Session blocked when a user changes their password to one that is too long

Support intro

Sorry to hear you’re facing problems :slightly_frowning_face:

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud version (eg, 20.0.5): 28.0.1
Operating system and version (eg, Ubuntu 20.04): Debian 12
Apache or nginx version (eg, Apache 2.4.25): Apache 2.4.57 (Debian)
PHP version (eg, 7.4): 8.2.7

The issue you are facing:
Hi,
I’m currently running tests on a Nextcloud instance recently deployed by a colleague. During these tests I looked at whether there was a limit to the number of characters that could be entered when a user used the functionality to change their password.
I first tried with 800 characters and received a pop-up message ‘Unable to change personal password’. After a bit of research I came across a post indicating that the limit was set at 469, which is correct because I only get a pop-up after 470 characters.
Nextcloud | Report #1727424 - No password length limit when creating a user as an administrator | HackerOne
Also, I see in the hardening guidelines that bcrypt is only supposed to consider the first 72 characters which doesn’t seem to be the case here.

The problem is that if a user changes their password to a new one of between 215 and 469 characters, the server won’t display a pop-up, but will still accept the password (an error 500 is visible when inspecting the Network tab) and the user will no longer be able to log in.
When the user enters their credentials and logs in, they are automatically returned to the ‘Internal Server Error’ page and cannot do anything. The administrator then has to change their password to unblock it.
Do you think this is a problem on our side or could it be a bug?

Is this the first time you’ve seen this error? (Y/N): Y

Steps to replicate it:

  1. Login with a user and access /settings/user/security
  2. Change password with one whose length is between 215 and 469 characters
    2.1 Inspect Network tab
  3. Attempt to reconnect with the new password

The output of your Nextcloud log in Admin > Logging:
Formatted

[index] Error: base64_encode(): Argument #1 ($string) must be of type string, null given in file '/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php' line 400
	POST /index.php/login
	from x.x.x.x by xxxx at Apr 26, 2024, 11:18:19 AM

Raw

{"reqId":"ZitxWupCQwENSxkXUse59gAAAAM","level":3,"time":"2024-04-26T09:18:19+00:00","remoteAddr":"x.x.x.x","user":"xxxx","app":"index","method":"POST","url":"/index.php/login","message":"base64_encode(): Argument #1 ($string) must be of type string, null given in file '/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php' line 400","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36","version":"28.0.1.1","exception":{"Exception":"Exception","Message":"base64_encode(): Argument #1 ($string) must be of type string, null given in file '/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php' line 400","Code":0,"Trace":[{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":184,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":315,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/nextcloud/lib/base.php","line":1069,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":39,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","Line":169,"Previous":{"Exception":"TypeError","Message":"base64_encode(): Argument #1 ($string) must be of type string, null given","Code":0,"Trace":[{"file":"/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":400,"function":"base64_encode"},{"file":"/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":531,"function":"encryptPassword","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/public/AppFramework/Db/TTransactional.php","line":63,"function":"OC\\Authentication\\Token\\{closure}","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":500,"function":"atomic","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Token/Manager.php","line":245,"function":"updatePasswords","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Authentication/Listeners/UserLoggedInListener.php","line":60,"function":"updatePasswords","class":"OC\\Authentication\\Token\\Manager","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php","line":86,"function":"handle","class":"OC\\Authentication\\Listeners\\UserLoggedInListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":230,"function":"__invoke","class":"OC\\EventDispatcher\\ServiceEventListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":59,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":94,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":106,"function":"dispatch","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/User/Session.php","line":392,"function":"dispatchTyped","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/CompleteLoginCommand.php","line":39,"function":"completeLogin","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":39,"function":"process","class":"OC\\Authentication\\Login\\CompleteLoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/LoggedInCheckCommand.php","line":60,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":39,"function":"process","class":"OC\\Authentication\\Login\\LoggedInCheckCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/EmailLoginCommand.php","line":68,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":39,"function":"process","class":"OC\\Authentication\\Login\\EmailLoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/UidLoginCommand.php","line":53,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":39,"function":"process","class":"OC\\Authentication\\Login\\UidLoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/UserDisabledCheckCommand.php","line":57,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":39,"function":"process","class":"OC\\Authentication\\Login\\UserDisabledCheckCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/PreLoginHookCommand.php","line":52,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/Chain.php","line":107,"function":"process","class":"OC\\Authentication\\Login\\PreLoginHookCommand","type":"->"},{"file":"/var/www/nextcloud/core/Controller/LoginController.php","line":307,"function":"process","class":"OC\\Authentication\\Login\\Chain","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":230,"function":"tryLogin","class":"OC\\Core\\Controller\\LoginController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":137,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":184,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":315,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/nextcloud/lib/base.php","line":1069,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":39,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php","Line":400},"message":"base64_encode(): Argument #1 ($string) must be of type string, null given in file '/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php' line 400","exception":[],"CustomMessage":"base64_encode(): Argument #1 ($string) must be of type string, null given in file '/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php' line 400"},"id":"662b7787ace93"}

config.php:

<?php
$CONFIG = array (
  'instanceid' => 'xxxx',
  'passwordsalt' => 'xxxx',
  'secret' => 'xxxx',
  'trusted_domains' =>
  array (
    0 => 'x.x.x.x',
    1 => 'nextcloud.test.loc',
  ),
  'datadirectory' => '/var/www/nextcloud/data',
  'dbtype' => 'mysql',
  'version' => '28.0.1.1',
  'overwrite.cli.url' => 'https://nextcloud.test.loc',
  'installed' => true,
  'has_internet_connection' => false,
  'debug' => 'false',
  'maintenance' => false,
  'dbname' => 'xxxx',
  'dbhost' => '127.0.0.1',
  'dbuser' => 'xxxx',
  'dbpassword' => 'xxxx',
  'mail_from_address' => 'xxxx',
  'mail_smtpmode' => 'smtp',
  'mail_sendmailmode' => 'smtp',
  'mail_domain' => 'xxxx',
  'mail_smtphost' => 'xxxx',
  'mail_smtpport' => 'xxxx',
  'mail_smtpsecure' => 'ssl',
  'mail_smtpauth' => 1,
  'mail_smtpname' => 'xxxx',
  'mail_smtppassword' => 'xxxx',
);

Browser console error:

encryption.js:12 Uncaught ReferenceError: OC is not defined
    at encryption.js:12:1
(anonymous) @ encryption.js:12

Thanks in advance

1 Like

Thank you for reporting this “interesting” bug - really appreciated!

I would recommend to file a bug report at Issues · nextcloud/server · GitHub as such “in-depth” analysis is out of scope of this forum which is primarily intended for personal and non-commercial user support.

1 Like

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.