nextcloud/apps/files_encryption/lib/util.php

1450 lines
37 KiB
PHP
Raw Normal View History

<?php
/**
* ownCloud
*
* @author Sam Tuke, Frank Karlitschek
2013-05-20 03:24:36 +04:00
* @copyright 2012 Sam Tuke <samtuke@owncloud.com>,
* Frank Karlitschek <frank@owncloud.org>
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
* License as published by the Free Software Foundation; either
* version 3 of the License, or any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
*
* You should have received a copy of the GNU Affero General Public
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
*
*/
# Bugs
# ----
# Sharing a file to a user without encryption set up will not provide them with access but won't notify the sharer
# Sharing all files to admin for recovery purposes still in progress
# Possibly public links are broken (not tested since last merge of master)
# Missing features
# ----------------
# Make sure user knows if large files weren't encrypted
# Test
# ----
# Test that writing files works when recovery is enabled, and sharing API is disabled
# Test trashbin support
// Old Todo:
// - Crypt/decrypt button in the userinterface
// - Setting if crypto should be on by default
// - Add a setting "Don´t encrypt files larger than xx because of performance
// reasons"
namespace OCA\Encryption;
/**
* @brief Class for utilities relating to encrypted file storage system
* @param OC_FilesystemView $view expected to have OC '/' as root path
* @param string $userId ID of the logged in user
* @param int $client indicating status of client side encryption. Currently
* unused, likely to become obsolete shortly
*/
2013-05-20 03:24:36 +04:00
class Util
{
// Web UI:
2013-05-20 03:24:36 +04:00
//// DONE: files created via web ui are encrypted
//// DONE: file created & encrypted via web ui are readable in web ui
//// DONE: file created & encrypted via web ui are readable via webdav
2013-05-20 03:24:36 +04:00
// WebDAV:
2013-05-20 03:24:36 +04:00
//// DONE: new data filled files added via webdav get encrypted
//// DONE: new data filled files added via webdav are readable via webdav
//// DONE: reading unencrypted files when encryption is enabled works via
//// webdav
//// DONE: files created & encrypted via web ui are readable via webdav
2013-05-20 03:24:36 +04:00
// Legacy support:
2013-05-20 03:24:36 +04:00
//// DONE: add method to check if file is encrypted using new system
//// DONE: add method to check if file is encrypted using old system
//// DONE: add method to fetch legacy key
//// DONE: add method to decrypt legacy encrypted data
2013-05-20 03:24:36 +04:00
// Admin UI:
2013-05-20 03:24:36 +04:00
//// DONE: changing user password also changes encryption passphrase
2013-05-20 03:24:36 +04:00
//// TODO: add support for optional recovery in case of lost passphrase / keys
//// TODO: add admin optional required long passphrase for users
//// TODO: implement flag system to allow user to specify encryption by folder, subfolder, etc.
2013-05-20 03:24:36 +04:00
// Integration testing:
2013-05-20 03:24:36 +04:00
//// TODO: test new encryption with versioning
2013-05-11 02:23:30 +04:00
//// DONE: test new encryption with sharing
//// TODO: test new encryption with proxies
2013-05-20 03:24:36 +04:00
private $view; // OC_FilesystemView object for filesystem operations
private $userId; // ID of the currently logged-in user
private $pwd; // User Password
private $client; // Client side encryption mode flag
private $publicKeyDir; // Dir containing all public user keys
private $encryptionDir; // Dir containing user's files_encryption
private $keyfilesPath; // Dir containing user's keyfiles
private $shareKeysPath; // Dir containing env keys for shared files
private $publicKeyPath; // Path to user's public key
private $privateKeyPath; // Path to user's private key
private $publicShareKeyId;
private $recoveryKeyId;
2013-05-20 03:24:36 +04:00
private $isPublic;
2013-05-20 03:24:36 +04:00
/**
* @param \OC_FilesystemView $view
* @param $userId
* @param bool $client
*/
2013-05-24 01:56:31 +04:00
public function __construct( \OC_FilesystemView $view, $userId, $client = false ) {
$this->view = $view;
$this->userId = $userId;
$this->client = $client;
2013-05-20 03:24:36 +04:00
$this->isPublic = false;
2013-05-24 01:56:31 +04:00
$this->publicShareKeyId = \OC_Appconfig::getValue( 'files_encryption', 'publicShareKeyId' );
$this->recoveryKeyId = \OC_Appconfig::getValue( 'files_encryption', 'recoveryKeyId' );
2013-05-20 03:24:36 +04:00
// if we are anonymous/public
2013-05-24 01:56:31 +04:00
if ( $this->userId === false ||
( isset( $_GET['service'] ) && $_GET['service'] == 'files' &&
isset( $_GET['t'] ) )
) {
2013-05-20 03:24:36 +04:00
$this->userId = $this->publicShareKeyId;
// only handle for files_sharing app
2013-05-24 01:56:31 +04:00
if ( $GLOBALS['app'] === 'files_sharing' ) {
2013-05-20 03:24:36 +04:00
$this->userDir = '/' . $GLOBALS['fileOwner'];
$this->fileFolderName = 'files';
$this->userFilesDir = '/' . $GLOBALS['fileOwner'] . '/' . $this->fileFolderName; // TODO: Does this need to be user configurable?
$this->publicKeyDir = '/' . 'public-keys';
$this->encryptionDir = '/' . $GLOBALS['fileOwner'] . '/' . 'files_encryption';
$this->keyfilesPath = $this->encryptionDir . '/' . 'keyfiles';
$this->shareKeysPath = $this->encryptionDir . '/' . 'share-keys';
$this->publicKeyPath = $this->publicKeyDir . '/' . $this->userId . '.public.key'; // e.g. data/public-keys/admin.public.key
$this->privateKeyPath = '/owncloud_private_key/' . $this->userId . '.private.key'; // e.g. data/admin/admin.private.key
$this->isPublic = true;
}
} else {
$this->userDir = '/' . $this->userId;
$this->fileFolderName = 'files';
$this->userFilesDir = '/' . $this->userId . '/' . $this->fileFolderName; // TODO: Does this need to be user configurable?
