{"record":{"id":"73f66233777c99ca","repo":"nextcloud/all-in-one","slug":"new-passwords-must-be-24-digits","errorCode":null,"errorMessage":"New passwords must be >= 24 digits.","messagePattern":"New passwords must be >= 24 digits\\.","errorType":"validation","errorClass":"InvalidSettingConfigurationException","httpStatus":422,"severity":"warning","filePath":"php/src/Data/ConfigurationManager.php","lineNumber":818,"sourceCode":"\n    /**\n     * @throws InvalidSettingConfigurationException\n     */\n    public function changeMasterPassword(string $currentPassword, string $newPassword) : void {\n        if ($currentPassword === '') {\n            throw new InvalidSettingConfigurationException(\"Please enter your current password.\");\n        }\n\n        if (!hash_equals($this->password, $currentPassword)) {\n            throw new InvalidSettingConfigurationException(\"The entered current password is not correct.\");\n        }\n\n        if ($newPassword === '') {\n            throw new InvalidSettingConfigurationException(\"Please enter a new password.\");\n        }\n\n        if (strlen($newPassword) < 24) {\n            throw new InvalidSettingConfigurationException(\"New passwords must be >= 24 digits.\");\n        }\n\n        if (!preg_match(\"#^[a-zA-Z0-9 ]+$#\", $newPassword)) {\n            throw new InvalidSettingConfigurationException('Not allowed characters in the new password.');\n        }\n\n        // All checks pass so set the password\n        $this->set('password', $newPassword);\n    }\n\n    /**\n     * @throws InvalidSettingConfigurationException\n     */\n    private function writeConfig() : void {\n        if(!is_dir(DataConst::GetDataDirectory())) {\n            throw new InvalidSettingConfigurationException(DataConst::GetDataDirectory() . \" does not exist! Something was set up falsely!\");\n        }\n        // Shouldn't happen, but as a precaution we won't write an empty config to disk.","sourceCodeStart":800,"sourceCodeEnd":836,"githubUrl":"https://github.com/nextcloud/all-in-one/blob/6b788eec5e61733cf03ed380a3572e43ae3f11ce/php/src/Data/ConfigurationManager.php#L800-L836","documentation":"Thrown when the new master password is shorter than 24 characters (strlen check). Nextcloud AIO enforces a minimum length of 24 because this password protects the borg backup encryption key and the container's sudo-capable AIO user; shorter values are rejected before the charset check runs.","triggerScenarios":"Calling changeMasterPassword() (or POSTing the master-password form) with a newPassword shorter than 24 bytes. Note the check uses strlen, so multibyte characters count per byte, not per character.","commonSituations":"Users pasting a typical 12-16 character password; assuming the usual 8-12 character minimum applies; counting Unicode characters (e.g. 25 emoji/accented chars that are fewer than 24 bytes).","solutions":["Choose a password of at least 24 ASCII alphanumeric characters (and spaces, the only other allowed chars).","Generate one with a password manager, e.g. `openssl rand -base64 24 | tr -d '/+=' ` then keep only allowed characters.","If automating, add a client-side length check of >= 24 before submitting."],"exampleFix":"// before\n$newPassword = 'shortpw123';\n\n// after\n$newPassword = 'correct-horse-battery-9a7X'; // strlen >= 24, allowed charset","handlingStrategy":"validation","validationCode":"if (strlen($newMasterPassword) < 24) {\n    // reject before calling changeMasterPassword()\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Document the 24-character minimum wherever users pick the AIO master password.","Generate passwords with a manager and enforce >= 24 allowed characters upstream."],"tags":["php","nextcloud-aio","password-policy","input-validation","configuration"],"backgroundTag":"password-too-short","analyzedSha":"6b788eec5e61733cf03ed380a3572e43ae3f11ce","analyzedAt":"2026-08-21T05:47:24.382Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}