{"record":{"id":"c533f570fb476853","repo":"nextcloud/all-in-one","slug":"the-entered-current-password-is-not-correct","errorCode":null,"errorMessage":"The entered current password is not correct.","messagePattern":"The entered current password is not correct\\.","errorType":"validation","errorClass":"InvalidSettingConfigurationException","httpStatus":422,"severity":"error","filePath":"php/src/Data/ConfigurationManager.php","lineNumber":810,"sourceCode":"\n        $this->startTransaction();\n        $this->borgBackupHostLocation = $location;\n        $this->borgRemoteRepo = $repo;\n        $this->borgRestorePassword = $password;\n        $this->instanceRestoreAttempt = true;\n        $this->commitTransaction();\n    }\n\n    /**\n     * @throws InvalidSettingConfigurationException\n     */\n    public function changeMasterPassword(string $currentPassword, string $newPassword) : void {\n        if ($currentPassword === '') {\n            throw new InvalidSettingConfigurationException(\"Please enter your current password.\");\n        }\n\n        if (!hash_equals($this->password, $currentPassword)) {\n            throw new InvalidSettingConfigurationException(\"The entered current password is not correct.\");\n        }\n\n        if ($newPassword === '') {\n            throw new InvalidSettingConfigurationException(\"Please enter a new password.\");\n        }\n\n        if (strlen($newPassword) < 24) {\n            throw new InvalidSettingConfigurationException(\"New passwords must be >= 24 digits.\");\n        }\n\n        if (!preg_match(\"#^[a-zA-Z0-9 ]+$#\", $newPassword)) {\n            throw new InvalidSettingConfigurationException('Not allowed characters in the new password.');\n        }\n\n        // All checks pass so set the password\n        $this->set('password', $newPassword);\n    }\n","sourceCodeStart":792,"sourceCodeEnd":828,"githubUrl":"https://github.com/nextcloud/all-in-one/blob/6b788eec5e61733cf03ed380a3572e43ae3f11ce/php/src/Data/ConfigurationManager.php#L792-L828","documentation":"Second check in ConfigurationManager::changeMasterPassword(): hash_equals() compares the submitted current password against the stored 'password' value of the AIO config; a mismatch (constant-time string comparison) throws InvalidSettingConfigurationException → HTTP 422. The stored password is the mastercontainer login password set at first AIO login or the last successful change, and it is kept as a plain string in the mastercontainer's config.json volume.","triggerScenarios":"Typing a wrong or outdated AIO password; using the Nextcloud user-account password instead of the AIO interface password; pasting with stray whitespace or an autocorrected value; the password having been changed earlier and the old one reused.","commonSituations":"Confusing the AIO mastercontainer password with the Nextcloud login; a forgotten initial password (printed once at first mastercontainer start); shared installs where another admin changed the password.","solutions":["Use the AIO web-interface login password, not the Nextcloud user password","Recover the initial password from the first-startup output ('sudo docker logs nextcloud-aio-mastercontainer' prints it once) or read the 'password' entry from the mastercontainer's config.json in the docker-aio-config volume — the comparison is a plain string compare, so the stored value is the password","Re-check for typos, keyboard layout issues and pasted whitespace before concluding the password is lost"],"exampleFix":"// before\ncurrent-master-password = '<nextcloud user password>'\n// after\ncurrent-master-password = '<AIO interface login password>'","handlingStrategy":"try-catch","validationCode":"// No meaningful client-side pre-check exists: the comparison value is the\n// stored mastercontainer password. Require fresh authentication instead and\n// rely on catching the mismatch.","typeGuard":"function isInvalidSettingConfigurationException(\\Throwable $e): bool {\n    return $e instanceof \\AIO\\Data\\InvalidSettingConfigurationException;\n}","tryCatchPattern":"use AIO\\Data\\InvalidSettingConfigurationException;\n\ntry {\n    $configurationManager->changeMasterPassword($currentPassword, $newPassword);\n} catch (InvalidSettingConfigurationException $e) {\n    // wrong current password: show the message, keep the session,\n    // and rate-limit repeated attempts like any login flow\n    $formErrors[] = $e->getMessage();\n}","preventionTips":["Label the field clearly as the AIO interface password to avoid Nextcloud-account confusion","Rate-limit password-change attempts at the endpoint","Store the master password in a password manager at first login so it is never guessed"],"tags":["php","nextcloud-aio","password","authentication","configuration"],"backgroundTag":"incorrect-password","analyzedSha":"6b788eec5e61733cf03ed380a3572e43ae3f11ce","analyzedAt":"2026-08-21T05:47:24.382Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}