$this->publicKeyDir = '/' . 'public-keys';
$this->encryptionDir = '/' . $this->userId . '/' . 'files_encryption';
$this->keyfilesPath = $this->encryptionDir . '/' . 'keyfiles';
$this->shareKeysPath = $this->encryptionDir . '/' . 'share-keys';
$this->publicKeyPath = $this->publicKeyDir . '/' . $this->userId . '.public.key'; // e.g. data/public-keys/admin.public.key
$this->privateKeyPath = $this->encryptionDir . '/' . $this->userId . '.private.key'; // e.g. data/admin/admin.private.key
}
}
2013-05-20 03:24:36 +04:00
/**
* @return bool
*/
2013-05-24 01:56:31 +04:00
public function ready() {
2013-05-20 03:24:36 +04:00
if (
2013-05-24 01:56:31 +04:00
!$this->view->file_exists( $this->encryptionDir )
or !$this->view->file_exists( $this->keyfilesPath )
or !$this->view->file_exists( $this->shareKeysPath )
or !$this->view->file_exists( $this->publicKeyPath )
or !$this->view->file_exists( $this->privateKeyPath )
) {
2013-05-20 03:24:36 +04:00
return false;
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
return true;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
* @brief Sets up user folders and keys for serverside encryption
* @param string $passphrase passphrase to encrypt server-stored private key with
*/
2013-05-24 01:56:31 +04:00
public function setupServerSide( $passphrase = null ) {
2013-05-20 03:24:36 +04:00
// Set directories to check / create
2013-05-20 03:24:36 +04:00
$setUpDirs = array(
$this->userDir
2013-05-20 03:24:36 +04:00
, $this->userFilesDir
, $this->publicKeyDir
, $this->encryptionDir
, $this->keyfilesPath
, $this->shareKeysPath
);
2013-05-20 03:24:36 +04:00
// Check / create all necessary dirs
2013-05-24 01:56:31 +04:00
foreach ( $setUpDirs as $dirPath ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
if ( !$this->view->file_exists( $dirPath ) ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$this->view->mkdir( $dirPath );
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
// Create user keypair
// we should never override a keyfile
2013-05-20 03:24:36 +04:00
if (
2013-05-24 01:56:31 +04:00
!$this->view->file_exists( $this->publicKeyPath )
&& !$this->view->file_exists( $this->privateKeyPath )
) {
2013-05-20 03:24:36 +04:00
// Generate keypair
$keypair = Crypt::createKeypair();
2013-05-20 03:24:36 +04:00
\OC_FileProxy::$enabled = false;
2013-05-20 03:24:36 +04:00
// Save public key
2013-05-24 01:56:31 +04:00
$this->view->file_put_contents( $this->publicKeyPath, $keypair['publicKey'] );
2013-05-20 03:24:36 +04:00
// Encrypt private key with user pwd as passphrase
2013-05-24 01:56:31 +04:00
$encryptedPrivateKey = Crypt::symmetricEncryptFileContent( $keypair['privateKey'], $passphrase );
2013-05-20 03:24:36 +04:00
// Save private key
2013-05-24 01:56:31 +04:00
$this->view->file_put_contents( $this->privateKeyPath, $encryptedPrivateKey );
2013-05-20 03:24:36 +04:00
\OC_FileProxy::$enabled = true;
2013-05-20 03:24:36 +04:00
} else {
// check if public-key exists but private-key is missing
2013-05-24 01:56:31 +04:00
if ( $this->view->file_exists( $this->publicKeyPath ) && !$this->view->file_exists( $this->privateKeyPath ) ) {
\OC_Log::write( 'Encryption library', 'public key exists but private key is missing for "' . $this->userId . '"', \OC_Log::FATAL );
return false;
2013-05-24 01:56:31 +04:00
} else if ( !$this->view->file_exists( $this->publicKeyPath ) && $this->view->file_exists( $this->privateKeyPath ) ) {
\OC_Log::write( 'Encryption library', 'private key exists but public key is missing for "' . $this->userId . '"', \OC_Log::FATAL );
return false;
}
}
2013-05-20 03:24:36 +04:00
// If there's no record for this user's encryption preferences
2013-05-24 01:56:31 +04:00
if ( false === $this->recoveryEnabledForUser() ) {
2013-05-20 03:24:36 +04:00
// create database configuration
$sql = 'INSERT INTO `*PREFIX*encryption` (`uid`,`mode`,`recovery_enabled`) VALUES (?,?,?)';
2013-05-24 01:56:31 +04:00
$args = array( $this->userId, 'server-side', 0 );
$query = \OCP\DB::prepare( $sql );
$query->execute( $args );
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
return true;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
* @return string
*/
2013-05-24 01:56:31 +04:00
public function getPublicShareKeyId() {
return $this->publicShareKeyId;
}
2013-05-20 03:24:36 +04:00
/**
* @brief Check whether pwd recovery is enabled for a given user
2013-05-20 03:24:36 +04:00
* @return bool 1 = yes, 0 = no, false = no record
*
* @note If records are not being returned, check for a hidden space
* at the start of the uid in db
*/
2013-05-24 01:56:31 +04:00
public function recoveryEnabledForUser() {
2013-05-20 03:24:36 +04:00
$sql = 'SELECT
recovery_enabled
FROM
`*PREFIX*encryption`
WHERE
uid = ?';
2013-05-24 01:56:31 +04:00
$args = array( $this->userId );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$query = \OCP\DB::prepare( $sql );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$result = $query->execute( $args );
2013-05-20 03:24:36 +04:00
$recoveryEnabled = array();
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
while ( $row = $result->fetchRow() ) {
2013-05-20 03:24:36 +04:00
$recoveryEnabled[] = $row['recovery_enabled'];
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
// If no record is found
2013-05-24 01:56:31 +04:00
if ( empty( $recoveryEnabled ) ) {
2013-05-20 03:24:36 +04:00
return false;
2013-05-20 03:24:36 +04:00
// If a record is found
} else {
2013-05-20 03:24:36 +04:00
return $recoveryEnabled[0];
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
* @brief Enable / disable pwd recovery for a given user
* @param bool $enabled Whether to enable or disable recovery
* @return bool
*/
2013-05-24 01:56:31 +04:00
public function setRecoveryForUser( $enabled ) {
2013-05-20 03:24:36 +04:00
$recoveryStatus = $this->recoveryEnabledForUser();
2013-05-20 03:24:36 +04:00
// If a record for this user already exists, update it
2013-05-24 01:56:31 +04:00
if ( false === $recoveryStatus ) {
2013-05-20 03:24:36 +04:00
$sql = 'INSERT INTO `*PREFIX*encryption`
(`uid`,`mode`,`recovery_enabled`)
VALUES (?,?,?)';
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$args = array( $this->userId, 'server-side', $enabled );
2013-05-20 03:24:36 +04:00
// Create a new record instead
} else {
2013-05-20 03:24:36 +04:00
$sql = 'UPDATE
*PREFIX*encryption
SET
recovery_enabled = ?
WHERE
uid = ?';
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$args = array( $enabled, $this->userId );
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$query = \OCP\DB::prepare( $sql );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
if ( $query->execute( $args ) ) {
2013-05-20 03:24:36 +04:00
return true;
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
return false;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
* @brief Find all files and their encryption status within a directory
* @param string $directory The path of the parent directory to search
* @return mixed false if 0 found, array on success. Keys: name, path
* @note $directory needs to be a path relative to OC data dir. e.g.
