Encryption module "Default encryption module" is not able to read [...]

[rapITler]

Steps to reproduce

1. Enforce password protection and enable default encryption
2. Upload and share file per mail.
3. Visit link in mail and click on download -> error will raised

How it works (but without a password!!!):

1. Enforce password protection and enable default encryption
2. Upload and share link with password protection
3. Share file per mail
4. Visit link in mail and click on download -> works without an password

Expected behaviour

Sharing per mail shouldn't work without a password.
Beside that fact may an error message should appear with the message "the download isn't possible without a password".

Actual behaviour

User which visit the link and click on download receive:
"Can't read file
Can not read this file, probably this is a shared file. Please ask the file owner to reshare the file with you."

or with shared link and mail:
User can download the file without a password.

Server configuration

Operating system:
CentOS 7.2
Web server:
Apache
Database:
mariadb

PHP version:
PHP 7.0.16
Nextcloud version: (see Nextcloud admin page)
11.0.1

Updated from an older Nextcloud/ownCloud or fresh install:
10.0.0

Where did you install Nextcloud from:
official page

Signing status:

Signing status

Integrity checker has been disabled. Integrity cannot be verified.

List of activated apps:

App list

Enabled:
  - activity: 2.4.1
  - admin_audit: 1.1.0
  - announcementcenter: 3.0.1
  - comments: 1.1.0
  - dav: 1.1.1
  - encryption: 1.4.1
  - federatedfilesharing: 1.1.1
  - federation: 1.1.1
  - files: 1.6.1
  - files_antivirus: 1.0.0.0
  - files_automatedtagging: 1.1.1
  - files_downloadactivity: 1.0.0
  - files_pdfviewer: 1.0.1
  - files_retention: 1.0.1
  - files_sharing: 1.1.1
  - files_texteditor: 2.2
  - files_trashbin: 1.1.0
  - files_versions: 1.4.0
  - files_videoplayer: 1.0.0
  - gallery: 16.0.0
  - logreader: 2.0.0
  - lookup_server_connector: 1.0.0
  - nextcloud_announcements: 1.0
  - notifications: 1.0.1
  - password_policy: 1.1.0
  - provisioning_api: 1.1.0
  - serverinfo: 1.1.1
  - sharebymail: 1.0.1
  - systemtags: 1.1.3
  - tasks: 0.9.4
  - templateeditor: 0.2
  - theming: 1.1.1
  - twofactor_backupcodes: 1.0.0
  - updatenotification: 1.1.1
  - user_ldap: 1.1.1
  - workflowengine: 1.1.1
Disabled:
  - external
  - files_accesscontrol
  - files_external
  - firstrunwizard
  - piwik
  - survey_client
  - user_external
  - user_saml

The content of config/config.php:

Config report

{
    "system": {
        "instanceid": "",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "",
            ""
        ],
        "datadirectory": "\/data",
        "overwrite.cli.url": "",
        "dbtype": "mysql",
        "version": "11.0.1.2",
        "dbname": "nextcloud",
        "dbhost": "localhost",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "",
        "installed": true,
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
        "ldapusercleanupinterval": 15,
        "loglevel": 2,
        "cron_log": true,
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "log_rotate_size": 104857600,
        "mail_from_address": "",
        "mail_smtpmode": "smtp",
        "mail_domain": "",
        "mail_smtphost": "",
        "mail_smtpport": "25",
        "mail_smtpsecure": "tls",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "auth.bruteforce.protection.enabled": true,
        "remember_login_cookie_lifetime": 86400,
        "session_lifetime": 28800,
        "session_keepalive": true,
        "updater.release.channel": "production",
        "maintenance": false,
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***"
    }
}

Are you using external storage, if yes which one: local/smb/sftp/...
SAN
Are you using encryption: yes/no
YES
Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
AD

LDAP configuration (delete this part if not used)

