$recoveryKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId());
+		$decryptedRecoveryKey = $this->crypt->decryptPrivateKey($recoveryKey, $oldPassword);
+		if ($decryptedRecoveryKey === false) {
+			return false;
+		}
+		$encryptedRecoveryKey = $this->crypt->encryptPrivateKey($decryptedRecoveryKey, $newPassword);
+		$header = $this->crypt->generateHeader();
+		if ($encryptedRecoveryKey) {
+			$this->keyManager->setSystemPrivateKey($this->keyManager->getRecoveryKeyId(), $header . $encryptedRecoveryKey);
+			return true;
+		}
+		return false;
+	}
+
+	/**
+	 * @param string $recoveryPassword
+	 * @return bool
+	 */
+	public function disableAdminRecovery($recoveryPassword) {
+		$keyManager = $this->keyManager;
+
+		if ($keyManager->checkRecoveryPassword($recoveryPassword)) {
+			// Set recoveryAdmin as disabled
+			$this->config->setAppValue('encryption', 'recoveryAdminEnabled', '0');
+			return true;
+		}
+		return false;
+	}
+
+	/**
+	 * check if recovery is enabled for user
+	 *
+	 * @param string $user if no user is given we check the current logged-in user
+	 *
+	 * @return bool
+	 */
+	public function isRecoveryEnabledForUser($user = '') {
+		$uid = $user === '' ? $this->user->getUID() : $user;
+		$recoveryMode = $this->config->getUserValue($uid,
+			'encryption',
+			'recoveryEnabled',
+			0);
+
+		return ($recoveryMode === '1');
+	}
+
+	/**
+	 * check if recovery is key is enabled by the administrator
+	 *
+	 * @return bool
+	 */
+	public function isRecoveryKeyEnabled() {
+		$enabled = $this->config->getAppValue('encryption', 'recoveryAdminEnabled', '0');
+
+		return ($enabled === '1');
+	}
+
+	/**
+	 * @param string $value
+	 * @return bool
+	 */
+	public function setRecoveryForUser($value) {
+		try {
+			$this->config->setUserValue($this->user->getUID(),
+				'encryption',
+				'recoveryEnabled',
+				$value);
+
+			if ($value === '1') {
+				$this->addRecoveryKeys('/' . $this->user->getUID() . '/files/');
+			} else {
+				$this->removeRecoveryKeys('/' . $this->user->getUID() . '/files/');
+			}
+
+			return true;
+		} catch (PreConditionNotMetException $e) {
+			return false;
+		}
+	}
+
+	/**
+	 * add recovery key to all encrypted files
+	 */
+	private function addRecoveryKeys(string $path): void {
+		$dirContent = $this->view->getDirectoryContent($path);
+		foreach ($dirContent as $item) {
+			$filePath = $item->getPath();
+			if ($item['type'] === 'dir') {
+				$this->addRecoveryKeys($filePath . '/');
+			} else {
+				$fileKey = $this->keyManager->getFileKey($filePath, $this->user->getUID(), null);
+				if (!empty($fileKey)) {
+					$accessList = $this->file->getAccessList($filePath);
+					$publicKeys = [];
+					foreach ($accessList['users'] as $uid) {
+						$publicKeys[$uid] = $this->keyManager->getPublicKey($uid);
+					}
+