* /admin/files NOT /backup OR /home/www/oc/data/admin/files
*/
2013-05-24 01:56:31 +04:00
public function findEncFiles( $directory, &$found = false ) {
2013-05-20 03:24:36 +04:00
// Disable proxy - we don't want files to be decrypted before
// we handle them
\OC_FileProxy::$enabled = false;
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
if ( $found == false ) {
$found = array( 'plain' => array(), 'encrypted' => array(), 'legacy' => array() );
}
2013-05-20 03:24:36 +04:00
if (
2013-05-24 01:56:31 +04:00
$this->view->is_dir( $directory )
&& $handle = $this->view->opendir( $directory )
) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
while ( false !== ( $file = readdir( $handle ) ) ) {
2013-05-20 03:24:36 +04:00
if (
2013-05-20 03:24:36 +04:00
$file != "."
&& $file != ".."
) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$filePath = $directory . '/' . $this->view->getRelativePath( '/' . $file );
$relPath = $this->stripUserFilesPath( $filePath );
2013-05-20 03:24:36 +04:00
// If the path is a directory, search
// its contents
2013-05-24 01:56:31 +04:00
if ( $this->view->is_dir( $filePath ) ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$this->findEncFiles( $filePath, $found );
2013-05-20 03:24:36 +04:00
// If the path is a file, determine
// its encryption status
2013-05-24 01:56:31 +04:00
} elseif ( $this->view->is_file( $filePath ) ) {
2013-05-20 03:24:36 +04:00
// Disable proxies again, some-
// where they got re-enabled :/
\OC_FileProxy::$enabled = false;
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$data = $this->view->file_get_contents( $filePath );
2013-05-20 03:24:36 +04:00
// If the file is encrypted
// NOTE: If the userId is
// empty or not set, file will
// detected as plain
// NOTE: This is inefficient;
// scanning every file like this
// will eat server resources :(
2013-05-20 03:24:36 +04:00
if (
2013-05-24 01:56:31 +04:00
Keymanager::getFileKey( $this->view, $this->userId, $relPath )
&& Crypt::isCatfileContent( $data )
) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$found['encrypted'][] = array( 'name' => $file, 'path' => $filePath );
2013-05-20 03:24:36 +04:00
// If the file uses old
// encryption system
} elseif ( Crypt::isLegacyEncryptedContent( $data, $relPath ) ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$found['legacy'][] = array( 'name' => $file, 'path' => $filePath );
2013-05-20 03:24:36 +04:00
// If the file is not encrypted
} else {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$found['plain'][] = array( 'name' => $file, 'path' => $relPath );
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
\OC_FileProxy::$enabled = true;
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
if ( empty( $found ) ) {
2013-05-20 03:24:36 +04:00
return false;
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
return $found;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
\OC_FileProxy::$enabled = true;
2013-05-20 03:24:36 +04:00
return false;
}
2013-05-20 03:24:36 +04:00
/**
* @brief Fetch the last lines of a file efficiently
* @note Safe to use on large files; does not read entire file to memory
* @note Derivative of http://tekkie.flashbit.net/php/tail-functionality-in-php
*/
2013-05-24 01:56:31 +04:00
public function tail( $filename, $numLines ) {
2013-05-20 03:24:36 +04:00
\OC_FileProxy::$enabled = false;
2013-05-20 03:24:36 +04:00
$text = '';
$pos = -1;
2013-05-24 01:56:31 +04:00
$handle = $this->view->fopen( $filename, 'r' );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
while ( $numLines > 0 ) {
--$pos;
2013-05-24 01:56:31 +04:00
if ( fseek( $handle, $pos, SEEK_END ) !== 0 ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
rewind( $handle );
$numLines = 0;
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
} elseif ( fgetc( $handle ) === "\n" ) {
2013-05-20 03:24:36 +04:00
--$numLines;
2013-05-20 03:24:36 +04:00
}
2013-05-24 01:56:31 +04:00
$block_size = ( -$pos ) % 8192;
if ( $block_size === 0 || $numLines === 0 ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$text = fread( $handle, ( $block_size === 0 ? 8192 : $block_size ) ) . $text;
2013-05-20 03:24:36 +04:00
}
}
2013-05-24 01:56:31 +04:00
fclose( $handle );
2013-05-20 03:24:36 +04:00
\OC_FileProxy::$enabled = true;
2013-05-20 03:24:36 +04:00
return $text;
}
2013-05-20 03:24:36 +04:00
/**
2013-05-20 03:24:36 +04:00
* @brief Check if a given path identifies an encrypted file
* @param $path
* @return boolean
*/
2013-05-24 01:56:31 +04:00
public function isEncryptedPath( $path ) {
2013-05-20 03:24:36 +04:00
// Disable encryption proxy so data retrieved is in its
// original form
2013-05-20 03:24:36 +04:00
$proxyStatus = \OC_FileProxy::$enabled;
\OC_FileProxy::$enabled = false;
2013-05-20 03:24:36 +04:00
// we only need 24 byte from the last chunk
$data = '';
2013-05-24 01:56:31 +04:00
$handle = $this->view->fopen( $path, 'r' );
if ( !fseek( $handle, -24, SEEK_END ) ) {
$data = fgets( $handle );
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
// re-enable proxy
\OC_FileProxy::$enabled = $proxyStatus;
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
return Crypt::isCatfileContent( $data );
2013-05-20 03:24:36 +04:00
}
/**
2013-05-20 03:24:36 +04:00
* @brief get the file size of the unencrypted file
* @param string $path absolute path
* @return bool
*/
2013-05-24 01:56:31 +04:00
public function getFileSize( $path ) {
$result = 0;
// Disable encryption proxy to prevent recursive calls
$proxyStatus = \OC_FileProxy::$enabled;
\OC_FileProxy::$enabled = false;
// Reformat path for use with OC_FSV
2013-05-24 01:56:31 +04:00
$pathSplit = explode( '/', $path );
$pathRelative = implode( '/', array_slice( $pathSplit, 3 ) );
2013-05-24 01:56:31 +04:00
if ( $pathSplit[2] == 'files' && $this->view->file_exists( $path ) && $this->isEncryptedPath( $path ) ) {
// get the size from filesystem
2013-05-24 01:56:31 +04:00
$fullPath = $this->view->getLocalFile( $path );
$size = filesize( $fullPath );
// calculate last chunk nr
2013-05-24 01:56:31 +04:00
$lastChunkNr = floor( $size / 8192 );
// open stream
2013-05-24 01:56:31 +04:00
$stream = fopen( 'crypt://' . $pathRelative, "r" );
2013-05-24 01:56:31 +04:00
if ( is_resource( $stream ) ) {
// calculate last chunk position
2013-05-24 01:56:31 +04:00
$lastChunckPos = ( $lastChunkNr * 8192 );
// seek to end
2013-05-24 01:56:31 +04:00
fseek( $stream, $lastChunckPos );
// get the content of the last chunk
2013-05-24 01:56:31 +04:00
$lastChunkContent = fread( $stream, 8192 );
// calc the real file size with the size of the last chunk
2013-05-24 01:56:31 +04:00
$realSize = ( ( $lastChunkNr * 6126 ) + strlen( $lastChunkContent ) );
// store file size
$result = $realSize;
}
}
2013-04-28 01:34:25 +04:00
\OC_FileProxy::$enabled = $proxyStatus;
2013-04-28 01:34:25 +04:00
return $result;
}
2013-05-20 03:24:36 +04:00
/**
* @brief fix the file size of the encrypted file
* @param $path absolute path
* @return true / false if file is encrypted
*/
2013-05-24 01:56:31 +04:00
public function fixFileSize( $path ) {
