upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 25

fix(encryption): Refactor EncryptionWrapper with HomeMountPoint support

Browse source 
Rewrite conditional flow to use early-return guards: skip IDisableEncryptionStorage,
skip the root mount, respect encryptHomeStorage for HomeMountPoints. Uses IAppConfig
for the encryptHomeStorage setting with a legacy string fallback for the upgrade window.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Stephen Cuppett <steve@cuppett.com>
This commit is contained in:
Stephen Cuppett 2026-04-29 11:58:31 -04:00
parent f188efd918
commit b523ddb4e7
1 changed files with 62 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

86
lib/private/Encryption/EncryptionWrapper.php
View file

@ -8,14 +8,17 @@
namespace OC\Encryption;
use OC\Files\Filesystem;
use OC\Files\Mount\HomeMountPoint;
use OC\Files\Storage\Wrapper\Encryption;
use OC\Files\View;
use OC\Memcache\ArrayCache;
use OCP\Encryption\IFile;
use OCP\Encryption\Keys\IStorage as EncryptionKeysStorage;
use OCP\Exceptions\AppConfigTypeConflictException;
use OCP\Files\Mount\IMountPoint;
use OCP\Files\Storage\IDisableEncryptionStorage;
use OCP\Files\Storage\IStorage;
use OCP\IAppConfig;
use OCP\IConfig;
use OCP\IGroupManager;
use OCP\IUserManager;
@ -57,32 +60,67 @@ class EncryptionWrapper {
'mount' => $mount
];
if ($force || (!$storage->instanceOfStorage(IDisableEncryptionStorage::class) && $mountPoint !== '/')) {
$user = Server::get(IUserSession::class)->getUser();
$mountManager = Filesystem::getMountManager();
$uid = $user ? $user->getUID() : null;
$fileHelper = Server::get(IFile::class);
$keyStorage = Server::get(EncryptionKeysStorage::class);
// Only evaluate other conditions if not forced
if (!$force) {
// If a disabled storage medium, return basic storage
if ($storage->instanceOfStorage(IDisableEncryptionStorage::class)) {
return $storage;
}
$util = new Util(
new View(),
Server::get(IUserManager::class),
Server::get(IGroupManager::class),
Server::get(IConfig::class)
// Root mount point handling: skip encryption wrapper
if ($mountPoint === '/') {
return $storage;
}
// Skip encryption for home mounts if encryptHomeStorage is disabled
if ($mount instanceof HomeMountPoint && !$this->shouldEncryptHomeStorage()) {
return $storage;
}
}
// Apply encryption wrapper
$user = Server::get(IUserSession::class)->getUser();
$mountManager = Filesystem::getMountManager();
$uid = $user ? $user->getUID() : null;
$fileHelper = Server::get(IFile::class);
$keyStorage = Server::get(EncryptionKeysStorage::class);
$util = new Util(
new View(),
Server::get(IUserManager::class),
Server::get(IGroupManager::class),
Server::get(IConfig::class)
);
return new Encryption(
$parameters,
$this->manager,
$util,
$this->logger,
$fileHelper,
$uid,
$keyStorage,
$mountManager,
$this->arrayCache
);
}
private function shouldEncryptHomeStorage(): bool {
$appConfig = Server::get(IAppConfig::class);
try {
return $appConfig->getValueBool('encryption', 'encryptHomeStorage', true);
} catch (AppConfigTypeConflictException) {
// Stored as VALUE_STRING from a pre-upgrade installation.
// RetypeEncryptionConfigKeys repair step will fix the type on occ upgrade.
return $this->parseLegacyBoolString(
$appConfig->getValueString('encryption', 'encryptHomeStorage', '1')
);
return new Encryption(
$parameters,
$this->manager,
$util,
$this->logger,
$fileHelper,
$uid,
$keyStorage,
$mountManager,
$this->arrayCache
);
} else {
return $storage;
} catch (\Throwable) {
// DB not ready (e.g. oc_appconfig does not yet exist during install).
return true;
}
}
private function parseLegacyBoolString(string $value): bool {
return in_array(strtolower(trim($value)), ['1', 'true', 'yes', 'on'], true);
}
}