+					$publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $this->user->getUID());
+
+					$shareKeys = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys);
+					$this->keyManager->deleteLegacyFileKey($filePath);
+					foreach ($shareKeys as $uid => $keyFile) {
+						$this->keyManager->setShareKey($filePath, $uid, $keyFile);
+					}
+				}
+			}
+		}
+	}
+
+	/**
+	 * remove recovery key to all encrypted files
+	 */
+	private function removeRecoveryKeys(string $path): void {
+		$dirContent = $this->view->getDirectoryContent($path);
+		foreach ($dirContent as $item) {
+			$filePath = $item->getPath();
+			if ($item['type'] === 'dir') {
+				$this->removeRecoveryKeys($filePath . '/');
+			} else {
+				$this->keyManager->deleteShareKey($filePath, $this->keyManager->getRecoveryKeyId());
+			}
+		}
+	}
+
+	/**
+	 * recover users files with the recovery key
+	 */
+	public function recoverUsersFiles(string $recoveryPassword, string $user): void {
+		$encryptedKey = $this->keyManager->getSystemPrivateKey($this->keyManager->getRecoveryKeyId());
+
+		$privateKey = $this->crypt->decryptPrivateKey($encryptedKey, $recoveryPassword);
+		if ($privateKey !== false) {
+			$this->recoverAllFiles('/' . $user . '/files/', $privateKey, $user);
+		}
+	}
+
+	/**
+	 * recover users files
+	 */
+	private function recoverAllFiles(string $path, string $privateKey, string $uid): void {
+		$dirContent = $this->view->getDirectoryContent($path);
+
+		foreach ($dirContent as $item) {
+			// Get relative path from encryption/keyfiles
+			$filePath = $item->getPath();
+			if ($this->view->is_dir($filePath)) {
+				$this->recoverAllFiles($filePath . '/', $privateKey, $uid);
+			} else {
+				$this->recoverFile($filePath, $privateKey, $uid);
+			}
+		}
+	}
+
+	/**
+	 * recover file
+	 */
+	private function recoverFile(string $path, string $privateKey, string $uid): void {
+		$encryptedFileKey = $this->keyManager->getEncryptedFileKey($path);
+		$shareKey = $this->keyManager->getShareKey($path, $this->keyManager->getRecoveryKeyId());
+
+		if ($encryptedFileKey && $shareKey && $privateKey) {
+			$fileKey = $this->crypt->multiKeyDecryptLegacy($encryptedFileKey,
+				$shareKey,
+				$privateKey);
+		} elseif ($shareKey && $privateKey) {
+			$fileKey = $this->crypt->multiKeyDecrypt($shareKey, $privateKey);
+		}
+
+		if (!empty($fileKey)) {
+			$accessList = $this->file->getAccessList($path);
+			$publicKeys = [];
+			foreach ($accessList['users'] as $user) {
+				$publicKeys[$user] = $this->keyManager->getPublicKey($user);
+			}
+
+			$publicKeys = $this->keyManager->addSystemKeys($accessList, $publicKeys, $uid);
+
+			$shareKeys = $this->crypt->multiKeyEncrypt($fileKey, $publicKeys);
+			$this->keyManager->deleteLegacyFileKey($path);
+			foreach ($shareKeys as $uid => $keyFile) {
+				$this->keyManager->setShareKey($path, $uid, $keyFile);
+			}
+		}
+	}
+}