2013-04-28 01:34:25 +04:00
$result = false;
2013-04-28 01:34:25 +04:00
// Disable encryption proxy to prevent recursive calls
$proxyStatus = \OC_FileProxy::$enabled;
\OC_FileProxy::$enabled = false;
2013-04-28 01:34:25 +04:00
2013-05-24 01:56:31 +04:00
$realSize = $this->getFileSize( $path );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
if ( $realSize > 0 ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$cached = $this->view->getFileInfo( $path );
2013-05-11 02:23:30 +04:00
$cached['encrypted'] = true;
2013-04-28 01:34:25 +04:00
// set the size
$cached['unencrypted_size'] = $realSize;
// put file info
2013-05-24 01:56:31 +04:00
$this->view->putFileInfo( $path, $cached );
$result = true;
2013-05-20 03:24:36 +04:00
}
\OC_FileProxy::$enabled = $proxyStatus;
return $result;
}
/**
* @brief Format a path to be relative to the /user/files/ directory
* @note e.g. turns '/admin/files/test.txt' into 'test.txt'
*/
2013-05-24 01:56:31 +04:00
public function stripUserFilesPath( $path ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$trimmed = ltrim( $path, '/' );
$split = explode( '/', $trimmed );
$sliced = array_slice( $split, 2 );
$relPath = implode( '/', $sliced );
2013-05-20 03:24:36 +04:00
return $relPath;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
* @param $path
* @return bool
*/
2013-05-24 01:56:31 +04:00
public function isSharedPath( $path ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$trimmed = ltrim( $path, '/' );
$split = explode( '/', $trimmed );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
if ( $split[2] == "Shared" ) {
2013-05-20 03:24:36 +04:00
return true;
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
return false;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
* @brief Encrypt all files in a directory
* @param string $dirPath the directory whose files will be encrypted
2013-05-20 03:24:36 +04:00
* @param null $legacyPassphrase
* @param null $newPassphrase
* @return bool
* @note Encryption is recursive
*/
2013-05-24 01:56:31 +04:00
public function encryptAll( $dirPath, $legacyPassphrase = null, $newPassphrase = null ) {
2013-05-17 16:13:05 +04:00
2013-05-24 01:56:31 +04:00
if ( $found = $this->findEncFiles( $dirPath ) ) {
2013-05-17 16:13:05 +04:00
// Disable proxy to prevent file being encrypted twice
\OC_FileProxy::$enabled = false;
2013-05-17 16:13:05 +04:00
// Encrypt unencrypted files
2013-05-24 01:56:31 +04:00
foreach ( $found['plain'] as $plainFile ) {
2013-05-17 16:13:05 +04:00
2013-04-12 17:18:19 +04:00
//relative to data/<user>/file
$relPath = $plainFile['path'];
2013-05-17 16:13:05 +04:00
2013-04-12 17:18:19 +04:00
//relative to /data
$rawPath = '/'.$this->userId . '/files/' . $plainFile['path'];
2013-05-17 16:13:05 +04:00
// Open plain file handle for binary reading
$plainHandle = $this->view->fopen( $rawPath, 'rb' );
2013-05-17 16:13:05 +04:00
// Open enc file handle for binary writing, with same filename as original plain file
$encHandle = fopen( 'crypt://' . $relPath.'.tmp', 'wb' );
2013-05-17 16:13:05 +04:00
// Move plain file to a temporary location
$size = stream_copy_to_stream( $plainHandle, $encHandle );
2013-05-17 16:13:05 +04:00
fclose($encHandle);
2013-05-17 16:13:05 +04:00
$fakeRoot = $this->view->getRoot();
$this->view->chroot('/'.$this->userId.'/files');
2013-05-22 04:02:42 +04:00
$this->view->rename($relPath . '.tmp', $relPath);
2013-05-17 16:13:05 +04:00
$this->view->chroot($fakeRoot);
2013-05-17 16:13:05 +04:00
// Add the file to the cache
\OC\Files\Filesystem::putFileInfo( $relPath, array( 'encrypted' => true, 'size' => $size, 'unencrypted_size' => $size ) );
}
2013-05-17 16:13:05 +04:00
// Encrypt legacy encrypted files
2013-05-17 16:13:05 +04:00
if (
2013-05-24 01:56:31 +04:00
!empty( $legacyPassphrase )
&& !empty( $newPassphrase )
) {
2013-05-17 16:13:05 +04:00
2013-05-24 01:56:31 +04:00
foreach ( $found['legacy'] as $legacyFile ) {
2013-05-17 16:13:05 +04:00
// Fetch data from file
2013-05-24 01:56:31 +04:00
$legacyData = $this->view->file_get_contents( $legacyFile['path'] );
2013-05-17 16:13:05 +04:00
$sharingEnabled = \OCP\Share::isEnabled();
// if file exists try to get sharing users
2013-05-24 01:56:31 +04:00
if ( $this->view->file_exists( $legacyFile['path'] ) ) {
$uniqueUserIds = $this->getSharingUsersArray( $sharingEnabled, $legacyFile['path'], $this->userId );
2013-05-17 16:13:05 +04:00
} else {
$uniqueUserIds[] = $this->userId;
}
// Fetch public keys for all users who will share the file
2013-05-24 01:56:31 +04:00
$publicKeys = Keymanager::getPublicKeys( $this->view, $uniqueUserIds );
// Recrypt data, generate catfile
2013-05-24 01:56:31 +04:00
$recrypted = Crypt::legacyKeyRecryptKeyfile( $legacyData, $legacyPassphrase, $publicKeys, $newPassphrase, $legacyFile['path'] );
2013-05-17 16:13:05 +04:00
$rawPath = $legacyFile['path'];
2013-05-24 01:56:31 +04:00
$relPath = $this->stripUserFilesPath( $rawPath );
2013-05-17 16:13:05 +04:00
// Save keyfile
2013-05-24 01:56:31 +04:00
Keymanager::setFileKey( $this->view, $relPath, $this->userId, $recrypted['filekey'] );
// Save sharekeys to user folders
2013-05-24 01:56:31 +04:00
Keymanager::setShareKeys( $this->view, $relPath, $recrypted['sharekeys'] );
// Overwrite the existing file with the encrypted one
2013-05-24 01:56:31 +04:00
$this->view->file_put_contents( $rawPath, $recrypted['data'] );
2013-05-17 16:13:05 +04:00
2013-05-24 01:56:31 +04:00
$size = strlen( $recrypted['data'] );
2013-05-17 16:13:05 +04:00
// Add the file to the cache
2013-05-24 01:56:31 +04:00
\OC\Files\Filesystem::putFileInfo( $rawPath, array( 'encrypted' => true, 'size' => $size ), '' );
}
}
2013-05-17 16:13:05 +04:00
\OC_FileProxy::$enabled = true;
2013-05-17 16:13:05 +04:00
// If files were found, return true
return true;
} else {
2013-05-17 16:13:05 +04:00
// If no files were found, return false
return false;
}
}
2013-05-17 16:13:05 +04:00
/**
* @brief Return important encryption related paths
* @param string $pathName Name of the directory to return the path of
* @return string path
*/
2013-05-24 01:56:31 +04:00
public function getPath( $pathName ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
switch ( $pathName ) {
2013-05-20 03:24:36 +04:00
case 'publicKeyDir':
2013-05-20 03:24:36 +04:00
return $this->publicKeyDir;
2013-05-20 03:24:36 +04:00
break;
2013-05-20 03:24:36 +04:00
case 'encryptionDir':
2013-05-20 03:24:36 +04:00
return $this->encryptionDir;
2013-05-20 03:24:36 +04:00
break;
2013-05-20 03:24:36 +04:00
case 'keyfilesPath':
2013-05-20 03:24:36 +04:00
return $this->keyfilesPath;
2013-05-20 03:24:36 +04:00
break;
2013-05-20 03:24:36 +04:00
case 'publicKeyPath':
2013-05-20 03:24:36 +04:00
return $this->publicKeyPath;
2013-05-20 03:24:36 +04:00
break;
2013-05-20 03:24:36 +04:00
case 'privateKeyPath':
2013-05-20 03:24:36 +04:00
return $this->privateKeyPath;
2013-05-20 03:24:36 +04:00
break;
}
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
return false;
}
2013-05-20 03:24:36 +04:00
/**
* @brief get path of a file.
