upstream/wekan
2
0 Fork 1
mirror of https://github.com/wekan/wekan.git synced 2026-11-05 21:44:59 -05:00
Code Releases 1 Activity

Continuous backup: a changed encrypted file is reported as changed, also with OpenSSL 4.

Browse Source 
A Node.js linked to OpenSSL 4 reports an AES-GCM tag mismatch as
ERR_OSSL_BAD_DECRYPT ("bad decrypt") instead of OpenSSL 3's "Unsupported
state or unable to authenticate data", so decryptFile() let the raw OpenSSL
error through instead of "An encrypted backup file has changed or the key is
wrong". Both are recognised now; tests/continuousBackupEncryption.test.cjs
passes with OpenSSL 4.1.0 and 3.5.9.

Thanks to xet7 !
This commit is contained in:
Lauri Ojansivu committed 2026-10-29 22:51:29 +02:00
1 parent ee16bdce6b
commit ffe49dd2fd
1 file changed
+4 -1
Download Patch File Download Diff File Expand all files Collapse all files
server/lib/continuousBackup/encryption.js
+4 -1
View File
@@ -92,7 +92,10 @@ function cipherFor(key) {
}
} catch (error) {
await fsp.rm(to, { force: true });
if (error.code === 'continuous-backup-key' || /auth/i.test(String(error.message))) refuse('An encrypted backup file has changed or the key is wrong');
// A GCM tag mismatch is "unable to authenticate data" with OpenSSL 3 and
// ERR_OSSL_BAD_DECRYPT ("bad decrypt") with OpenSSL 4, which a Node
// linked to the system OpenSSL uses.
if (error.code === 'continuous-backup-key' || error.code === 'ERR_OSSL_BAD_DECRYPT' || /auth/i.test(String(error.message))) refuse('An encrypted backup file has changed or the key is wrong');
throw error;
}
};