Skip to content

changing vault password fails if contains credentials with files #761

@harrhp

Description

@harrhp

Bug report

Steps to reproduce

  1. create vault
  2. add credential with file
  3. change vault password

Expected behaviour

vault password changed without errors

Actual behaviour

saving reencrypted file fails which leads to data corruption

Configuration

Operating system: Windows 10 Version 22H2 (Build 19045.2546)

Browser: Vivaldi 5.6.2867.62 (Stable channel) (64-bit)

Extensions that might cause interference: None

Passman version: 2.4.3

Operating system: Debian GNU/Linux 11 (bullseye)

Web server: Apache/2.4.54 (Debian)

Database: PostgreSQL 15.1

PHP version: PHP 8.1.14

cloud server: Nextcloud

cloud version: 25.0.3

docker image: nextcloud:25.0.3

Browser log

Browser log
General
Request URL: https://example.com/apps/passman/api/v2/file/87
Request Method: PATCH
Status Code: 403 
Remote Address: *:443
Referrer Policy: no-referrer

Response Content
{"message":"Logged in user must be an admin"}

Response Headers
access-control-allow-origin: https://example.com
cache-control: no-cache, no-store, must-revalidate
content-length: 45
content-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
content-type: application/json; charset=utf-8
date: Sun, 05 Feb 2023 07:39:17 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
feature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
pragma: no-cache
referrer-policy: no-referrer
server: nginx/1.23.2
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-powered-by: PHP/8.1.14
x-request-id: 4ADykDflXRYfzBeVYXHu
x-robots-tag: none
x-xss-protection: 1; mode=block

Request Headers
:authority: example.com
:method: PATCH
:path: /apps/passman/api/v2/file/87
:scheme: https
accept: application/json, text/plain, */*
accept-encoding: gzip, deflate, br
accept-language: ru-RU,ru;q=0.9
content-length: 595
content-type: application/json;charset=UTF-8
cookie: oc_sessionPassphrase=*; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; oc6zn2env6bl=*; nc_username=*; nc_token=*; nc_session_id=*
dnt: 1
origin: https://example.com
requesttoken: *
sec-ch-ua: "Chromium";v="108", "Not?A_Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: same-origin
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36

Cloud log

Cloud log
No log

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions