{"record":{"id":"42a49d4cce421454","repo":"nextcloud/all-in-one","slug":"not-allowed-characters-in-the-new-password","errorCode":null,"errorMessage":"Not allowed characters in the new password.","messagePattern":"Not allowed characters in the new password\\.","errorType":"validation","errorClass":"InvalidSettingConfigurationException","httpStatus":422,"severity":"warning","filePath":"php/src/Data/ConfigurationManager.php","lineNumber":822,"sourceCode":"    public function changeMasterPassword(string $currentPassword, string $newPassword) : void {\n        if ($currentPassword === '') {\n            throw new InvalidSettingConfigurationException(\"Please enter your current password.\");\n        }\n\n        if (!hash_equals($this->password, $currentPassword)) {\n            throw new InvalidSettingConfigurationException(\"The entered current password is not correct.\");\n        }\n\n        if ($newPassword === '') {\n            throw new InvalidSettingConfigurationException(\"Please enter a new password.\");\n        }\n\n        if (strlen($newPassword) < 24) {\n            throw new InvalidSettingConfigurationException(\"New passwords must be >= 24 digits.\");\n        }\n\n        if (!preg_match(\"#^[a-zA-Z0-9 ]+$#\", $newPassword)) {\n            throw new InvalidSettingConfigurationException('Not allowed characters in the new password.');\n        }\n\n        // All checks pass so set the password\n        $this->set('password', $newPassword);\n    }\n\n    /**\n     * @throws InvalidSettingConfigurationException\n     */\n    private function writeConfig() : void {\n        if(!is_dir(DataConst::GetDataDirectory())) {\n            throw new InvalidSettingConfigurationException(DataConst::GetDataDirectory() . \" does not exist! Something was set up falsely!\");\n        }\n        // Shouldn't happen, but as a precaution we won't write an empty config to disk.\n        if ($this->config === []) {\n            return;\n        }\n        $df = disk_free_space(DataConst::GetDataDirectory());","sourceCodeStart":804,"sourceCodeEnd":840,"githubUrl":"https://github.com/nextcloud/all-in-one/blob/6b788eec5e61733cf03ed380a3572e43ae3f11ce/php/src/Data/ConfigurationManager.php#L804-L840","documentation":"Thrown when the new master password contains characters outside [a-zA-Z0-9 ] because the value must match ^[a-zA-Z0-9 ]+$ before it is stored. The restricted charset avoids quoting/escaping problems in the shell scripts and container environment where this password is consumed. It runs last, after the empty and length checks.","triggerScenarios":"Submitting a >= 24 character password containing punctuation or symbols, e.g. 'my-very-long-password!!!' (hyphens, exclamation marks), or any of !@#$%^&*()_+=.,;:'\"[]{}<>?/\\|~`.","commonSituations":"Password managers auto-generating symbol-laden passwords; users pasting passwords with trailing tabs/newlines; copy-paste introducing smart quotes from rich-text sources.","solutions":["Remove all non-alphanumeric characters (spaces are the sole exception) from the new password.","Regenerate the password restricted to letters, digits and spaces, with length >= 24.","Check for invisible characters (non-breaking space U+00A0, zero-width space) if a visually plain password still fails."],"exampleFix":"// before\n$new = 'Sup3r$ecret-Password-2024!!';\n\n// after\n$new = 'Sup3r Secret Password 2024 safe';","handlingStrategy":"validation","validationCode":"if (!preg_match('#^[a-zA-Z0-9 ]+$#', $newMasterPassword)) {\n    // strip or reject before calling changeMasterPassword()\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Restrict password-manager recipes to letters, digits and spaces for AIO.","Watch for invisible unicode (NBSP, zero-width) when plain passwords still fail."],"tags":["php","nextcloud-aio","password-policy","input-validation","configuration"],"backgroundTag":"password-policy-violation","analyzedSha":"6b788eec5e61733cf03ed380a3572e43ae3f11ce","analyzedAt":"2026-08-21T05:47:24.382Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}