From 36cfdd320bd766798930dc09acea74b27f58d95c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julius=20H=C3=A4rtl?= Date: Wed, 22 Jul 2020 10:05:51 +0200 Subject: Harden key generation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There might be cases where multiple requests trigger the key generation at the same time and the instance ends up with a non-fitting public/private key pair. Therefore the whole key generation should be locked. Other than that this makes sure that user key generation return values are properly validated. Signed-off-by: Julius Härtl --- apps/settings/lib/Controller/ChangePasswordController.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'apps/settings/lib/Controller/ChangePasswordController.php') diff --git a/apps/settings/lib/Controller/ChangePasswordController.php b/apps/settings/lib/Controller/ChangePasswordController.php index 3006e89318f..668b0e49e66 100644 --- a/apps/settings/lib/Controller/ChangePasswordController.php +++ b/apps/settings/lib/Controller/ChangePasswordController.php @@ -188,7 +188,9 @@ class ChangePasswordController extends Controller { \OC::$server->getUserSession(), new \OCA\Encryption\Session(\OC::$server->getSession()), \OC::$server->getLogger(), - $util); + $util, + \OC::$server->getLockingProvider() + ); $recovery = new \OCA\Encryption\Recovery( \OC::$server->getUserSession(), $crypt, -- cgit v1.2.3