2013-05-20 03:24:36 +04:00
* @param int $fileId id of the file
* @return string path of the file
*/
2013-05-24 01:56:31 +04:00
public static function fileIdToPath( $fileId ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$query = \OC_DB::prepare( 'SELECT `path`'
2013-05-20 03:24:36 +04:00
. ' FROM `*PREFIX*filecache`'
2013-05-24 01:56:31 +04:00
. ' WHERE `fileid` = ?' );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$result = $query->execute( array( $fileId ) );
2013-05-20 03:24:36 +04:00
$row = $result->fetchRow();
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
return substr( $row['path'], 5 );
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
* @brief Filter an array of UIDs to return only ones ready for sharing
* @param array $unfilteredUsers users to be checked for sharing readiness
* @return multi-dimensional array. keys: ready, unready
*/
2013-05-24 01:56:31 +04:00
public function filterShareReadyUsers( $unfilteredUsers ) {
2013-05-20 03:24:36 +04:00
// This array will collect the filtered IDs
$readyIds = $unreadyIds = array();
2013-05-20 03:24:36 +04:00
// Loop through users and create array of UIDs that need new keyfiles
2013-05-24 01:56:31 +04:00
foreach ( $unfilteredUsers as $user ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$util = new Util( $this->view, $user );
2013-05-20 03:24:36 +04:00
// Check that the user is encryption capable, or is the
// public system user 'ownCloud' (for public shares)
2013-05-20 03:24:36 +04:00
if (
$user == $this->publicShareKeyId
or $user == $this->recoveryKeyId
2013-05-20 03:24:36 +04:00
or $util->ready()
) {
2013-05-20 03:24:36 +04:00
// Construct array of ready UIDs for Keymanager{}
$readyIds[] = $user;
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
// Construct array of unready UIDs for Keymanager{}
$unreadyIds[] = $user;
2013-05-20 03:24:36 +04:00
// Log warning; we can't do necessary setup here
// because we don't have the user passphrase
2013-05-24 01:56:31 +04:00
\OC_Log::write( 'Encryption library', '"' . $user . '" is not setup for encryption', \OC_Log::WARN );
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
return array(
2013-05-24 01:56:31 +04:00
'ready' => $readyIds,
'unready' => $unreadyIds
);
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
* @brief Decrypt a keyfile without knowing how it was encrypted
* @param string $filePath
* @param string $fileOwner
* @param string $privateKey
2013-05-20 03:24:36 +04:00
* @note Checks whether file was encrypted with openssl_seal or
* openssl_encrypt, and decrypts accrdingly
2013-05-20 03:24:36 +04:00
* @note This was used when 2 types of encryption for keyfiles was used,
* but now we've switched to exclusively using openssl_seal()
*/
2013-05-24 01:56:31 +04:00
public function decryptUnknownKeyfile( $filePath, $fileOwner, $privateKey ) {
// Get the encrypted keyfile
// NOTE: the keyfile format depends on how it was encrypted! At
// this stage we don't know how it was encrypted
2013-05-24 01:56:31 +04:00
$encKeyfile = Keymanager::getFileKey( $this->view, $this->userId, $filePath );
2013-05-20 03:24:36 +04:00
// We need to decrypt the keyfile
// Has the file been shared yet?
