nextcloud / nextcloud/server

[Bug]: Data encryption deletes data on external files when decrypted

Open
#57,485 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage 31-feedback bug feature: encryption (server-side) feature: external storage
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

⚠️ This issue respects the following points: ⚠️
Bug description

Open the data encryption function of Nextcloud, create new files, modify the original files, and test them. Finally, all the files are decrypted, and it is found that all the modified files (that is, decrypted files) have disappeared! !

Steps to reproduce
  1. Mount SFTP external storage in Next cloud.

  2. executing php occ encryption:enable on the nextcloud server: enable turns on the server encryption function.

  3. A new test.md file is created in the SFTP directory, and the contents are written casually.

  4. Viewing the file content in nextcloud is plaintext, and viewing the file content in SFTP server is ciphertext (as expected).

  5. I don't want to use the nextcloud encryption function, so I executed php occ encryption:decrypt-all and selected Y, indicating that the decryption was successful.

  6. Log in to the SFTP server to check and find that the test.md file does not exist! ! ! It should exist and the content is visible in plain text!

Expected behavior

Just decrypt the "encrypted" file, that's all.

It should not be that the decrypted file disappeared.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

SQlite

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?
  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other
Configuration report
{
    "system": {
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/bmV4dGNsb3VkCg\/dXNlcgo\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/bmV4dGNsb3VkCg\/dXNlcgo\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "upgrade.disable-web": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "121.41.51.10:8777"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "sqlite3",
        "version": "31.0.2.1",
        "overwrite.cli.url": "http:\/\/121.41.51.10:8777\/bmV4dGNsb3VkCg\/dXNlcgo",
        "installed": true,
        "maintenance": false
    }
}
List of activated Apps
Enabled:
  - activity: 4.0.0
  - app_api: 5.0.2
  - bruteforcesettings: 4.0.0
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contactsinteraction: 1.12.0
  - dashboard: 7.11.0
  - dav: 1.33.0
  - encryption: 2.19.0
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_downloadlimit: 4.0.0
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - firstrunwizard: 4.0.0
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - nextcloud_announcements: 3.0.0
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - password_policy: 3.0.0
  - photos: 4.0.0-dev.1
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - support: 3.0.0
  - survey_client: 3.0.0
  - systemtags: 1.21.1
  - text: 5.0.0
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - updatenotification: 1.21.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0
Disabled:
  - admin_audit: 1.21.0
  - files_external: 1.23.0
  - group_everyone: 0.1.17
  - onlyoffice: 9.7.0
  - suspicious_login: 9.0.1
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0
  - user_ldap: 1.22.0
Nextcloud Signing status

Nextcloud Logs

Additional info

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the php occ encryption:decrypt-all entry point and reproduce the report using an SFTP external-storage mount, Nextcloud Server 31, and the encryption module. Trace the decryption path for the created test.md file; done means the file remains on SFTP with its plaintext contents after decryption.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.