Merge pull request #63698 from nextcloud/backport/63555/stable35

[stable35] fix: Check that password matches in occ user:auth-tokens:add

Author: AndyScherzinger

core/Command/User/AuthTokens/Add.php

@@ -12,8 +12,8 @@
 use OC\Authentication\Events\AppPasswordCreatedEvent;
 use OC\Authentication\Token\IProvider;
 use OC\Authentication\Token\IToken;
+use OC\User\Manager as UserManager;
 use OCP\EventDispatcher\IEventDispatcher;
-use OCP\IUserManager;
 use OCP\Security\ISecureRandom;
 use Symfony\Component\Console\Command\Command;
 use Symfony\Component\Console\Helper\QuestionHelper;
@@ -25,8 +25,8 @@
 
 class Add extends Command {
 	public function __construct(
-		protected IUserManager $userManager,
-		protected IProvider $tokenProvider,
+		private UserManager $userManager,
+		private IProvider $tokenProvider,
 		private ISecureRandom $random,
 		private IEventDispatcher $eventDispatcher,
 	) {
@@ -92,12 +92,21 @@ protected function execute(InputInterface $input, OutputInterface $output): int
 			$password = $helper->ask($input, $output, $question);
 		}
 
+		$loginName = $input->getOption('login-name') ?? $user->getUID();
+
 		if ($password === null) {
 			$output->writeln('<info>No password provided. The generated app password will therefore have limited capabilities. Any operation that requires the login password will fail.</info>');
+		} else {
+			$loggedInUser = $this->userManager->checkPasswordNoLogging($loginName, $password);
+			if ($loggedInUser === false) {
+				$output->writeln('<error>The given password is invalid for login ' . $loginName . '</error>');
+				return self::FAILURE;
+			} elseif ($loggedInUser->getUID() !== $user->getUID()) {
+				$output->writeln('<error>The user ' . $username . ' does not match the given login ' . $loginName . '</error>');
+				return self::FAILURE;
+			}
 		}
 
-		$loginName = $input->getOption('login-name') ?? $user->getUID();
-
 		$tokenName = $input->getOption('name') ?: 'cli';
 
 		$token = $this->random->generate(72, ISecureRandom::CHAR_UPPER . ISecureRandom::CHAR_LOWER . ISecureRandom::CHAR_DIGITS);