wedding-pics/apps/encryption/lib/Session.php

@@ -0,0 +1,187 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption;
+
+use OCA\Encryption\Exceptions\PrivateKeyMissingException;
+use OCP\ISession;
+
+class Session {
+
+	/** @var ISession */
+	protected $session;
+
+	public const NOT_INITIALIZED = '0';
+	public const INIT_EXECUTED = '1';
+	public const INIT_SUCCESSFUL = '2';
+
+	/**
+	 * @param ISession $session
+	 */
+	public function __construct(ISession $session) {
+		$this->session = $session;
+	}
+
+	/**
+	 * Sets status of encryption app
+	 *
+	 * @param string $status INIT_SUCCESSFUL, INIT_EXECUTED, NOT_INITIALIZED
+	 */
+	public function setStatus($status) {
+		$this->session->set('encryptionInitialized', $status);
+	}
+
+	/**
+	 * Gets status if we already tried to initialize the encryption app
+	 *
+	 * @return string init status INIT_SUCCESSFUL, INIT_EXECUTED, NOT_INITIALIZED
+	 */
+	public function getStatus() {
+		$status = $this->session->get('encryptionInitialized');
+		if (is_null($status)) {
+			$status = self::NOT_INITIALIZED;
+		}
+
+		return $status;
+	}
+
+	/**
+	 * check if encryption was initialized successfully
+	 *
+	 * @return bool
+	 */
+	public function isReady() {
+		$status = $this->getStatus();
+		return $status === self::INIT_SUCCESSFUL;
+	}
+
+	/**
+	 * Gets user or public share private key from session
+	 *
+	 * @return string $privateKey The user's plaintext private key
+	 * @throws Exceptions\PrivateKeyMissingException
+	 */
+	public function getPrivateKey() {
+		$key = $this->session->get('privateKey');
+		if (is_null($key)) {
+			throw new Exceptions\PrivateKeyMissingException('please try to log-out and log-in again', 0);
+		}
+		return $key;
+	}
+
+	/**
+	 * check if private key is set
+	 *
+	 * @return boolean
+	 */
+	public function isPrivateKeySet() {
+		$key = $this->session->get('privateKey');
+		if (is_null($key)) {
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * Sets user private key to session
+	 *
+	 * @param string $key users private key
+	 *
+	 * @note this should only be set on login
+	 */
+	public function setPrivateKey($key) {
+		$this->session->set('privateKey', $key);
+	}
+
+	/**
+	 * store data needed for the decrypt all operation in the session
+	 *
+	 * @param string $user
+	 * @param string $key
+	 */
+	public function prepareDecryptAll($user, $key) {
+		$this->session->set('decryptAll', true);
+		$this->session->set('decryptAllKey', $key);
+		$this->session->set('decryptAllUid', $user);
+	}
+
+	/**
+	 * check if we are in decrypt all mode
+	 *
+	 * @return bool
+	 */
+	public function decryptAllModeActivated() {
+		$decryptAll = $this->session->get('decryptAll');
+		return ($decryptAll === true);
+	}
+
+	/**
+	 * get uid used for decrypt all operation
+	 *
+	 * @return string
+	 * @throws \Exception
+	 */
+	public function getDecryptAllUid() {
+		$uid = $this->session->get('decryptAllUid');
+		if (is_null($uid) && $this->decryptAllModeActivated()) {
+			throw new \Exception('No uid found while in decrypt all mode');
+		} elseif (is_null($uid)) {
+			throw new \Exception('Please activate decrypt all mode first');
+		}
+
+		return $uid;
+	}
+
+	/**
+	 * get private key for decrypt all operation
+	 *
+	 * @return string
+	 * @throws PrivateKeyMissingException
+	 */
+	public function getDecryptAllKey() {
+		$privateKey = $this->session->get('decryptAllKey');
+		if (is_null($privateKey) && $this->decryptAllModeActivated()) {
+			throw new PrivateKeyMissingException('No private key found while in decrypt all mode');
+		} elseif (is_null($privateKey)) {
+			throw new PrivateKeyMissingException('Please activate decrypt all mode first');
+		}
+
+		return $privateKey;
+	}
+
+	/**
+	 * remove keys from session
+	 */
+	public function clear() {
+		$this->session->remove('publicSharePrivateKey');
+		$this->session->remove('privateKey');
+		$this->session->remove('encryptionInitialized');
+		$this->session->remove('decryptAll');
+		$this->session->remove('decryptAllKey');
+		$this->session->remove('decryptAllUid');
+	}
+}