LDAP config

+-------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Configuration                 |                                                                                                                                                             |
+-------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------+
| hasMemberOfFilterSupport      | 1                                                                                                                                                           |
| hasPagedResultSupport         |                                                                                                                                                             |
| homeFolderNamingRule          |                                                                                                                                                             |
| lastJpegPhotoLookup           | 0                                                                                                                                                           |
| ldapAgentName                 | CN=,OU=ServiceAccount,OU=Users,OU=_Global,dc=,dc=|
| ldapAgentPassword             | ***                                                                                                                                                         |
| ldapAttributesForGroupSearch  |                                                                                                                                                             |
| ldapAttributesForUserSearch   |                                                                                                                                                             |
| ldapBackupHost                |                                                                                                                                                             |
| ldapBackupPort                |                                                                                                                                                             |
| ldapBase                      | dc=,dc=|
| ldapBaseGroups                | dc=,=|
| ldapBaseUsers                 | dc=,dc=|
| ldapCacheTTL                  | 600                                                                                                                                                         |
| ldapConfigurationActive       | 1                                                                                                                                                           |
| ldapDynamicGroupMemberURL     |                                                                                                                                                             |
| ldapEmailAttribute            | mail                                                                                                                                                        |
| ldapExperiencedAdmin          | 1                                                                                                                                                           |
| ldapExpertUUIDGroupAttr       |                                                                                                                                                             |
| ldapExpertUUIDUserAttr        |                                                                                                                                                             |
| ldapExpertUsernameAttr        | cn                                                                                                                                                          |
| ldapGroupDisplayName          | cn                                                                                                                                                          |
| ldapGroupFilter               | (&(|(objectclass=group))(|(memberof:1.2.840.113556.1.4.1941:=cn=,OU=,OU=Groups,OU=Admin,DC=,DC=)))                         |
| ldapGroupFilterGroups         |                                                                                                          |
| ldapGroupFilterMode           | 0                                                                                                                                                           |
| ldapGroupFilterObjectclass    | group                                                                                                                                                       |
| ldapGroupMemberAssocAttr      | member                                                                                                                                                      |
| ldapHost                      |                                                                                                                                          |
| ldapIgnoreNamingRules         |                                                                                                                                                             |
| ldapLoginFilter               | (&(&(|(objectclass=user)))(samaccountname=%uid))                                                                                                            |
| ldapLoginFilterAttributes     |                                                                                                                                                             |
| ldapLoginFilterEmail          | 0                                                                                                                                                           |
| ldapLoginFilterMode           | 0                                                                                                                                                           |
| ldapLoginFilterUsername       | 1                                                                                                                                                           |
| ldapNestedGroups              | 0                                                                                                                                                           |
| ldapOverrideMainServer        |                                                                                                                                                             |
| ldapPagingSize                | 500                                                                                                                                                         |
| ldapPort                      | 389                                                                                                                                                         |
| ldapQuotaAttribute            |                                                                                                                                                             |
| ldapQuotaDefault              |                                                                                                                                                             |
| ldapTLS                       | 0                                                                                                                                                           |
| ldapUserDisplayName           | displayname                                                                                                                                                 |
| ldapUserDisplayName2          |                                                                                                                                                             |
| ldapUserFilter                | (&(|(objectclass=user))(|(|(memberof:1.2.840.113556.1.4.1941:=CN=,OU=,OU=Groups,OU=Admin,DC=,DC=)(primaryGroupID=97011)))) |
| ldapUserFilterGroups          |                                                                                                                                 |
| ldapUserFilterMode            | 0                                                                                                                                                           |
| ldapUserFilterObjectclass     | user                                                                                                                                                        |
| ldapUuidGroupAttribute        | auto                                                                                                                                                        |
| ldapUuidUserAttribute         | auto                                                                                                                                                        |
| turnOffCertCheck              | 0                                                                                                                                                           |
| turnOnPasswordChange          | 0                                                                                                                                                           |
| useMemberOfToDetectMembership | 1                                                                                                                                                           |
+-------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------+

Client configuration

Browser:
Chrome
Operating system:
Windows 7

Logs

Web server error log

Web server error log

Insert your webserver log here

Nextcloud log (data/nextcloud.log)