2013-05-20 03:24:36 +04:00
if (
$this->userId == $fileOwner
2013-05-24 01:56:31 +04:00
&& !Keymanager::getShareKey( $this->view, $this->userId, $filePath ) // NOTE: we can't use isShared() here because it's a post share hook so it always returns true
) {
2013-05-20 03:24:36 +04:00
// The file has no shareKey, and its keyfile must be
// decrypted conventionally
2013-05-24 01:56:31 +04:00
$plainKeyfile = Crypt::keyDecrypt( $encKeyfile, $privateKey );
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
// The file has a shareKey and must use it for decryption
2013-05-24 01:56:31 +04:00
$shareKey = Keymanager::getShareKey( $this->view, $this->userId, $filePath );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$plainKeyfile = Crypt::multiKeyDecrypt( $encKeyfile, $shareKey, $privateKey );
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
return $plainKeyfile;
}
2013-05-20 03:24:36 +04:00
/**
* @brief Encrypt keyfile to multiple users
2013-05-20 03:24:36 +04:00
* @param Session $session
* @param array $users list of users which should be able to access the file
* @param string $filePath path of the file to be shared
2013-05-20 03:24:36 +04:00
* @return bool
*/
2013-05-24 01:56:31 +04:00
public function setSharedFileKeyfiles( Session $session, array $users, $filePath ) {
2013-05-20 03:24:36 +04:00
// Make sure users are capable of sharing
2013-05-24 01:56:31 +04:00
$filteredUids = $this->filterShareReadyUsers( $users );
2013-05-20 03:24:36 +04:00
// If we're attempting to share to unready users
2013-05-24 01:56:31 +04:00
if ( !empty( $filteredUids['unready'] ) ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
\OC_Log::write( 'Encryption library', 'Sharing to these user(s) failed as they are unready for encryption:"' . print_r( $filteredUids['unready'], 1 ), \OC_Log::WARN );
2013-05-20 03:24:36 +04:00
return false;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
// Get public keys for each user, ready for generating sharekeys
2013-05-24 01:56:31 +04:00
$userPubKeys = Keymanager::getPublicKeys( $this->view, $filteredUids['ready'] );
2013-05-20 03:24:36 +04:00
// Note proxy status then disable it
$proxyStatus = \OC_FileProxy::$enabled;
\OC_FileProxy::$enabled = false;
// Get the current users's private key for decrypting existing keyfile
$privateKey = $session->getPrivateKey();
2013-05-24 01:56:31 +04:00
$fileOwner = \OC\Files\Filesystem::getOwner( $filePath );
2013-05-20 03:24:36 +04:00
// Decrypt keyfile
2013-05-24 01:56:31 +04:00
$plainKeyfile = $this->decryptUnknownKeyfile( $filePath, $fileOwner, $privateKey );
2013-05-20 03:24:36 +04:00
// Re-enc keyfile to (additional) sharekeys
2013-05-24 01:56:31 +04:00
$multiEncKey = Crypt::multiKeyEncrypt( $plainKeyfile, $userPubKeys );
2013-05-20 03:24:36 +04:00
// Save the recrypted key to it's owner's keyfiles directory
// Save new sharekeys to all necessary user directory
2013-05-20 03:24:36 +04:00
if (
2013-05-24 01:56:31 +04:00
!Keymanager::setFileKey( $this->view, $filePath, $fileOwner, $multiEncKey['data'] )
|| !Keymanager::setShareKeys( $this->view, $filePath, $multiEncKey['keys'] )
) {
2013-05-24 01:56:31 +04:00
\OC_Log::write( 'Encryption library', 'Keyfiles could not be saved for users sharing ' . $filePath, \OC_Log::ERROR );
2013-05-20 03:24:36 +04:00
return false;
}
2013-05-20 03:24:36 +04:00
// Return proxy to original status
\OC_FileProxy::$enabled = $proxyStatus;
return true;
}
2013-05-20 03:24:36 +04:00
/**
* @brief Find, sanitise and format users sharing a file
* @note This wraps other methods into a portable bundle
*/
2013-05-24 01:56:31 +04:00
public function getSharingUsersArray( $sharingEnabled, $filePath, $currentUserId = false ) {
// Check if key recovery is enabled
if (
2013-05-24 01:56:31 +04:00
\OC_Appconfig::getValue( 'files_encryption', 'recoveryAdminEnabled' )
&& $this->recoveryEnabledForUser()
) {
2013-05-20 03:24:36 +04:00
$recoveryEnabled = true;
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
$recoveryEnabled = false;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
// Make sure that a share key is generated for the owner too
2013-05-24 01:56:31 +04:00
list( $owner, $ownerPath ) = $this->getUidAndFilename( $filePath );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$userIds = array();
if ( $sharingEnabled ) {
// Find out who, if anyone, is sharing the file
2013-05-24 01:56:31 +04:00
$result = \OCP\Share::getUsersSharingFile( $ownerPath, $owner, true, true, true );
$userIds = $result['users'];
2013-05-24 01:56:31 +04:00
if ( $result['public'] ) {
$userIds[] = $this->publicShareKeyId;
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
// If recovery is enabled, add the
// Admin UID to list of users to share to
2013-05-24 01:56:31 +04:00
if ( $recoveryEnabled ) {
2013-05-20 03:24:36 +04:00
// Find recoveryAdmin user ID
2013-05-24 01:56:31 +04:00
$recoveryKeyId = \OC_Appconfig::getValue( 'files_encryption', 'recoveryKeyId' );
2013-05-20 03:24:36 +04:00
// Add recoveryAdmin to list of users sharing
$userIds[] = $recoveryKeyId;
2013-05-20 03:24:36 +04:00
}
// add current user if given
2013-05-24 01:56:31 +04:00
if ( $currentUserId != false ) {
2013-05-20 03:24:36 +04:00
$userIds[] = $currentUserId;
2013-05-20 03:24:36 +04:00
}
// Remove duplicate UIDs
2013-05-24 01:56:31 +04:00
$uniqueUserIds = array_unique( $userIds );
2013-05-20 03:24:36 +04:00
return $uniqueUserIds;
}
2013-05-20 03:24:36 +04:00
/**
* @brief Set file migration status for user
2013-05-20 03:24:36 +04:00
* @param $status
* @return bool
*/
2013-05-24 01:56:31 +04:00
public function setMigrationStatus( $status ) {
2013-05-20 03:24:36 +04:00
$sql = 'UPDATE
*PREFIX*encryption
SET
migration_status = ?
WHERE
uid = ?';
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$args = array( $status, $this->userId );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$query = \OCP\DB::prepare( $sql );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
if ( $query->execute( $args ) ) {
2013-05-20 03:24:36 +04:00
return true;
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
return false;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
* @brief Check whether pwd recovery is enabled for a given user
2013-05-20 03:24:36 +04:00
* @return bool 1 = yes, 0 = no, false = no record
* @note If records are not being returned, check for a hidden space
* at the start of the uid in db
*/
2013-05-24 01:56:31 +04:00
public function getMigrationStatus() {
2013-05-20 03:24:36 +04:00
$sql = 'SELECT
migration_status
FROM
`*PREFIX*encryption`
WHERE
uid = ?';
2013-05-24 01:56:31 +04:00
$args = array( $this->userId );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$query = \OCP\DB::prepare( $sql );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$result = $query->execute( $args );
2013-05-20 03:24:36 +04:00
$migrationStatus = array();
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$row = $result->fetchRow();
if($row) {
$migrationStatus[] = $row['migration_status'];
}
2013-05-20 03:24:36 +04:00
// If no record is found
2013-05-24 01:56:31 +04:00
if ( empty( $migrationStatus ) ) {
2013-05-20 03:24:36 +04:00
return false;
2013-05-20 03:24:36 +04:00
// If a record is found
} else {
2013-05-20 03:24:36 +04:00
return $migrationStatus[0];
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
2013-03-26 15:39:55 +04:00
* @brief get uid of the owners of the file and the path to the file
2013-05-20 03:24:36 +04:00
* @param string $path Path of the file to check
* @note $shareFilePath must be relative to data/UID/files. Files
* relative to /Shared are also acceptable
2013-03-26 15:39:55 +04:00
* @return array
*/
2013-05-24 01:56:31 +04:00
public function getUidAndFilename( $path ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$view = new \OC\Files\View( $this->userFilesDir );
$fileOwnerUid = $view->getOwner( $path );
2013-05-20 03:24:36 +04:00
// handle public access
2013-05-24 01:56:31 +04:00
if ( $this->isPublic ) {
2013-05-20 03:24:36 +04:00
$filename = $path;
$fileOwnerUid = $GLOBALS['fileOwner'];
2013-05-24 01:56:31 +04:00
return array( $fileOwnerUid, $filename );
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
// Check that UID is valid
2013-05-24 01:56:31 +04:00
if ( !\OCP\User::userExists( $fileOwnerUid ) ) {
throw new \Exception( 'Could not find owner (UID = "' . var_export( $fileOwnerUid, 1 ) . '") of file "' . $path . '"' );
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
// NOTE: Bah, this dependency should be elsewhere
2013-05-24 01:56:31 +04:00
\OC\Files\Filesystem::initMountPoints( $fileOwnerUid );
2013-05-20 03:24:36 +04:00
// If the file owner is the currently logged in user
2013-05-24 01:56:31 +04:00
if ( $fileOwnerUid == $this->userId ) {
2013-05-20 03:24:36 +04:00
// Assume the path supplied is correct
$filename = $path;
2013-05-20 03:24:36 +04:00
} else {
2013-05-24 01:56:31 +04:00
$info = $view->getFileInfo( $path );
$ownerView = new \OC\Files\View( '/' . $fileOwnerUid . '/files' );
2013-05-20 03:24:36 +04:00
// Fetch real file path from DB
2013-05-24 01:56:31 +04:00
$filename = $ownerView->getPath( $info['fileid'] ); // TODO: Check that this returns a path without including the user data dir
2013-05-20 03:24:36 +04:00
}
2013-05-24 01:56:31 +04:00
return array( $fileOwnerUid, $filename );
2013-05-20 03:24:36 +04:00
}
2013-03-26 15:39:55 +04:00
}
/**
2013-05-24 01:56:31 +04:00
* @brief go recursively through a dir and collect all files and sub files.