wedding-pics/apps/encryption/lib/Settings/Admin.php

@@ -0,0 +1,102 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Encryption\Settings;
+
+use OC\Files\View;
+use OCA\Encryption\Crypto\Crypt;
+use OCA\Encryption\Session;
+use OCA\Encryption\Util;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\ISession;
+use OCP\IUserManager;
+use OCP\IUserSession;
+use OCP\Settings\ISettings;
+use Psr\Log\LoggerInterface;
+
+class Admin implements ISettings {
+	public function __construct(
+		private IL10N $l,
+		private LoggerInterface $logger,
+		private IUserSession $userSession,
+		private IConfig $config,
+		private IUserManager $userManager,
+		private ISession $session
+	) {
+	}
+
+	/**
+	 * @return TemplateResponse
+	 */
+	public function getForm() {
+		$crypt = new Crypt(
+			$this->logger,
+			$this->userSession,
+			$this->config,
+			$this->l);
+
+		$util = new Util(
+			new View(),
+			$crypt,
+			$this->userSession,
+			$this->config,
+			$this->userManager);
+
+		// Check if an adminRecovery account is enabled for recovering files after lost pwd
+		$recoveryAdminEnabled = $this->config->getAppValue('encryption', 'recoveryAdminEnabled', '0');
+		$session = new Session($this->session);
+
+		$encryptHomeStorage = $util->shouldEncryptHomeStorage();
+
+		$parameters = [
+			'recoveryEnabled' => $recoveryAdminEnabled,
+			'initStatus' => $session->getStatus(),
+			'encryptHomeStorage' => $encryptHomeStorage,
+			'masterKeyEnabled' => $util->isMasterKeyEnabled(),
+		];
+
+		return new TemplateResponse('encryption', 'settings-admin', $parameters, '');
+	}
+
+	/**
+	 * @return string the section ID, e.g. 'sharing'
+	 */
+	public function getSection() {
+		return 'security';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 */
+	public function getPriority() {
+		return 11;
+	}
+}

wedding-pics/apps/encryption/lib/Settings/Personal.php

@@ -0,0 +1,94 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Encryption\Settings;
+
+use OCA\Encryption\Session;
+use OCA\Encryption\Util;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\IConfig;
+use OCP\IUserSession;
+use OCP\Settings\ISettings;
+
+class Personal implements ISettings {
+
+	/** @var IConfig */
+	private $config;
+	/** @var Session */
+	private $session;
+	/** @var Util */
+	private $util;
+	/** @var IUserSession */
+	private $userSession;
+
+	public function __construct(IConfig $config, Session $session, Util $util, IUserSession $userSession) {
+		$this->config = $config;
+		$this->session = $session;
+		$this->util = $util;
+		$this->userSession = $userSession;
+	}
+
+	/**
+	 * @return TemplateResponse returns the instance with all parameters set, ready to be rendered
+	 * @since 9.1
+	 */
+	public function getForm() {
+		$recoveryAdminEnabled = $this->config->getAppValue('encryption', 'recoveryAdminEnabled');
+		$privateKeySet = $this->session->isPrivateKeySet();
+
+		if (!$recoveryAdminEnabled && $privateKeySet) {
+			return new TemplateResponse('settings', 'settings/empty', [], '');
+		}
+
+		$userId = $this->userSession->getUser()->getUID();
+		$recoveryEnabledForUser = $this->util->isRecoveryEnabledForUser($userId);
+
+		$parameters = [
+			'recoveryEnabled' => $recoveryAdminEnabled,
+			'recoveryEnabledForUser' => $recoveryEnabledForUser,
+			'privateKeySet' => $privateKeySet,
+			'initialized' => $this->session->getStatus(),
+		];
+		return new TemplateResponse('encryption', 'settings-personal', $parameters, '');
+	}
+
+	/**
+	 * @return string the section ID, e.g. 'sharing'
+	 * @since 9.1
+	 */
+	public function getSection() {
+		return 'security';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 * @since 9.1
+	 */
+	public function getPriority() {
+		return 80;
+	}
+}

wedding-pics/apps/encryption/lib/Users/Setup.php

@@ -0,0 +1,65 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption\Users;
+
+use OCA\Encryption\Crypto\Crypt;
+use OCA\Encryption\KeyManager;
+
+class Setup {
+	/** @var Crypt */
+	private $crypt;
+	/** @var KeyManager */
+	private $keyManager;
+
+	public function __construct(Crypt $crypt,
+		KeyManager $keyManager) {
+		$this->crypt = $crypt;
+		$this->keyManager = $keyManager;
+	}
+
+	/**
+	 * @param string $uid user id
+	 * @param string $password user password
+	 * @return bool
+	 */
+	public function setupUser($uid, $password) {
+		if (!$this->keyManager->userHasKeys($uid)) {
+			$keyPair = $this->crypt->createKeyPair();
+			return is_array($keyPair) ? $this->keyManager->storeKeyPair($uid, $password, $keyPair) : false;
+		}
+		return true;
+	}
+
+	/**
+	 * make sure that all system keys exists
+	 */
+	public function setupSystem() {
+		$this->keyManager->validateShareKey();
+		$this->keyManager->validateMasterKey();
+	}
+}