nextcloud log

{"reqId":"WL6q3C0xlD4Y8papSsgRZgAAAAM","remoteAddr":"","app":"no app in context","message":"Encryption module \"Default encryption module\" is not able to read \/\/files\/bla.JPG","level":2,"time":"2017-03-07T13:43:09+01:00","method":"GET","url":"\/index.php\/s\/dEV8muxaWcmRIVo\/download","user":"--","version":"11.0.1.2"}
{"reqId":"WL6q3C0xlD4Y8papSsgRZgAAAAM","remoteAddr":"","app":"no app in context","message":"Exception: {\"Exception\":\"OC\\\\Encryption\\\\Exceptions\\\\DecryptionFailedException\",\"Message\":\"Encryption module \\\"Default encryption module\\\" is not able to read \\\\\\/files\\\/bla.JPG\",\"Code\":0,\"Trace\":\"#0 \\\/www\\\/lib\\\/private\\\/Files\\\/Storage\\\/Wrapper\\\/Encryption.php(328): OCA\\\\Encryption\\\\Crypto\\\\Encryption->isReadable('\\\..', NULL)\\n#1 \\\/www\\\/lib\\\/private\\\/Files\\\/Storage\\\/Wrapper\\\/Wrapper.php(169): OC\\\\Files\\\\Storage\\\\Wrapper\\\\Encryption->isReadable('files\\\/disk_132_...')\\n#2 \\\/www\\\/lib\\\/private\\\/Files\\\/Storage\\\/Wrapper\\\/Wrapper.php(169): OC\\\\Files\\\\Storage\\\\Wrapper\\\\Wrapper->isReadable('files\\\/disk_132_...')\\n#3 \\\/www\\\/lib\\\/private\\\/Files\\\/Storage\\\/Wrapper\\\/Wrapper.php(169): OC\\\\Files\\\\Storage\\\\Wrapper\\\\Wrapper->isReadable('files\\\/disk_132_...')\\n#4 \\\/www\\\/lib\\\/private\\\/Files\\\/View.php(1124): OC\\\\Files\\\\Storage\\\\Wrapper\\\\Wrapper->isReadable('files\\\/.')\\n#5 \\\/www\\\/lib\\\/private\\\/Files\\\/View.php(489): OC\\\\Files\\\\View->basicOperation('isReadable', '\\\/disk_132_too_h...')\\n#6 \\\/www\\\/lib\\\/private\\\/Files\\\/Filesystem.php(688): OC\\\\Files\\\\View->isReadable('\\\/\\\/disk_132_too_...')\\n#7 \\\/www\\\/lib\\\/private\\\/legacy\\\/files.php(261): OC\\\\Files\\\\Filesystem::isReadable('\\\/\\\/...')\\n#8 \\\/www\\\/lib\\\/private\\\/legacy\\\/files.php(120): OC_Files::getSingleFile(Object(OC\\\\Files\\\\View), '\\\/', '', Array)\\n#9 \\\/www\\\/apps\\\/files_sharing\\\/lib\\\/Controller\\\/ShareController.php(534): OC_Files::get('\\\/', '', Array)\\n#10 [internal function]: OCA\\\\Files_Sharing\\\\Controller\\\\ShareController->downloadShare('dEV8muxaWcmRIVo', NULL, '', '')\\n#11 \\\/www\\\/lib\\\/private\\\/AppFramework\\\/Http\\\/Dispatcher.php(160): call_user_func_array(Array, Array)\\n#12 \\\/www\\\/lib\\\/private\\\/AppFramework\\\/Http\\\/Dispatcher.php(90): OC\\\\AppFramework\\\\Http\\\\Dispatcher->executeController(Object(OCA\\\\Files_Sharing\\\\Controller\\\\ShareController), 'downloadShare')\\n#13 \\\/www\\\/lib\\\/private\\\/AppFramework\\\/App.php(114): OC\\\\AppFramework\\\\Http\\\\Dispatcher->dispatch(Object(OCA\\\\Files_Sharing\\\\Controller\\\\ShareController), 'downloadShare')\\n#14 \\\/www\\\/lib\\\/public\\\/AppFramework\\\/App.php(136): OC\\\\AppFramework\\\\App::main('ShareController', 'downloadShare', Object(OC\\\\AppFramework\\\\DependencyInjection\\\\DIContainer))\\n#15 \\\/www\\\/core\\\/routes.php(100): OCP\\\\AppFramework\\\\App->dispatch('ShareController', 'downloadShare')\\n#16 [internal function]: OC\\\\Route\\\\Router->{closure}(Array)\\n#17 \\\/www\\\/lib\\\/private\\\/Route\\\/Router.php(299): call_user_func(Object(Closure), Array)\\n#18 \\\/www\\\/lib\\\/base.php(1010): OC\\\\Route\\\\Router->match('\\\/s\\\/dEV8muxaWcmR...')\\n#19 \\\/www\\\/index.php(40): OC::handleRequest()\\n#20 {main}\",\"File\":\"\\\/www\\\/apps\\\/encryption\\\/lib\\\/Crypto\\\/Encryption.php\",\"Line\":496}","level":3,"time":"2017-03-07T13:43:09+01:00","method":"GET","url":"\/index.php\/s\/dEV8muxaWcmRIVo\/download","user":"--","version":"11.0.1.2"}

[schiessle]

Fix to allow you to access mail shares if the files are encrypted is here: #3751

Sharing per mail shouldn't work without a password.

The "enforce password" setting only applies to public links, as the setting indicates. We consider files shared by mail as something different, more "internal" (even if it is almost the same from a technical point of view). Maybe like a federated share for people who don't have a own Nextcloud. The link shared by mail is never shown in the web interface, in contrast to a public link which you can access on your web ui, post on social media, etc.

Discussions on how we could protect link shares with a additional password can be followed here: #2357