From 39996b5a3ba288f3807a67b1841359c9ba0b100e Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Mon, 3 Aug 2026 23:29:22 +0200 Subject: [PATCH 1/2] fix: fix sftp key loading Signed-off-by: Robin Appelman --- apps/files_external/lib/Lib/Auth/PublicKey/RSA.php | 8 ++++++-- .../lib/Lib/Auth/PublicKey/RSAPrivateKey.php | 9 +++++++-- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/apps/files_external/lib/Lib/Auth/PublicKey/RSA.php b/apps/files_external/lib/Lib/Auth/PublicKey/RSA.php index c55bb5c4ec3c7..7db842768ff8b 100644 --- a/apps/files_external/lib/Lib/Auth/PublicKey/RSA.php +++ b/apps/files_external/lib/Lib/Auth/PublicKey/RSA.php @@ -14,6 +14,7 @@ use OCP\IConfig; use OCP\IL10N; use OCP\IUser; +use phpseclib3\Crypt\PublicKeyLoader; use phpseclib3\Crypt\RSA as RSACrypt; /** @@ -46,15 +47,18 @@ public function __construct( #[\Override] public function manipulateStorageConfig(StorageConfig &$storage, ?IUser $user = null) { try { - $auth = RSACrypt::loadPrivateKey( + $auth = PublicKeyLoader::load( $storage->getBackendOption('private_key'), $this->config->getSystemValue('secret', '') ); } catch (\Throwable) { // Add fallback routine for a time where secret was not enforced to be exists - $auth = RSACrypt::loadPrivateKey($storage->getBackendOption('private_key')); + $auth = PublicKeyLoader::load($storage->getBackendOption('private_key')); } + if (!$auth instanceof RSACrypt\PrivateKey) { + throw new \RuntimeException('Loaded key is not a private key'); + } $storage->setBackendOption('public_key_auth', $auth); } diff --git a/apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php b/apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php index 16260c0d074f2..f2112dd9dc824 100644 --- a/apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php +++ b/apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php @@ -13,6 +13,7 @@ use OCP\IConfig; use OCP\IL10N; use OCP\IUser; +use phpseclib3\Crypt\PublicKeyLoader; use phpseclib3\Crypt\RSA; use phpseclib3\Exception\NoKeyLoadedException; @@ -45,17 +46,21 @@ public function __construct( public function manipulateStorageConfig(StorageConfig &$storage, ?IUser $user = null) { try { - $auth = RSA\PrivateKey::loadPrivateKey( + $auth = PublicKeyLoader::load( $storage->getBackendOption('private_key'), $this->config->getSystemValue('secret', ''), ); } catch (NoKeyLoadedException) { // Add fallback routine for a time where secret was not enforced to be exists - $auth = RSA\PrivateKey::loadPrivateKey( + $auth = PublicKeyLoader::load( $storage->getBackendOption('private_key'), '', ); } + + if (!$auth instanceof RSA\PrivateKey) { + throw new \RuntimeException('Loaded key is not a private key'); + } $storage->setBackendOption('public_key_auth', $auth); } } From f6b65414687701d7ba0ec7ac957aa6eba655f15f Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Tue, 26 May 2026 20:39:11 +0200 Subject: [PATCH 2/2] fix: clear key password after loading key Signed-off-by: Robin Appelman # Conflicts: # apps/files_external/lib/Lib/Auth/PublicKey/RSA.php # Conflicts: # apps/files_external/lib/Lib/Auth/PublicKey/RSA.php # apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php --- apps/files_external/lib/Lib/Auth/PublicKey/RSA.php | 1 + apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php | 2 ++ 2 files changed, 3 insertions(+) diff --git a/apps/files_external/lib/Lib/Auth/PublicKey/RSA.php b/apps/files_external/lib/Lib/Auth/PublicKey/RSA.php index 7db842768ff8b..166f208d82b2b 100644 --- a/apps/files_external/lib/Lib/Auth/PublicKey/RSA.php +++ b/apps/files_external/lib/Lib/Auth/PublicKey/RSA.php @@ -59,6 +59,7 @@ public function manipulateStorageConfig(StorageConfig &$storage, ?IUser $user = if (!$auth instanceof RSACrypt\PrivateKey) { throw new \RuntimeException('Loaded key is not a private key'); } + $auth = $auth->withPassword(''); $storage->setBackendOption('public_key_auth', $auth); } diff --git a/apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php b/apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php index f2112dd9dc824..7eb8f2bb67106 100644 --- a/apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php +++ b/apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php @@ -61,6 +61,8 @@ public function manipulateStorageConfig(StorageConfig &$storage, ?IUser $user = if (!$auth instanceof RSA\PrivateKey) { throw new \RuntimeException('Loaded key is not a private key'); } + + $auth = $auth->withPassword(''); $storage->setBackendOption('public_key_auth', $auth); } }