From f82fe763af9b3a766dd0635253be43fab9eea738 Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Thu, 11 Jul 2024 14:44:48 +0200 Subject: [PATCH 1/7] =?UTF-8?q?Send=20Pad=E2=80=99s=20plain=20password=20w?= =?UTF-8?q?hen=20sharing=20ownership?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - The password is sent via `Mailbox` and then is still oblivious to the server - Otherwise a bogus file is created (#1522) - Also fix the file stored and fix #1521 --- www/common/outer/mailbox-handlers.js | 1 + www/common/sframe-common-outer.js | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/www/common/outer/mailbox-handlers.js b/www/common/outer/mailbox-handlers.js index cfa749084..a2b2ed08a 100644 --- a/www/common/outer/mailbox-handlers.js +++ b/www/common/outer/mailbox-handlers.js @@ -384,6 +384,7 @@ define([ var channel = content.channel || content.teamChannel; if (content.password) { + content.pw = content.password; var key = ctx.store.driveSecret.keys.cryptKey; content.password = Crypto.encrypt(content.password, key); } diff --git a/www/common/sframe-common-outer.js b/www/common/sframe-common-outer.js index 6c46ced04..508937e41 100644 --- a/www/common/sframe-common-outer.js +++ b/www/common/sframe-common-outer.js @@ -1083,7 +1083,7 @@ define([ Cryptpad.addSharedFolder(null, secret, cb); } else { var _data = { - password: data.password, + password: data.pw || data.password, href: data.href, channel: data.channel, title: data.title, From da63f7d51ed95f5daf985ceeca7b279813e39d27 Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Thu, 11 Jul 2024 14:50:19 +0200 Subject: [PATCH 2/7] Minor: fix a typo in comment --- www/common/common-ui-elements.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/common/common-ui-elements.js b/www/common/common-ui-elements.js index 5405bf319..f56584e19 100644 --- a/www/common/common-ui-elements.js +++ b/www/common/common-ui-elements.js @@ -3615,7 +3615,7 @@ define([ // Add the pad to your drive // This command will also add your mailbox to the metadata log - // The callback is called when the pad is stored, independantly of the metadata command + // The callback is called when the pad is stored, independently of the metadata command if (data.calendar) { var calendarModule = common.makeUniversal('calendar'); var calendarData = data.calendar; From 1ac0cd3e1d15ed511d98f274012fb8ffd51a29ed Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Fri, 12 Jul 2024 17:59:50 +0200 Subject: [PATCH 3/7] Use the correct password when sharing a pad to a contact - Fix #1270; - Force reload option added. --- www/common/cryptpad-common.js | 3 ++- www/common/notifications.js | 1 + www/common/outer/mailbox-handlers.js | 7 +++++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/www/common/cryptpad-common.js b/www/common/cryptpad-common.js index 4525c8287..e2d6a3746 100644 --- a/www/common/cryptpad-common.js +++ b/www/common/cryptpad-common.js @@ -2619,7 +2619,8 @@ define([ disableCache: localStorage['CRYPTPAD_STORE|disableCache'], driveEvents: !rdyCfg.noDrive, //rdyCfg.driveEvents // Boolean lastVisit: Number(localStorage.lastVisit) || undefined, - blockId: blockId + blockId: blockId, + blockHash: blockHash }; common.userHash = userHash || LocalStore.getUserHash(); diff --git a/www/common/notifications.js b/www/common/notifications.js index 82fb4b45d..8ec80c2e9 100644 --- a/www/common/notifications.js +++ b/www/common/notifications.js @@ -129,6 +129,7 @@ define([ var obj = { p: msg.content.isTemplate ? ['template'] : undefined, t: teamNotification || undefined, + f: 1, pw: msg.content.password || '' }; common.openURL(Hash.getNewPadURL(msg.content.href, obj)); diff --git a/www/common/outer/mailbox-handlers.js b/www/common/outer/mailbox-handlers.js index a2b2ed08a..06de11374 100644 --- a/www/common/outer/mailbox-handlers.js +++ b/www/common/outer/mailbox-handlers.js @@ -8,7 +8,8 @@ define([ '/common/common-hash.js', '/common/common-util.js', '/components/chainpad-crypto/crypto.js', -], function (ApiConfig, Messaging, Hash, Util, Crypto) { + '/common/outer/login-block.js', + ], function (ApiConfig, Messaging, Hash, Util, Crypto, Block) { // Random timeout between 10 and 30 times your sync time (lag + chainpad sync) var getRandomTimeout = function (ctx) { @@ -265,7 +266,9 @@ define([ } if (content.password) { - var key = ctx.store.driveSecret.keys.cryptKey; + var uHash = ctx.store.data.blockHash; + var uSecret = Block.parseBlockHash(uHash); + var key = uSecret.keys.symmetric; content.password = Crypto.encrypt(content.password, key); } From e1b2be39c0f48f4f9e0234880295ee27ac19758a Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Fri, 19 Jul 2024 11:50:37 +0200 Subject: [PATCH 4/7] Fix: old password sent upon updating a password for the first time - Finish to fix #1521 --- www/common/sframe-common-outer.