Unable to share one password among users
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 823
- Forks
- 117
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 8
Description
Bug report
Steps to reproduce
- Create a password
- Create a second user
- Share password among users (just read access).
Expected behaviour
Other user can accept the shared password
and has it added in his storage.
Actual behaviour
Hint: Does ALSO happen on https://demo.passman.cc when you update passman to the latest version
Without clicking "accept" an error sometimes appears on top center saying:
An error occured during decryption
The XHR is 200 on index.php/apps/passman/api/v2/sharing/vault/{uuid}/get
but the response is empty (just [] on my server).
Clicking "Accept" won't add the password to the other users store.
Firefox console says:
Crypto stuff initialized passman.min.js:27:26050
Password fields present on an insecure (http://) page. This is a security risk that allows user login credentials to be stolen.[Learn More] passman
Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user’s experience. For more help http://xhr.spec.whatwg.org/
Yes, I have http only as long as nextcloud is in the internal network only.
Even disabling the HTTPS check won't change a thing.
Logs show:
| Error | PHP | Method OC_L10N_String::__toString() must return a string value at /var/www/nextcloud/lib/private/L10N/L10N.php#85 | 2017-11-03T07:55:52+0100 |
|---|---|---|---|
| Error | PHP | vsprintf(): Too few arguments at /var/www/nextcloud/lib/private/legacy/l10n/string.php#72 | 2017-11-03T07:55:52+0100 |
| Error | PHP | Only variables should be passed by reference at /var/www/nextcloud/apps/passman/controller/sharecontroller.php#235 | 2017-11-03T07:55:45+0100 |
| Error | PHP | Method OC_L10N_String::__toString() must return a string value at /var/www/nextcloud/lib/private/L10N/L10N.php#85 | 2017-11-03T07:54:31+0100 |
| Error | PHP | vsprintf(): Too few arguments at /var/www/nextcloud/lib/private/legacy/l10n/string.php#72 | 2017-11-03T07:54:31+0100 |
| Error | PHP | Only variables should be passed by reference at /var/www/nextcloud/apps/passman/controller/sharecontroller.php#235 | 2017-11-03T07:54:13+0100 |
| Error | PHP | Method OC_L10N_String::__toString() must return a string value at /var/www/nextcloud/lib/private/L10N/L10N.php#85 | 2017-11-03T07:54:06+0100 |
| Error | PHP | vsprintf(): Too few arguments at /var/www/nextcloud/lib/private/legacy/l10n/string.php#72 | 2017-11-03T07:54:06+0100 |
Configuration
Operating system: Ubuntu 16.04
Browser: Chrome
Extensions that might cause interference: None, as this fails on demo server too.
Passman version: 2.1.4
Operating system: Still Ubuntu.
Web server: Apache
Database: MariaDB
PHP version: 7.0.22
cloud server: Nextcloud 12
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at apps/passman/controller/sharecontroller.php around line 235 and trace the sharing API request at /api/v2/sharing/vault/{uuid}/get, using the reported PHP and decryption errors as clues. Reproduce the listed sharing and acceptance steps, then verify that a read-only recipient can accept the password and see it in their store without errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, php
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100