2013-05-20 03:24:36 +04:00
* @param string $dir relative to the users files folder
* @return array with list of files relative to the users files folder
*/
2013-05-24 01:56:31 +04:00
public function getAllFiles( $dir ) {
2013-05-20 03:24:36 +04:00
$result = array();
2013-05-01 13:04:40 +04:00
2013-05-24 01:56:31 +04:00
$content = $this->view->getDirectoryContent( $this->userFilesDir . $dir );
2013-05-01 13:04:40 +04:00
// handling for re shared folders
2013-05-24 01:56:31 +04:00
$path_split = explode( '/', $dir );
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
foreach ( $content as $c ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$sharedPart = $path_split[sizeof( $path_split ) - 1];
$targetPathSplit = array_reverse( explode( '/', $c['path'] ) );
$path = '';
// rebuild path
2013-05-24 01:56:31 +04:00
foreach ( $targetPathSplit as $pathPart ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
if ( $pathPart !== $sharedPart ) {
2013-05-20 03:24:36 +04:00
$path = '/' . $pathPart . $path;
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
break;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
$path = $dir . $path;
2013-05-24 01:56:31 +04:00
if ( $c['type'] === "dir" ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$result = array_merge( $result, $this->getAllFiles( $path ) );
} else {
2013-05-20 03:24:36 +04:00
$result[] = $path;
2013-05-20 03:24:36 +04:00
}
}
2013-05-20 03:24:36 +04:00
return $result;
2013-05-20 03:24:36 +04:00
}
/**
* @brief get shares parent.
* @param int $id of the current share
* @return array of the parent
*/
2013-05-24 01:56:31 +04:00
public static function getShareParent( $id ) {
2013-05-04 05:37:22 +04:00
2013-05-24 01:56:31 +04:00
$query = \OC_DB::prepare( 'SELECT `file_target`, `item_type`'
2013-05-20 03:24:36 +04:00
. ' FROM `*PREFIX*share`'
2013-05-24 01:56:31 +04:00
. ' WHERE `id` = ?' );
2013-05-04 05:37:22 +04:00
2013-05-24 01:56:31 +04:00
$result = $query->execute( array( $id ) );
2013-05-04 05:37:22 +04:00
$row = $result->fetchRow();
2013-05-04 05:37:22 +04:00
return $row;
2013-05-04 05:37:22 +04:00
}
/**
* @brief get shares parent.
* @param int $id of the current share
* @return array of the parent
*/
2013-05-24 01:56:31 +04:00
public static function getParentFromShare( $id ) {
2013-05-24 01:56:31 +04:00
$query = \OC_DB::prepare( 'SELECT `parent`'
2013-05-20 03:24:36 +04:00
. ' FROM `*PREFIX*share`'
2013-05-24 01:56:31 +04:00
. ' WHERE `id` = ?' );
2013-05-24 01:56:31 +04:00
$result = $query->execute( array( $id ) );
$row = $result->fetchRow();
return $row;
}
/**
* @brief get owner of the shared files.
2013-05-20 03:24:36 +04:00
* @param $id
* @internal param int $Id of a share
* @return string owner
*/
2013-05-24 01:56:31 +04:00
public function getOwnerFromSharedFile( $id ) {
$query = \OC_DB::prepare( 'SELECT `parent`, `uid_owner` FROM `*PREFIX*share` WHERE `id` = ?', 1 );
$source = $query->execute( array( $id ) )->fetchRow();
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$fileOwner = false;
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
if ( isset( $source['parent'] ) ) {
$parent = $source['parent'];
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
while ( isset( $parent ) ) {
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
$query = \OC_DB::prepare( 'SELECT `parent`, `uid_owner` FROM `*PREFIX*share` WHERE `id` = ?', 1 );
$item = $query->execute( array( $parent ) )->fetchRow();
2013-05-20 03:24:36 +04:00
2013-05-24 01:56:31 +04:00
if ( isset( $item['parent'] ) ) {
2013-05-20 03:24:36 +04:00
$parent = $item['parent'];
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
$fileOwner = $item['uid_owner'];
2013-05-20 03:24:36 +04:00
break;
2013-05-20 03:24:36 +04:00
}
}
2013-05-20 03:24:36 +04:00
} else {
2013-05-20 03:24:36 +04:00
$fileOwner = $source['uid_owner'];
2013-05-20 03:24:36 +04:00
}
return $fileOwner;
2013-05-20 03:24:36 +04:00
}
2013-05-20 03:24:36 +04:00
/**
* @return string
*/
2013-05-24 01:56:31 +04:00
public function getUserId() {
2013-05-20 03:24:36 +04:00
return $this->userId;
}
2013-05-20 03:24:36 +04:00
/**
* @return string
*/
2013-05-24 01:56:31 +04:00
public function getUserFilesDir() {
2013-05-20 03:24:36 +04:00
return $this->userFilesDir;
}
2013-05-20 03:24:36 +04:00
/**
* @param $password
* @return bool
*/
2013-05-24 01:56:31 +04:00
public function checkRecoveryPassword( $password ) {
$pathKey = '/owncloud_private_key/' . $this->recoveryKeyId . ".private.key";
$pathControlData = '/control-file/controlfile.enc';
$proxyStatus = \OC_FileProxy::$enabled;
\OC_FileProxy::$enabled = false;
2013-05-24 01:56:31 +04:00
$recoveryKey = $this->view->file_get_contents( $pathKey );
2013-05-24 01:56:31 +04:00
$decryptedRecoveryKey = Crypt::symmetricDecryptFileContent( $recoveryKey, $password );
2013-05-24 01:56:31 +04:00
$controlData = $this->view->file_get_contents( $pathControlData );
$decryptedControlData = Crypt::keyDecrypt( $controlData, $decryptedRecoveryKey );
\OC_FileProxy::$enabled = $proxyStatus;
2013-05-24 01:56:31 +04:00