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/common/sframe-common-outer.js b/www/common/sframe-common-outer.js index 508937e41..b4031d155 100644 --- a/www/common/sframe-common-outer.js +++ b/www/common/sframe-common-outer.js @@ -1359,7 +1359,7 @@ define([ var viewH = Utils.Hash.getViewHashFromKeys(_secret); var href = Utils.Hash.hashToHref(editH, parsed.type); var roHref = Utils.Hash.hashToHref(viewH, parsed.type); - Cryptpad.setPadAttribute('password', password, w(), parsed.getUrl()); + Cryptpad.setPadAttribute('password', pw, w(), parsed.getUrl()); Cryptpad.setPadAttribute('channel', chan, w(), parsed.getUrl()); Cryptpad.setPadAttribute('href', href, w(), parsed.getUrl()); Cryptpad.setPadAttribute('roHref', roHref, w(), parsed.getUrl()); From 727c9d7b8828bf81c1771fe61f16069d83cae046 Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Fri, 19 Jul 2024 11:54:10 +0200 Subject: [PATCH 5/7] Fix the 'Preview document' link when sharing ownership - The password should not be asked in this context - Remove deprecated use of the drive secret - Related to #1270 and #1521 --- www/common/common-ui-elements.js | 2 +- www/common/outer/mailbox-handlers.js | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/www/common/common-ui-elements.js b/www/common/common-ui-elements.js index f56584e19..10db8c37c 100644 --- a/www/common/common-ui-elements.js +++ b/www/common/common-ui-elements.js @@ -3559,7 +3559,7 @@ define([ $(link).click(function (e) { e.preventDefault(); e.stopPropagation(); - var obj = { pw: msg.content.password || '' }; + var obj = { pw: msg.content.password || '', f: 1 }; common.openURL(Hash.getNewPadURL(msg.content.href, obj)); }); diff --git a/www/common/outer/mailbox-handlers.js b/www/common/outer/mailbox-handlers.js index 06de11374..6ecac6a54 100644 --- a/www/common/outer/mailbox-handlers.js +++ b/www/common/outer/mailbox-handlers.js @@ -387,8 +387,10 @@ define([ var channel = content.channel || content.teamChannel; if (content.password) { + var uHash = ctx.store.data.blockHash; + var uSecret = Block.parseBlockHash(uHash); + var key = uSecret.keys.symmetric; content.pw = content.password; - var key = ctx.store.driveSecret.keys.cryptKey; content.password = Crypto.encrypt(content.password, key); } From 750635db4eeaf0ed662ede3f33ab49563136fe90 Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Fri, 19 Jul 2024 11:57:40 +0200 Subject: [PATCH 6/7] minor: use of let instead of var - To avoid some secrets to live outside their intended scope. --- www/common/outer/mailbox-handlers.js | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/www/common/outer/mailbox-handlers.js b/www/common/outer/mailbox-handlers.js index 6ecac6a54..0b98bbe9f 100644 --- a/www/common/outer/mailbox-handlers.js +++ b/www/common/outer/mailbox-handlers.js @@ -266,9 +266,9 @@ define([ } if (content.password) { - var uHash = ctx.store.data.blockHash; - var uSecret = Block.parseBlockHash(uHash); - var key = uSecret.keys.symmetric; + let uHash = ctx.store.data.blockHash; + let uSecret = Block.parseBlockHash(uHash); + let key = uSecret.keys.symmetric; content.password = Crypto.encrypt(content.password, key); } @@ -387,9 +387,9 @@ define([ var channel = content.channel || content.teamChannel; if (content.password) { - var uHash = ctx.store.data.blockHash; - var uSecret = Block.parseBlockHash(uHash); - var key = uSecret.keys.symmetric; + let uHash = ctx.store.data.blockHash; + let uSecret = Block.parseBlockHash(uHash); + let key = uSecret.keys.symmetric; content.pw = content.password; content.password = Crypto.encrypt(content.password, key); } From 8ceccb678c42e5d2d2fa5ca5a60e3bb8617e15b9 Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Fri, 19 Jul 2024 12:10:05 +0200 Subject: [PATCH 7/7] Cleaning code: use a function to encrypt the password - Use a function to encrypt the password for later use in URLs as it is used both to share a password-protected pad and share ownership of a password-protected pad; - related do #1270 and #1522. --- www/common/outer/mailbox-handlers.js | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/www/common/outer/mailbox-handlers.js b/www/common/outer/mailbox-handlers.js index 0b98bbe9f..906be2843 100644 --- a/www/common/outer/mailbox-handlers.js +++ b/www/common/outer/mailbox-handlers.js @@ -238,6 +238,14 @@ define([ cb(true); }; + // Encrypt the password under the right key before sending it via URL hash + var encryptPassword = function(ctx, password) { + let uHash = ctx.store.data.blockHash; + let uSecret = Block.parseBlockHash(uHash); + let key = uSecret.keys.symmetric; + return Crypto.encrypt(password, key); + }; + // Hide duplicates when receiving a SHARE_PAD notification: // Keep only one notification per channel: the stronger and more recent one var channels = {}; @@ -266,10 +274,7 @@ define([ } if (content.password) { - let uHash = ctx.store.data.blockHash; - let uSecret = Block.parseBlockHash(uHash); - let key = uSecret.keys.symmetric; - content.password = Crypto.encrypt(content.password, key); + content.password = encryptPassword(ctx, content.password); } // Update the data @@ -387,11 +392,8 @@ define([ var channel = content.channel || content.teamChannel; if (content.password) { - let uHash = ctx.store.data.blockHash; - let uSecret = Block.parseBlockHash(uHash); - let key = uSecret.keys.symmetric; content.pw = content.password; - content.password = Crypto.encrypt(content.password, key); + content.password = encryptPassword(ctx, content.password); } if (addOwners[channel]) { return void cb(true); }