nextcloud/all-in-one · warning · InvalidSettingConfigurationException

Not allowed characters in the new password.

Error message

Not allowed characters in the new password.

What it means

Thrown when the new master password contains characters outside [a-zA-Z0-9 ] because the value must match ^[a-zA-Z0-9 ]+$ before it is stored. The restricted charset avoids quoting/escaping problems in the shell scripts and container environment where this password is consumed. It runs last, after the empty and length checks.

Source

Thrown at php/src/Data/ConfigurationManager.php:822

    public function changeMasterPassword(string $currentPassword, string $newPassword) : void {
        if ($currentPassword === '') {
            throw new InvalidSettingConfigurationException("Please enter your current password.");
        }

        if (!hash_equals($this->password, $currentPassword)) {
            throw new InvalidSettingConfigurationException("The entered current password is not correct.");
        }

        if ($newPassword === '') {
            throw new InvalidSettingConfigurationException("Please enter a new password.");
        }

        if (strlen($newPassword) < 24) {
            throw new InvalidSettingConfigurationException("New passwords must be >= 24 digits.");
        }

        if (!preg_match("#^[a-zA-Z0-9 ]+$#", $newPassword)) {
            throw new InvalidSettingConfigurationException('Not allowed characters in the new password.');
        }

        // All checks pass so set the password
        $this->set('password', $newPassword);
    }

    /**
     * @throws InvalidSettingConfigurationException
     */
    private function writeConfig() : void {
        if(!is_dir(DataConst::GetDataDirectory())) {
            throw new InvalidSettingConfigurationException(DataConst::GetDataDirectory() . " does not exist! Something was set up falsely!");
        }
        // Shouldn't happen, but as a precaution we won't write an empty config to disk.
        if ($this->config === []) {
            return;
        }
        $df = disk_free_space(DataConst::GetDataDirectory());

View on GitHub (pinned to 6b788eec5e)

Solutions

1. Remove all non-alphanumeric characters (spaces are the sole exception) from the new password.
2. Regenerate the password restricted to letters, digits and spaces, with length >= 24.
3. Check for invisible characters (non-breaking space U+00A0, zero-width space) if a visually plain password still fails.

Example fix

// before
$new = 'Sup3r$ecret-Password-2024!!';

// after
$new = 'Sup3r Secret Password 2024 safe';

if (!preg_match('#^[a-zA-Z0-9 ]+$#', $newMasterPassword)) {
    // strip or reject before calling changeMasterPassword()
}

When it happens

Trigger: Submitting a >= 24 character password containing punctuation or symbols, e.g. 'my-very-long-password!!!' (hyphens, exclamation marks), or any of !@#$%^&*()_+=.,;:'"[]{}<>?/\|~`.

Common situations: Password managers auto-generating symbol-laden passwords; users pasting passwords with trailing tabs/newlines; copy-paste introducing smart quotes from rich-text sources.

Related errors

• New passwords must be >= 24 digits.
• Domain must contain at least one dot!
• Domain must not contain slashes!
• Domain must not contain colons!
• Please enter a path or a remote repo url!

AI-assisted analysis of nextcloud/all-in-one@6b788eec5e (2026-08-21). Data as JSON: /api/errors/42a49d4cce421454. Report an issue: GitHub.