nextcloud/all-in-one · warning · InvalidSettingConfigurationException

Please enter a new password.

Error message

Please enter a new password.

What it means

Thrown by ConfigurationManager::changeMasterPassword when the new-master-password field is an empty string. It is the first of four sequential validations on the new password (empty, length >= 24, allowed charset). The check runs after the current-password checks, so an empty current password or a wrong current password throws a different message first.

Source

Thrown at php/src/Data/ConfigurationManager.php:814

        $this->borgRestorePassword = $password;
        $this->instanceRestoreAttempt = true;
        $this->commitTransaction();
    }

    /**
     * @throws InvalidSettingConfigurationException
     */
    public function changeMasterPassword(string $currentPassword, string $newPassword) : void {
        if ($currentPassword === '') {
            throw new InvalidSettingConfigurationException("Please enter your current password.");
        }

        if (!hash_equals($this->password, $currentPassword)) {
            throw new InvalidSettingConfigurationException("The entered current password is not correct.");
        }

        if ($newPassword === '') {
            throw new InvalidSettingConfigurationException("Please enter a new password.");
        }

        if (strlen($newPassword) < 24) {
            throw new InvalidSettingConfigurationException("New passwords must be >= 24 digits.");
        }

        if (!preg_match("#^[a-zA-Z0-9 ]+$#", $newPassword)) {
            throw new InvalidSettingConfigurationException('Not allowed characters in the new password.');
        }

        // All checks pass so set the password
        $this->set('password', $newPassword);
    }

    /**
     * @throws InvalidSettingConfigurationException
     */
    private function writeConfig() : void {

View on GitHub (pinned to 6b788eec5e)

Solutions

1. Provide a non-empty 'new-master-password' value in the request body.
2. Verify the field name is exactly 'new-master-password' (hyphenated form keys, not underscores).
3. Check that your HTTP client is not stripping empty-looking values or mis-encoding the multipart/form body.

Example fix

// before
curl -d 'current-master-password=oldpass' -d 'new-master-password=' https://host/api/webconfig

// after
curl -d 'current-master-password=oldpass' -d 'new-master-password=<24+ char password>' https://host/api/webconfig

if ($newMasterPassword === '') {
    // show a form error instead of calling changeMasterPassword()
}

When it happens

Trigger: POST to the AIO web configuration endpoint (ConfigurationController::SetConfig) with the 'new-master-password' form field present but empty, or with only 'current-master-password' filled in (the controller defaults the missing field to '').

Common situations: Automating the AIO setup form with curl and omitting the new password field; a browser extension or password manager clearing the field before submit; UI scripts that send the password-change form half-filled.

Related errors

• Please enter the password!
• Please enter your current password.
• Domain must contain at least one dot!
• Domain must not contain slashes!
• Domain must not contain colons!

AI-assisted analysis of nextcloud/all-in-one@6b788eec5e (2026-08-21). Data as JSON: /api/errors/3d7657748904de8e. Report an issue: GitHub.