{"record":{"id":"3d7657748904de8e","repo":"nextcloud/all-in-one","slug":"please-enter-a-new-password","errorCode":null,"errorMessage":"Please enter a new password.","messagePattern":"Please enter a new password\\.","errorType":"validation","errorClass":"InvalidSettingConfigurationException","httpStatus":422,"severity":"warning","filePath":"php/src/Data/ConfigurationManager.php","lineNumber":814,"sourceCode":"        $this->borgRestorePassword = $password;\n        $this->instanceRestoreAttempt = true;\n        $this->commitTransaction();\n    }\n\n    /**\n     * @throws InvalidSettingConfigurationException\n     */\n    public function changeMasterPassword(string $currentPassword, string $newPassword) : void {\n        if ($currentPassword === '') {\n            throw new InvalidSettingConfigurationException(\"Please enter your current password.\");\n        }\n\n        if (!hash_equals($this->password, $currentPassword)) {\n            throw new InvalidSettingConfigurationException(\"The entered current password is not correct.\");\n        }\n\n        if ($newPassword === '') {\n            throw new InvalidSettingConfigurationException(\"Please enter a new password.\");\n        }\n\n        if (strlen($newPassword) < 24) {\n            throw new InvalidSettingConfigurationException(\"New passwords must be >= 24 digits.\");\n        }\n\n        if (!preg_match(\"#^[a-zA-Z0-9 ]+$#\", $newPassword)) {\n            throw new InvalidSettingConfigurationException('Not allowed characters in the new password.');\n        }\n\n        // All checks pass so set the password\n        $this->set('password', $newPassword);\n    }\n\n    /**\n     * @throws InvalidSettingConfigurationException\n     */\n    private function writeConfig() : void {","sourceCodeStart":796,"sourceCodeEnd":832,"githubUrl":"https://github.com/nextcloud/all-in-one/blob/6b788eec5e61733cf03ed380a3572e43ae3f11ce/php/src/Data/ConfigurationManager.php#L796-L832","documentation":"Thrown by ConfigurationManager::changeMasterPassword when the new-master-password field is an empty string. It is the first of four sequential validations on the new password (empty, length >= 24, allowed charset). The check runs after the current-password checks, so an empty current password or a wrong current password throws a different message first.","triggerScenarios":"POST to the AIO web configuration endpoint (ConfigurationController::SetConfig) with the 'new-master-password' form field present but empty, or with only 'current-master-password' filled in (the controller defaults the missing field to '').","commonSituations":"Automating the AIO setup form with curl and omitting the new password field; a browser extension or password manager clearing the field before submit; UI scripts that send the password-change form half-filled.","solutions":["Provide a non-empty 'new-master-password' value in the request body.","Verify the field name is exactly 'new-master-password' (hyphenated form keys, not underscores).","Check that your HTTP client is not stripping empty-looking values or mis-encoding the multipart/form body."],"exampleFix":"// before\ncurl -d 'current-master-password=oldpass' -d 'new-master-password=' https://host/api/webconfig\n\n// after\ncurl -d 'current-master-password=oldpass' -d 'new-master-password=<24+ char password>' https://host/api/webconfig","handlingStrategy":"validation","validationCode":"if ($newMasterPassword === '') {\n    // show a form error instead of calling changeMasterPassword()\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate required form fields client-side before POSTing to /api/webconfig.","When automating, only include the master-password form keys when you actually intend a password change."],"tags":["php","nextcloud-aio","input-validation","password","configuration"],"backgroundTag":"required-field-empty","analyzedSha":"6b788eec5e61733cf03ed380a3572e43ae3f11ce","analyzedAt":"2026-08-21T05:47:24.382Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}