Web UI lostpassword.php is not calling warning message when encryption app is enabled

[gig13]

Expected behavior
When a user with encryption enabled goes to reset the password, the lostpassword.php file should be executed and the user is warned about the recovery key and losing all his/her data.

Actual behavior
The standard reset message is displayed, and the email notification message is displayed.

Steps to reproduce

1. Install owncloud and enable encryption
2. Setup personal information email and the recovery key
3. Logout
4. Attempt to login with an incorrect password

Server configuration
Ubuntu 14
MySql
OC7 beta2
Browser Firefox

[DeepDiver1975]

@LukasReschke seems like this fits into the mail settings pr you are working on - right?

[LukasReschke]

Mhm. This is again in another file but it can be fairly easily solved. Assigning to myself and trying to find some time end of the week.

That said: I still believe that the encryption app should use a per-instance key and not a per-user one. So many problems would go away…

[schiessle]

Just as a note: There was a warning on the old password reset page. It was removed because it was considered to be to alarming, if I remember correctly. Maybe it makes sense to include @jancborchardt into the discussion to make sure that we don't add, remove, add,... stuff and have one consistent opinion.

[jancborchardt]

Sounds like a note is in order here when people are about to lose their data.

[etiess]

I just experienced this confusion and I think a note is definitely necessary. This notification should be different in 2 cases:

1. If the user doesn't have a recovery key, he is informed that reseting the password will lead to data loss on the server. The user should clearly accept that (box to check or link to click on) in order to reset the password.
2. If the user has a recovery key, he is informed that reseting the password will allow him to access his account except his files (possible access to calendar, contacts, ...). And that he should contact the admin to recover full access.

My point is that a different message should be sent / displayed in each case. And that in case 2, he should be notified that he won't get access to his files without contacting the admin.

I was confused in #11661 and @schiesbn explained me this clearly (thank you ;) ). Once this notification is integrated, I can modifiy the documentation to explain this if you want.

And just to complete the information, @jancborchardt and @VicDeo are managing a modification in the password recovery process in #10353 . The objective is to integrate a:

1. double-entry of the password to avoid typing error
2. message indicating the reset was successful

Still, I think (and it's my opinion) that the password recovery should be possible by email. Why not with a 2-step verification process like in Gmail? I know it's difficult to integrate a verification with SMS, but the second step could be an email automatically sent to the admin. The admin can then decide to use the recovery key.

[butonic]

cc @owncloud/support-triagers

[LukasReschke]

Will be fixed with ownCloud 8: #11696