login() must be called after getServerPublicHostKey().

owncloud · Jul 12, 2014 · e18c8f2 · e18c8f2
1 parent d02604b
commit e18c8f2
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/apps/files_external/lib/sftp.php b/apps/files_external/lib/sftp.php
@@ -54,12 +54,8 @@ public function __construct($params) {
 		$hostKeys = $this->readHostKeys();
 		$this->client = new \Net_SFTP($this->host);
 
-		if (!$this->client->login($this->user, $this->password)) {
-			throw new \Exception('Login failed');
-		}
-
+		// The SSH Host Key MUST be verified before login().
 		$currentHostKey = $this->client->getServerPublicHostKey();
-
 		if (array_key_exists($this->host, $hostKeys)) {
 			if ($hostKeys[$this->host] != $currentHostKey) {
 				throw new \Exception('Host public key does not match known key');
@@ -68,6 +64,10 @@ public function __construct($params) {
 			$hostKeys[$this->host] = $currentHostKey;
 			$this->writeHostKeys($hostKeys);
 		}
+
+		if (!$this->client->login($this->user, $this->password)) {
+			throw new \Exception('Login failed');
+		}
 	}
 
 	public function test() {