wedding-pics/apps/encryption/lib/Util.php

@@ -0,0 +1,162 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Clark Tomlinson <fallen013@gmail.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Phil Davis <phil.davis@inf.org>
+ * @author Robin Appelman <robin@icewind.nl>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Encryption;
+
+use OC\Files\View;
+use OCA\Encryption\Crypto\Crypt;
+use OCP\IConfig;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\IUserSession;
+use OCP\PreConditionNotMetException;
+
+class Util {
+	private IUser|false $user;
+
+	public function __construct(
+		private View $files,
+		private Crypt $crypt,
+		IUserSession $userSession,
+		private IConfig $config,
+		private IUserManager $userManager,
+	) {
+		$this->files = $files;
+		$this->crypt = $crypt;
+		$this->user = $userSession->isLoggedIn() ? $userSession->getUser() : false;
+		$this->config = $config;
+		$this->userManager = $userManager;
+	}
+
+	/**
+	 * check if recovery key is enabled for user
+	 *
+	 * @param string $uid
+	 * @return bool
+	 */
+	public function isRecoveryEnabledForUser($uid) {
+		$recoveryMode = $this->config->getUserValue($uid,
+			'encryption',
+			'recoveryEnabled',
+			'0');
+
+		return ($recoveryMode === '1');
+	}
+
+	/**
+	 * check if the home storage should be encrypted
+	 *
+	 * @return bool
+	 */
+	public function shouldEncryptHomeStorage() {
+		$encryptHomeStorage = $this->config->getAppValue(
+			'encryption',
+			'encryptHomeStorage',
+			'1'
+		);
+
+		return ($encryptHomeStorage === '1');
+	}
+
+	/**
+	 * set the home storage encryption on/off
+	 *
+	 * @param bool $encryptHomeStorage
+	 */
+	public function setEncryptHomeStorage($encryptHomeStorage) {
+		$value = $encryptHomeStorage ? '1' : '0';
+		$this->config->setAppValue(
+			'encryption',
+			'encryptHomeStorage',
+			$value
+		);
+	}
+
+	/**
+	 * check if master key is enabled
+	 */
+	public function isMasterKeyEnabled(): bool {
+		$userMasterKey = $this->config->getAppValue('encryption', 'useMasterKey', '1');
+		return ($userMasterKey === '1');
+	}
+
+	/**
+	 * @param $enabled
+	 * @return bool
+	 */
+	public function setRecoveryForUser($enabled) {
+		$value = $enabled ? '1' : '0';
+
+		try {
+			$this->config->setUserValue($this->user->getUID(),
+				'encryption',
+				'recoveryEnabled',
+				$value);
+			return true;
+		} catch (PreConditionNotMetException $e) {
+			return false;
+		}
+	}
+
+	/**
+	 * @param string $uid
+	 * @return bool
+	 */
+	public function userHasFiles($uid) {
+		return $this->files->file_exists($uid . '/files');
+	}
+
+	/**
+	 * get owner from give path, path relative to data/ expected
+	 *
+	 * @param string $path relative to data/
+	 * @return string
+	 * @throws \BadMethodCallException
+	 */
+	public function getOwner($path) {
+		$owner = '';
+		$parts = explode('/', $path, 3);
+		if (count($parts) > 1) {
+			$owner = $parts[1];
+			if ($this->userManager->userExists($owner) === false) {
+				throw new \BadMethodCallException('Unknown user: ' .
+				'method expects path to a user folder relative to the data folder');
+			}
+		}
+
+		return $owner;
+	}
+
+	/**
+	 * get storage of path
+	 *
+	 * @param string $path
+	 * @return \OC\Files\Storage\Storage|null
+	 */
+	public function getStorage($path) {
+		return $this->files->getMount($path)->getStorage();
+	}
+}