if ( $decryptedControlData === 'ownCloud' ) {
return true;
2013-05-20 03:24:36 +04:00
}
return false;
}
2013-05-20 03:24:36 +04:00
/**
* @return string
*/
2013-05-24 01:56:31 +04:00
public function getRecoveryKeyId() {
return $this->recoveryKeyId;
}
/**
* @brief add recovery key to all encrypted files
*/
2013-05-24 01:56:31 +04:00
public function addRecoveryKeys( $path = '/' ) {
$dirContent = $this->view->getDirectoryContent( $this->keyfilesPath . $path );
foreach ( $dirContent as $item ) {
// get relative path from files_encryption/keyfiles/
$filePath = substr( $item['path'], strlen('files_encryption/keyfiles') );
if ( $item['type'] == 'dir' ) {
$this->addRecoveryKeys( $filePath . '/' );
} else {
2013-05-24 01:56:31 +04:00
$session = new Session( new \OC_FilesystemView( '/' ) );
$sharingEnabled = \OCP\Share::isEnabled();
2013-05-24 01:56:31 +04:00
$file = substr( $filePath, 0, -4 );
$usersSharing = $this->getSharingUsersArray( $sharingEnabled, $file );
$this->setSharedFileKeyfiles( $session, $usersSharing, $file );
}
}
}
/**
* @brief remove recovery key to all encrypted files
*/
2013-05-24 01:56:31 +04:00
public function removeRecoveryKeys( $path = '/' ) {
$dirContent = $this->view->getDirectoryContent( $this->keyfilesPath . $path );
foreach ( $dirContent as $item ) {
// get relative path from files_encryption/keyfiles
$filePath = substr( $item['path'], strlen('files_encryption/keyfiles') );
if ( $item['type'] == 'dir' ) {
$this->removeRecoveryKeys( $filePath . '/' );
} else {
2013-05-24 01:56:31 +04:00
$file = substr( $filePath, 0, -4 );
$this->view->unlink( $this->shareKeysPath . '/' . $file . '.' . $this->recoveryKeyId . '.shareKey' );
}
}
}
/**
* @brief decrypt given file with recovery key and encrypt it again to the owner and his new key
2013-05-20 03:24:36 +04:00
* @param string $file
* @param string $privateKey recovery key to decrypt the file
*/
2013-05-24 01:56:31 +04:00
private function recoverFile( $file, $privateKey ) {
$sharingEnabled = \OCP\Share::isEnabled();
// Find out who, if anyone, is sharing the file
2013-05-24 01:56:31 +04:00
if ( $sharingEnabled ) {
$result = \OCP\Share::getUsersSharingFile( $file, $this->userId, true, true, true );
$userIds = $result['users'];
$userIds[] = $this->recoveryKeyId;
2013-05-24 01:56:31 +04:00
if ( $result['public'] ) {
$userIds[] = $this->publicShareKeyId;
}
} else {
2013-05-24 01:56:31 +04:00
$userIds = array( $this->userId, $this->recoveryKeyId );
}
2013-05-24 01:56:31 +04:00
$filteredUids = $this->filterShareReadyUsers( $userIds );
$proxyStatus = \OC_FileProxy::$enabled;
\OC_FileProxy::$enabled = false;
//decrypt file key
2013-05-24 01:56:31 +04:00
$encKeyfile = $this->view->file_get_contents( $this->keyfilesPath . $file . ".key" );
$shareKey = $this->view->file_get_contents( $this->shareKeysPath . $file . "." . $this->recoveryKeyId . ".shareKey" );
$plainKeyfile = Crypt::multiKeyDecrypt( $encKeyfile, $shareKey, $privateKey );
// encrypt file key again to all users, this time with the new public key for the recovered use
2013-05-24 01:56:31 +04:00
$userPubKeys = Keymanager::getPublicKeys( $this->view, $filteredUids['ready'] );
$multiEncKey = Crypt::multiKeyEncrypt( $plainKeyfile, $userPubKeys );
// write new keys to filesystem TDOO!
2013-05-24 01:56:31 +04:00
$this->view->file_put_contents( $this->keyfilesPath . $file . '.key', $multiEncKey['data'] );
foreach ( $multiEncKey['keys'] as $userId => $shareKey ) {
2013-05-20 03:24:36 +04:00
$shareKeyPath = $this->shareKeysPath . $file . '.' . $userId . '.shareKey';
2013-05-24 01:56:31 +04:00
$this->view->file_put_contents( $shareKeyPath, $shareKey );
}
// Return proxy to original status
\OC_FileProxy::$enabled = $proxyStatus;
}
/**
* @brief collect all files and recover them one by one
2013-05-20 03:24:36 +04:00
* @param string $path to look for files keys
* @param string $privateKey private recovery key which is used to decrypt the files
*/
2013-05-24 01:56:31 +04:00
private function recoverAllFiles( $path, $privateKey ) {
$dirContent = $this->view->getDirectoryContent( $this->keyfilesPath . $path );
foreach ( $dirContent as $item ) {
$filePath = substr( $item['path'], 25 );
if ( $item['type'] == 'dir' ) {
$this->recoverAllFiles( $filePath . '/', $privateKey );
} else {
2013-05-24 01:56:31 +04:00
$file = substr( $filePath, 0, -4 );
$this->recoverFile( $file, $privateKey );
}
}
}
/**
* @brief recover users files in case of password lost
2013-05-20 03:24:36 +04:00
* @param string $recoveryPassword
*/
2013-05-24 01:56:31 +04:00
public function recoverUsersFiles( $recoveryPassword ) {
// Disable encryption proxy to prevent recursive calls
$proxyStatus = \OC_FileProxy::$enabled;
\OC_FileProxy::$enabled = false;
2013-05-24 01:56:31 +04:00
$encryptedKey = $this->view->file_get_contents( '/owncloud_private_key/' . $this->recoveryKeyId . '.private.key' );
$privateKey = Crypt::symmetricDecryptFileContent( $encryptedKey, $recoveryPassword );
\OC_FileProxy::$enabled = $proxyStatus;
2013-05-24 01:56:31 +04:00
$this->recoverAllFiles( '/', $privateKey );
}
}